Eccouncil Exam 312-50 Topic 9 Question 99 Discussion

Actual exam question for Eccouncil's 312-50 exam

Question #: 99
Topic #: 9

An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?

Am=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per
second, therefore likely staying operative, regardless of the hold-up time per connection

Bm=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections
exceed this, and with each connection held up for 15 seconds, the attack duration could be significant

C95, b=10: Here, the server can handle 95 connections per second, but it falls short against the
attacker's 100 connections, albeit the hold-up time per connection is lower

Dm=105, b=12: The server can manage 105 connections per second, more than the attacker's 100
connections, likely maintaining operation despite a moderate hold-up time

Show Suggested Answer

Suggested Answer: B

A Slow HTTP POST attack is a type of denial-of-service (DoS) attack that exploits the way web servers handle HTTP requests. The attacker sends a legitimate HTTP POST header to the web server, specifying a large amount of data to be sent in the request body. However, the attacker then sends the data very slowly, keeping the connection open and occupying the server's resources. The attacker can launch multiple such connections, exceeding the server's capacity to handle concurrent requests and preventing legitimate users from accessing the web server.

The attack duration D is given by the formula D = a * b, where a is the number of connections and b is the hold-up time per connection. The attacker intends to maximize D by manipulating a and b. The server can manage m connections per second, but any connections exceeding m will overwhelm the system. Therefore, the scenario that is most likely to result in the longest duration of server unavailability is the one where a > m and b is the largest. Among the four options, this is the case for option B, where a = 100, m = 90, and b = 15. In this scenario, D = 100 * 15 = 1500 seconds, which is the longest among the four options. Option A has a larger b, but a < m, so the server can handle the connections without being overwhelmed. Option C has a > m, but a smaller b, so the attack duration is shorter. Option D has a > m, but a smaller b and a smaller difference between a and m, so the attack duration is also shorter. Reference:

What is a Slow POST Attack & How to Prevent One? (Guide)

Mitigate Slow HTTP GET/POST Vulnerabilities in the Apache HTTP Server - Acunetix

What is a Slow Post DDoS Attack? | NETSCOUT

by Barrett at Dec 07, 2024, 12:19 AM

Limited Time Offer

25%

I think option B is the most likely to result in the longest duration of server unavailability.

upvoted 0 times

...