Discuss EC-Council 312-50 Exam Topic 19 Question 89

An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios. Which is most likely to result in the longest duration of server unavailability?

Am=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per
second, therefore likely staying operative, regardless of the hold-up time per connection

Bm=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections
exceed this, and with each connection held up for 15 seconds, the attack duration could be significant

C95, b=10: Here, the server can handle 95 connections per second, but it falls short against the
attacker's 100 connections, albeit the hold-up time per connection is lower

Dm=105, b=12: The server can manage 105 connections per second, more than the attacker's 100
connections, likely maintaining operation despite a moderate hold-up time

Suggested Answer: B

A Slow HTTP POST attack is a type of denial-of-service (DoS) attack that exploits the way web servers handle HTTP requests. The attacker sends a legitimate HTTP POST header to the web server, specifying a large amount of data to be sent in the request body. However, the attacker then sends the data very slowly, keeping the connection open and occupying the server's resources. The attacker can launch multiple such connections, exceeding the server's capacity to handle concurrent requests and preventing legitimate users from accessing the web server.

The attack duration D is given by the formula D = a * b, where a is the number of connections and b is the hold-up time per connection. The attacker intends to maximize D by manipulating a and b. The server can manage m connections per second, but any connections exceeding m will overwhelm the system. Therefore, the scenario that is most likely to result in the longest duration of server unavailability is the one where a > m and b is the largest. Among the four options, this is the case for option B, where a = 100, m = 90, and b = 15. In this scenario, D = 100 * 15 = 1500 seconds, which is the longest among the four options. Option A has a larger b, but a < m, so the server can handle the connections without being overwhelmed. Option C has a > m, but a smaller b, so the attack duration is shorter. Option D has a > m, but a smaller b and a smaller difference between a and m, so the attack duration is also shorter. Reference:

What is a Slow POST Attack & How to Prevent One? (Guide)

Mitigate Slow HTTP GET/POST Vulnerabilities in the Apache HTTP Server - Acunetix

What is a Slow Post DDoS Attack? | NETSCOUT

Get Premium 312-50 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

34 comments · newest first

Ty 11 months ago

Wait, how does 100 connections even work against 90? Sounds fishy!

Twanna 11 months ago

C might surprise you, even with lower hold-up time, it's still a struggle.

Ryann 11 months ago

A is definitely not a problem, server can handle that.

Jaime 12 months ago

I think D is safe, 105 connections should hold up fine.

Dick 12 months ago

B seems like the worst case, 100 connections over 90 is rough.

Adelina 1 year ago

I thought option D would keep the server running fine since it can handle more connections than the attacker is sending, but I'm not completely confident about the hold-up time's impact.

Cordelia 1 year ago

I practiced similar scenarios, and I feel like option B is definitely the worst case here because of the combination of too many connections and a longer hold-up time.

Audry 1 year ago

I'm not entirely sure, but I think option C might not be as bad as it sounds since the hold-up time is lower, even if the server is overwhelmed.

Mabel 1 year ago

I remember studying Slow HTTP attacks, and it seems like option B could lead to significant downtime since the server can't handle all 100 connections.

Jenelle 1 year ago

Whoa, this is a lot of information to process. I'm not sure I fully understand how the different variables interact. I'll need to re-read the question carefully and maybe even sketch out some diagrams to visualize the scenarios.

Marget 1 year ago

This is a tricky one, but I feel confident I can work through it. I'll start by calculating the attack duration for each scenario and then compare them to determine the most impactful one.

Jolanda 1 year ago

Okay, I think I've got a good strategy for this. I'll focus on the scenario where the server's capacity is just barely exceeded by the attacker's connections, as that's likely to result in the longest duration of server unavailability.

Brett 1 year ago

Hmm, I'm a bit confused by all the variables and numbers here. I'll need to really focus and break this down step-by-step to make sure I understand the implications of each scenario.

Lakeesha 1 year ago

This question seems pretty straightforward. I think I can handle it by carefully analyzing the different scenarios and considering the impact of the attacker's connections on the server's capacity.

Catherin 1 year ago

This question is really testing our understanding of the Sustainable Business Model Canvas. I think the best approach is to follow the sequence laid out in option C - it seems to hit all the key elements in a logical flow.

Pete 1 year ago

I'm not entirely sure about this one. The Lessons Report seems like it could be relevant to the quality management system, but I'm not sure who specifically should use that information to refine the standards.

Maryann 2 years ago

Well, at least the attacker isn't using a Slow Loris attack. That would be even more deliciously devious!

Carin 2 years ago

105 connections per second is more than enough to handle the attacker's 100 connections, and the 12-second hold-up time is manageable. This seems like the best option.

Ryan 2 years ago

↳ replying to Carin

Yeah, with 105 connections per second, the server should be able to handle the attack.

Tula 2 years ago

↳ replying to Carin

I agree, option D seems like the best choice.

Alaine 2 years ago

That's true, but the attacker's 100 connections could still cause some issues, especially if they are held up for a long time.

Almeta 2 years ago

But what about option A? The server can handle 110 connections per second, so it might not be as bad as option B.

Ludivina 2 years ago

95 connections per second is just not enough to handle the attacker's 100 connections, even with a lower hold-up time. I'd say this is the second-worst scenario.

Shala 2 years ago

With the server only able to handle 90 connections per second and the attacker's 100 connections held up for 15 seconds each, this scenario is definitely the most problematic.

Samuel 2 years ago

↳ replying to Shala

C) 95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower

Winfred 2 years ago

↳ replying to Shala

B) m=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections exceed this, and with each connection held up for 15 seconds, the attack duration could be significant

Eden 2 years ago

↳ replying to Shala

A) m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection

Ming 2 years ago

I agree with Alaine. With only 90 connections per second and each connection held up for 15 seconds, the server could be overwhelmed.

Alaine 2 years ago

I think option B is the most likely to result in the longest duration of server unavailability.

Nan 2 years ago

The server can handle 110 connections per second, so this scenario is the most likely to keep the server operational, even with the attacker's slow HTTP POST attack.

Chantell 2 years ago

↳ replying to Nan

D) m=105, b=12: The server can manage 105 connections per second, more than the attacker's 100 connections, likely maintaining operation despite a moderate hold-up time

Sylvia 2 years ago

↳ replying to Nan

C) 95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower

Gilberto 2 years ago

↳ replying to Nan

Jutta 2 years ago

↳ replying to Nan

A) m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection

EC-Council 312-50 Exam - Topic 19 Question 89 Discussion