{"id":25065806,"url":"https://github.com/dubniczky/slow-loris","last_synced_at":"2025-06-24T19:44:11.206Z","repository":{"id":50088007,"uuid":"518557284","full_name":"dubniczky/Slow-Loris","owner":"dubniczky","description":"Python implementation of the Slow Loris denial of service attack available on pip","archived":false,"fork":false,"pushed_at":"2022-07-27T17:49:52.000Z","size":53,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-06T19:49:11.741Z","etag":null,"topics":["attack","ddos","dos-attack","network","python"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dubniczky.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-07-27T17:43:52.000Z","updated_at":"2024-07-15T01:57:26.000Z","dependencies_parsed_at":"2022-09-23T06:23:09.684Z","dependency_job_id":null,"html_url":"https://github.com/dubniczky/Slow-Loris","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dubniczky%2FSlow-Loris","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dubniczky%2FSlow-Loris/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dubniczky%2FSlow-Loris/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dubniczky%2FSlow-Loris/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dubniczky","download_url":"https://codeload.github.com/dubniczky/Slow-Loris/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246473351,"owners_count":20783256,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["attack","ddos","dos-attack","network","python"],"created_at":"2025-02-06T19:45:06.345Z","updated_at":"2025-03-31T13:28:19.620Z","avatar_url":"https://github.com/dubniczky.png","language":"Python","funding_links":["https://www.buymeacoffee.com/dubniczky"],"categories":[],"sub_categories":[],"readme":"# Slow Loris DoS Attack\n\nPython implementation of the Slow Loris denial of service attack\n\n## Support ❤️\n\nIf you find the project useful, please consider supporting, or contributing.\n\n[![\"Buy Me A Coffee\"](https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png)](https://www.buymeacoffee.com/dubniczky)\n\n## Disclaimer\n\nThis tool is intended for demonstrational purposes, so only use against your systems or against ones you have authorization for. I take no responsibility for your actions.\n\n## Introduction\n\nSlow Loris is a low-bandwidth denial of service attack, utilizing lots of connections to the same host and keeping them alive while sending minimal data.\n\nWhen receiving a GET request, the server will wait until an empty line is sent to transmit the requested resource. We don't want any data in return, only to occupy the given connection.\n\nThe HTTP standard does not define a limit to the header count, but most frameworks have a limit defined in bytes, after which they will abort the connection. A default NodeJS 14+ setup has an upper limit of 16 kb. Using our current header size (average 15 bytes per header), it will take ~1,000 headers to fill this up.\n\nIf we consider an average of 5 seconds as a timeout period, one connection can occupy a channel for about 5000 seconds or around 1 hour 23 minutes. This happens while sending only 16kb of data.\n\nThis attack is most effective if:\n\n- The host has a hard-limited number of possible connections at a time\n- The host has no load balancing or firewalls\n- The host has no DoS protection\n- The attack is carried out by a distributed network of systems\n\n## Requirements\n\n- Python 3.10+\n- Optional: NodeJS 16+\n\n## Installation\n\n### Using Pip package manager\n\n```bash\npip install sloris\n```\n\n### Download repository\n\n```bash\ngit clone https://gitlab.com/richardnagy/security/sloris\ncd sloris\npython setup.py install\n```\n\n## Usage\n\n```bash\nsloris HOST_IP [OPTIONS]\n```\n\nHelp:\n\nUse the following command to get a list of options.\n\n```bash\nsloris -h\n```\n\nExample run\n\n```bash\nsloris localhost -p 8080 -c 1000 -m GET -u /page -t 5 -pc true\n```\n\n## Demo server\n\nThe demo server is written in native NodeJS with zero dependencies. You can start it by using:\n\n```bash\nnode testserver.node PORT\n```\n\n\u003e Please note that on UNIX systems, root privileges are required to run this script on a port lower than 1024\n\n## License\n\n[MIT](./LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdubniczky%2Fslow-loris","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdubniczky%2Fslow-loris","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdubniczky%2Fslow-loris/lists"}