Identifying Slow HTTP Attack Vulnerabilities on Web Applications | Qualys
Summary: Slow HTTP attacks exploit the HTTP protocol's requirement that requests be fully received before processing, so a single machine can open thousands of unfinished requests using minimal bandwidth and tie up server resources until a denial of service occurs. QualysGuard WAS detects slow headers (Slowloris, QID 150079) and slow POST (Are-You-Dead-Yet, QID 150085) by opening paired connections and checking whether the server closes the second more than 10 seconds after the first, and it flags a server that accepts a 65543 Kbyte POST body with a 200 response as QID 150086.
Why it matters: These attacks look like ordinary slow requests, so traditional anti-DoS tools struggle to detect them, and the article notes rumors that CIA.gov was attacked using slowloris. A single machine with minimal bandwidth is enough to generate thousands of unfinished requests, which means the resource at stake is your server's threads or sockets, not its network capacity.
Read the original at Qualys Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026