New Open-Source Tool for Slow HTTP DoS Attack Vulnerabilities | Qualys
Summary: Qualys researcher Sergey Shekyan released slowhttptest, an open-source tool that opens and maintains configurable slow HTTP connections to measure a server's limits, inspired by Robert "Rsnake" Hansen's Slowloris and Tom Brennan's OWASP slow post tools. In a lab test, the tool opened 1,000 connections at 200 per second, the server processed only 377 concurrently, and denial of service was achieved within the first 5 seconds and lasted 60 seconds until the server timed out connections.
What's compelling: Slow HTTP attacks need minimal resources from the attacker, and a server that can only handle 377 of 1,000 concurrent connections can be knocked over in 5 seconds by a single low-cost client.
Read the original at Qualys Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026