www.leafonsword.org

Hardware

        CPU:1 core,2.3GHz

        Memory:512M

        DISK:4K random IOPS--5000 r/w

        Bandwith:80Mbps(Download),25Mbps(Upload)       

Protect by Cloudflare(or nexqcloud)

How:

Just change NS record to cloudflare(or nexqcloud)'s nameservers

Launch (D)DOS attack

With cloudflare(or nexqloud) protected

Attacks was absorbed by CDN,anything is as normal

bypass CDN's protection--Find real IP behind CDN(method 1)

Ping fake subdomain:

bypass CDN's protection--Find real IP behind CDN(method 2)

 By default dns resolver

bypass CDN's protection--Find real IP behind CDN(method 2)

Specified dns resolver

Find addtional  information

By Whatweb

Find Other website's information

By nmap

Consider attack purpose

Consuming something:

CPU

Mem

Disk

Bandwith

Consider 7 layer attack methods

I Choose HTTP Get Flood

Types of Layer 7 DDOS web attacks

Consider tools

Loic(loiq)

Hoic

OWASP HTTP Post Tool

SlowHTTPTest

Slowloris

Goloris

R.U.DY (R U Dead Yet?)

Example--Using loiq

Before attack

After attack

Tcpdump's output

After attack

Detect (D)DOS attacks

Method one

Monitor resource consuming

CPU、Mem、Disk、Network......

Method Two--Monitor connections

Defend (D)DOS attacks

Method One--timeout limits for HTTP headers

For Apache like web servers, waiting for the HTTP headers to complete sending is a basic and inherent behavior of web servers

So choose other web servers with timeout limits for HTTP headers,such as Nginx,IIS,lighttpd................

Apache could also use module(mod_antiloris)

Method Two--Limit Connections

Example--Nginx(ngx_http_limit_conn_module)

The ngx_http_limit_conn_module module is used to limit the number of connections per the defined key, in particular, the number of connections from a single IP address

http {
    limit_conn_zone $binary_remote_addr zone=addr:10m;

    ...

    server {

        ...

        location /download/ {
            limit_conn addr 1;
        }

Method Three--Block Attacker

(D)DOS Deflate

When triggering definded connection limit: