[Xitami] Xitami DoS/DDoS (CFM, PHP, Perl, and *ALL* CGIs)...

[Thomas J. Hruska]

At 10:15 AM 5/2/2002 -0400, Michael writeth:
>On 28 Apr 2002 at 22:23, Thomas J. Hruska wrote:
>
>> I previously e-mailed this list about a problem with 50 simultaneous
>> connections to CGI scripts under Xitami.  I have since performed
>> additional testing and have come to the conclusion that CGIs are a
>> fatal source of DoS/DDoS attacks with the Xitami webserver under
>> Windows [...snipped for brevity]
>
>How doesn one do 50 simultaneous connections?  I don't even 
>know 50 people <g>

Heavy server usage testing via a tool I wrote primarily for testing the
speed of scripting languages under various conditions...instead it has
become a tool I use now for debugging this particular DoS/DDoS.  It really
doesn't matter if you don't know 50 people.  As long as a malicious person
is willing to use a distributed attack tool, all they have to do is find a
CGI on a Xitami server and within 2-3 seconds, the server will grind to a
halt and start returning zero bytes of data to most clients (it will appear
to them that the server is busy or down and then proceed to go elsewhere).

Hope this helps!


          Thomas J. Hruska -- shinelight@shininglightpro.com
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/