Feedback Technical Grievances

  • 🔧 Site instability resolved. You can report double-posts and broken attachments. For bigger issues, use the Technical Grievances thread.
    🇵🇦 Nuestro primer dominio localizado está en español en kiwifarms.pa. Our first localized domain is on Spanish on kiwifarms.pa.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
Destacado
You are seeing this page because you are using adblocking, a proxy, are browsing in private mode, are using a browser that is incompatible, or you need to enable javascript and/or cookies.
If you feel you have reached this message in error, please click below to try again.


yeah this bitch can drink bleach, i hope she has cutting scars
 
Yeah dude, modified slowloris, right when I read your header when I logged in that was my first thought. Read your post a couple back and thought "he has good instincts." Pretty slick shit if your a skid from defcon 19. Sam Bowne continually giving people great ideas with no idea who he is giving great ideas to. Lol that ASN number is making you a target for the network nerds, Josh. Here comes the arms race; you mitigate, they attack, you mitigate, they change vectors again, story of an admin. It's like "Death of a Salesman" with worse dialogue.

My big fear is you were actually compromised and we are no longer talking to Josh. Would you submit to testing? Perhaps Voight-Kampff or DNA? Your choice.
 
Fondful Memories dijo:
Is slowloris still a thing in 2019?
Presiona para expandir...
I think the requirements to pull it off are much higher now. I realize in retrospect that this error has been around for a very long time with only slight success in causing problems. I think recently he's upgraded his stresser package.

Hoss dijo:
Wait....I thought Cloudflare could stop Slowloris?
Presiona para expandir...
It did. That was how I knew it was an attack.

kiwifarms.cc

Josh: “It was some sort of hostile activity but I don't know what to call it. Somehow, via HTTP, they were able to lock up hundreds of NGINX workers and hundreds of PHP-FPM workers without any spike in H...”

Josh (@josh@kiwifarms.cc): “It was some sort of hostile activity but I don't know what to call it. Somehow, via HTTP, they were able to lock up hundreds of NGINX workers and hundreds of PHP-FPM workers without any spike in H...”
kiwifarms.cc kiwifarms.cc
 
Fondful Memories dijo:
Is slowloris still a thing in 2019?
Presiona para expandir...

Unfortunately it's very hard to patch out a fragmented HTTP request because it assumes something down the line messed up and waits for another packet. Once it ABOUT hits the timeout limit it sends another fragment. Differentiating Slowloris from a really shitty connection is difficult but doable. Reverse Proxies usually stop them.
 
Null dijo:
I think the requirements to pull it off are much higher now. I realize in retrospect that this error has been around for a very long time with only slight success in causing problems. I think recently he's upgraded his stresser package.
Presiona para expandir...

I believe Apache is still quite vulnerable to it.

Null dijo:
One thing I need to figure out what happens if the php upstream is on a different server. Does it read local or remote files?
Presiona para expandir...

If it's on a different server then wouldn't it require an xmlhttprequest or are you routing it through a simple TCP connection?

BandAid dijo:
Yeah dude, modified slowloris, right when I read your header when I logged in that was my first thought. Read your post a couple back and thought "he has good instincts." Pretty slick shit if your a skid from defcon 19. Sam Bowne continually giving people great ideas with no idea who he is giving great ideas to. Lol that ASN number is making you a target for the network nerds, Josh. Here comes the arms race; you mitigate, they attack, you mitigate, they change vectors again, story of an admin. It's like "Death of a Salesman" with worse dialogue.

My big fear is you were actually compromised and we are no longer talking to Josh. Would you submit to testing? Perhaps Voight-Kampff or DNA? Your choice.
Presiona para expandir...

The scary thing is Slowloris isn't remotely the worst HTTP attack. Slowdroid is a good example of a server killer (You can kill a server with your phone). HTTP. REST, and other Layer 7 protocols have some jank shit you can exploit like requesting a window size of 0. Or just do what Slowdroid does and send a HTTP header with nothing but spaces behind it. There are also BASH exploits as well.
 
Última edición:
Was someone doing this attack on Kiwi Farms?

en.wikipedia.org

Slowloris (computer security) - Wikipedia

en.wikipedia.org en.wikipedia.org

Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to—but never completing—the request. Affected servers will keep these connections open, filling their maximum concurrent connection pool, eventually denying additional connection attempts from clients.[1]
Presiona para expandir...

Informative video by Dr Mike Pound, whom God preserve!

 
Última edición:
It's not just that. People have been trying a lot of shit. I'm getting good at mitigating it.

Traffic this month.
1564413520635.png

Traffic this week.
1564413595777.png

Traffic last 24 hours.
1564413677136.png
 
Destacado
Debes iniciar sesión o registrarte para responder aquí.
Atrás
Top Abajo