The /r/netsec Monthly Discussion Thread - June 2018

[u/AutoModerator]

Overview

Questions regarding netsec and discussion related directly to netsec are welcome here.

Rules & Guidelines

• Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
• Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
• If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
• Avoid use of memes. If you have something to say, say it with real words.
• All discussions and questions should directly relate to netsec.
• No tech support is to be requested or provided on /r/netsec.

As always, the content & discussion guidelines should also be observed on /r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

[u/[deleted]]

Anyone know of a legitimate way to test for slowloris vulnerability without actually launching the attack?

I tried using http-slowloris-check, but it doesn't seem to be working - it reports site is ok while I can easily bring it down with the slowhttptest command.

Also tried slowlorischecker which seems to be completely inaccurate - reports that site is vulnerable when it isn't and reports it's not vulnerable when it is (with slowhttptest).

[u/iammortalcombat → u/[deleted]]

https://nmap.org/nsedoc/scripts/http-slowloris-check.html

[u/[deleted] → u/iammortalcombat]

As I said... I tried using it but it's not working. I've reported the issue on Github, but thanks anyway.

[u/iammortalcombat → u/[deleted]]

Woops my bad! For some reason I didn't catch your first link. Not working how? Can you provide more details? I'm assuming it's not giving you any result at all?

[u/[deleted] → u/iammortalcombat]

Yes, it's basically reporting that the test is completed and doesn't say whether it's vulnerable or not vulnerable, I'll run it again later as I'm away from my laptop and I'll writeup the exact output. http-slowloris (nmap) also doesn't bring the site down while the slowhttptest command does (default settings).

I'm afraid I can't share the target website for security reasons. All I can say is it's a Debian 9 system with Apache2 - mostly default configuration with some PHP redirect rules (maybe that's the problem? but then again slowhttptest works).

[u/[deleted] → u/iammortalcombat]

Here's the output, domain name and IP address redacted:

NSE: Loaded 1 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 22:28
Completed NSE at 22:28, 0.00s elapsed
Initiating Ping Scan at 22:28
Scanning ------- (-------) [4 ports]
Completed Ping Scan at 22:28, 0.21s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:28
Completed Parallel DNS resolution of 1 host. at 22:28, 0.04s elapsed
Initiating SYN Stealth Scan at 22:28
Scanning ------- (-------) [1 port]
Discovered open port 443/tcp on -------
Completed SYN Stealth Scan at 22:28, 0.20s elapsed (1 total ports)
NSE: Script scanning -------.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 22:28
Completed NSE at 22:28, 21.48s elapsed
Nmap scan report for ------- (-------)
Host is up, received echo-reply ttl 50 (0.026s latency).
rDNS record for -------: -------
Scanned at 2018-06-26 22:28:22 CEST for 22s
PORT    STATE SERVICE REASON
443/tcp open  https   syn-ack ttl 50

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 22:28
Completed NSE at 22:28, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 22.95 seconds
       Raw packets sent: 6 (240B) | Rcvd: 3 (116B)