Editing Denial-of-service attack (section)

===HTTP slow POST DoS attack===
First discovered in 2009, the HTTP slow POST attack sends a complete, legitimate [[POST (HTTP)|HTTP POST header]], which includes a ''Content-Length'' field to specify the size of the message body to follow. However, the attacker then proceeds to send the actual message body at an extremely slow rate (e.g. 1 byte/110 seconds). Due to the entire message being correct and complete, the target server will attempt to obey the ''Content-Length'' field in the header, and wait for the entire body of the message to be transmitted, which can take a very long time. The attacker establishes hundreds or even thousands of such connections until all resources for incoming connections on the victim server are exhausted, making any further connections impossible until all data has been sent. It is notable that unlike many other DDoS or DDoS attacks, which try to subdue the server by overloading its network or CPU, an HTTP slow POST attack targets the ''logical'' resources of the victim, which means the victim would still have enough network bandwidth and processing power to operate.<ref>{{cite web |url=https://www.owasp.org/images/4/43/Layer_7_DDOS.pdf |archive-url=https://ghostarchive.org/archive/20221009/https://www.owasp.org/images/4/43/Layer_7_DDOS.pdf |archive-date=2022-10-09 |url-status=live|title=OWASP Plan - Strawman - Layer_7_DDOS.pdf |date=18 March 2014|website= Open Web Application Security Project|access-date=18 March 2014}}</ref> Combined with the fact that the [[Apache HTTP Server]] will, by default, accept requests up to 2GB in size, this attack can be particularly powerful. HTTP slow POST attacks are difficult to differentiate from legitimate connections and are therefore able to bypass some protection systems. [[OWASP]], an [[Open-source model|open source]] web application security project, released a tool to test the security of servers against this type of attack.<ref>{{cite web |url=https://www.owasp.org/index.php/OWASP_HTTP_Post_Tool |title=OWASP HTTP Post Tool |archive-url=https://web.archive.org/web/20101221131703/https://www.owasp.org/index.php/OWASP_HTTP_Post_Tool |archive-date=2010-12-21}}</ref>