GO KALI FREE

Slowloris

Stress Testing

Intermediatehigh risk

Slowloris is a denial-of-service tool that allows a single machine to test a web server's resilience against resource exhaustion by keeping numerous HTTP connections open with partial requests.

Installation

pip install slowloris

Basic Syntax

slowloris [options] <target>

Quick Facts

Full Name
Slowloris
License
MIT License
Author
Robert "RSnake" Hansen
Written In
Python
Platforms
Linux, macOS, Windows
Category
Stress Testing
First Release
2009
Attack Type
Slow HTTP DoS

Tool Overview

Slowloris is a slow-rate HTTP denial-of-service testing tool that exploits a fundamental design limitation in threaded web servers. Instead of overwhelming a server with bandwidth, Slowloris opens hundreds of connections and keeps them alive by sending partial HTTP headers at slow intervals.

The attack works by sending incomplete HTTP requests — Slowloris sends the initial GET request but never sends the terminating headers. The server keeps the connection open waiting for the request to complete, eventually exhausting its connection pool and denying service to legitimate users.

Slowloris is notable for requiring minimal bandwidth — a single machine with a standard internet connection can take down an Apache server. This demonstrated a class of DoS vulnerabilities that rely on application-layer resource exhaustion rather than network-layer flooding.

Common Commands

pip3 install slowlorisInstall the Python Slowloris implementation from PyPI
slowloris example.comLaunch a Slowloris attack against a host on default port 80
slowloris 10.10.10.10 -p 80Attack a host by IP address on a specific port
slowloris example.com -p 443Target a service running on port 443
slowloris example.com -vRun with verbose output to watch connection activity
slowloris example.com -s 1000Open 1000 concurrent half-open sockets
slowloris example.com -s 150Use the default 150 sockets for a lighter test
slowloris example.com --sleeptime 10Send a keep-alive header every 10 seconds per socket
slowloris example.com -uaRandomize the User-Agent string on each connection
slowloris example.com --httpsAttack over TLS/HTTPS instead of plain HTTP
slowloris example.com -x --proxy-host 127.0.0.1 --proxy-port 8080Route the attack through a SOCKS/HTTP proxy
slowloris example.com -s 500 -v -uaCombine socket count, verbosity, and UA randomization
slowloris -hShow the Slowloris help and full option list
perl slowloris.pl -dns example.comRun the classic RSnake Perl Slowloris against a host
perl slowloris.pl -dns example.com -port 80Specify the target port for the Perl script

Step-by-Step Guide

  1. 1Define your target web server address
  2. 2Execute the script against the target
  3. 3Watch the active connection count grow
  4. 4Verify if legitimate users can still access the website
  5. 5Halt the execution and record the results

Use Cases

Web Server Testing

Evaluate how many concurrent slow connections your web server can handle before rejecting requests.

Timeout Configuration

Test connection timeout settings and verify proper request timeout values are configured.

Resilience Planning

Determine if your infrastructure needs reverse proxies or rate limiting to handle slow connection attacks.

Comparison Testing

Compare the behavior of different web server architectures (threaded vs event-driven) under load.

WAF Validation

Verify that Web Application Firewalls detect and block slow-rate HTTP attacks.

Key Features

Related Tools

GoldenEye

Stress Testing

HTTP KeepAlive stress testing tool with configurable worker threads.

hping3

Stress Testing

Network packet crafting tool for SYN floods and custom DoS tests.

Metasploit

Exploitation

Contains Slowloris auxiliary module for integrated exploitation framework testing.

Wireshark

Sniffing & Spoofing

Packet capture for analyzing slow HTTP connection behavior.

Frequently Asked Questions

What is Slowloris and how does it work?

Slowloris is a denial-of-service tool that keeps many HTTP connections open by sending partial HTTP headers at regular intervals. It opens connections to the target web server and sends incomplete HTTP requests, never completing them. The server keeps these connections open waiting for the request to finish, eventually exhausting all available connections.

Which servers are vulnerable to Slowloris?

Slowloris primarily affects threaded web servers like Apache that create a new thread for each connection. Event-driven servers like Nginx, Lighttpd, and modern Apache configurations with event MPM are resilient because they can handle many connections with few threads. Reverse proxies and load balancers can also mitigate the attack.

How do you defend against Slowloris?

Mitigations include using event-driven servers (Nginx), setting shorter connection timeouts, limiting connections per IP with mod_reqtimeout (Apache), using a reverse proxy (HAProxy, Nginx) that buffers connections, and deploying DDoS protection services like Cloudflare.

Is using Slowloris illegal?

Slowloris is a legitimate testing tool for evaluating web server resilience. However, using it against servers without explicit written authorization is illegal and constitutes a denial-of-service attack under laws like the CFAA and Computer Misuse Act. Only use Slowloris in lab environments or with written permission.

Tags

#stress-testing#dos#http#networking

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.