312-50V11 · Question #757
Which of the following DoS tools is used to attack target web applications by starvation of available sessions on the web server? The tool keeps sessions at halt using never-ending POST…
The correct answer is C. R-U-Dead-Yet? (RUDY). R-U-Dead-Yet (RUDY) is a slow-rate application-layer DoS tool that starves a web server of available sessions by holding POST connections open indefinitely using a large Content-Length header and near-zero data transmission rate.
Question
Which of the following DoS tools is used to attack target web applications by starvation of available sessions on the web server? The tool keeps sessions at halt using never-ending POST transmissions and sending an arbitrarily large content-length header value.
Options
- AStacheldraht
- BLOIC
- CR-U-Dead-Yet? (RUDY)
- DMyDoom
How the community answered
(62 responses)- A5% (3)
- B2% (1)
- C90% (56)
- D3% (2)
Why each option
R-U-Dead-Yet (RUDY) is a slow-rate application-layer DoS tool that starves a web server of available sessions by holding POST connections open indefinitely using a large Content-Length header and near-zero data transmission rate.
Stacheldraht is a distributed DDoS tool that coordinates ICMP and SYN flood attacks against network-layer targets, not an application-layer session starvation tool.
LOIC (Low Orbit Ion Cannon) is a volumetric flood tool that overwhelms targets with high-rate UDP, TCP, or HTTP traffic, not a slow-rate session exhaustion attack.
RUDY attacks web servers by opening multiple HTTP POST connections, declaring an arbitrarily large Content-Length header, and then transmitting the request body one byte at a time at a very slow rate. This keeps each server session occupied indefinitely, exhausting the session pool and preventing legitimate users from connecting - a classic slow-rate starvation attack rather than a volumetric flood.
MyDoom is a mass-mailing worm that spreads via email and installs backdoors; it is not a web session starvation tool.
Concept tested: Slow-rate HTTP POST DoS session starvation attack
Source: https://owasp.org/www-community/attacks/Slow_HTTP_Attack
Topics
Community Discussion
No community discussion yet for this question.