Hi there.
This is Pinal Dave, and I welcome all of you to this new course,
Impact with Slowloris.
In this course,
we are going to talk about MITRE ATT&CK methodology and
particularly focus on DoS attack and DDoS attack.
Let us talk about Slowloris.
If you search this word on the internet you will end
up on this cute and cuddly animal.
It is usually spotted in Southeast Asia.
However, when we are talking about Slowloris impact tool,
which we use in the red team engagement,
the tool is very impactful when used for an attack on target.
Let us learn a little bit more about Slowloris.
This tool is created by Gokberk.
Gokberk has done many different tools,
and I have included the link to his website in our resources section.
Slowloris is an HTTP denial‑of‑service attack that affects threaded servers.
This exhausts the server's thread pool,
and the server can't reply to other people.
Now,
let's understand why we should use Slowloris in our MITRE ATT&CK methodology.
Slowloris is an impact tool.
The impact methodology of MITRE ATT&CK consists of techniques to
disrupt our ability or compromise integrity by manipulating
business and operational processes.
Essentially, a denial‑of‑service, or DoS,
attack is used to consume website resources so that user who
needs to access the site cannot access them.
Because a DoS attack can be easily originated from nearly any location,
finding those responsible can be extremely difficult.
When multiple origins of DoS attack as a single endpoint as a target,
the attack of DoS becomes DDoS, which is more effective and dangerous.
The real question is that why should we use Slowloris?
Well, the answer is,
this tool generates a traffic and attack which is extremely difficult to
differentiate from legit traffic for a target server.
Here are three primary reasons which make Slowloris a very unique tool.
The first one is that it keeps the connections open with target.
The second one is that when it sends the traffic it can randomize user‑agent.
And the third one is that we can adjust time to sleep between
header which we send from attacker to target.
Now is the time to discuss kill chain.
If you are familiar with the red team kill chain,
we can map the Slowloris tool to all the phases after reconnaissance.
It actually focuses, making the server unresponsive by various actions,
like manipulation and interruption.
In real world,
I've seen many using this tool as a distraction to the end user's security team.
While the security team focuses on preventing the DDoS attacks,
often there are other attacks happening in parallel,
damaging a system.
Here is the list of MITRE ATT&CK tactics.
We are going to focus in this course about impact.
When we are talking about impact,
particularly we are going to focus on two tactics.
The first one is T1498, which is Network Denial of Service,
and the second one is T1499, Endpoint Denial of Service.
Ultimately we are going to see the target is not going to serve legit user.
Now, both of these we are going to explore in demonstration,
but before we go to demonstration, we must understand that we must stay legal.
I want you to keep in mind that performing any of those
attacks without authorization is illegal.
And this means that if you start such an attack on the
server which eventually stops responding,
it gets you in legal trouble.
I can't stress enough that this tool and teaching is for you to learn what
can worst happen to your server if someone attacks you.
The learning from the course should be applied in such a way that
it protects you during unwanted attack scenario.
If you are working on a red team project,
make sure that you have all the authorizations in place.
Before we go to demonstration, let's understand how Slowloris works,
as well as a legit request from a user to a web server.
On the screen,
I have a diagram when there is a normal computer which is
sending HTTP header to a web server.
Now web server processes this request and response is
sent back to a normal computer.
This will all work fine, and eventually web server will close the thread.
This is happening every day when we are surfing the web.
Let's assume that we do not have a normal computer,
but there is a person with malicious intention and it
uses Slowloris to attack our server.
In normal case, we would have one or two threads from user.
However, in case of Slowloris attack, by default,
it sends around 150 HTTP headers.
Now our target server would think this is absolutely normal
and start processing each of these threads.
The problem is that each of these HTTP headers are kept
alive and resent at fixed intervals.
This will further confuse our target server because it
will keep on receiving HTTP headers,
which are kept open and continuously keeping our server engaged.
Every single threaded server has a limit of how many threads they can process.
Eventually,
our threaded server will give up when number of HTTP
headers are more than what it can process.
The final result will be that our server will stop responding,
and this is when denial‑of‑service attack is successful.
One final thing before we jump to demonstration.
Currently on the diagram, we are seeing a single computer.
When there are multiple computers from different locations and IP addresses,
the same attack, which is DoS, becomes distributed denial‑of‑service attack.
Well, now is the time for demonstration.