|
|
| (10 intermediate revisions by 2 users not shown) |
| Line 2: |
Line 2: |
| | <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div> | | <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div> |
| | | | |
| − | Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
| + | The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]! |
| − | = Introduction =
| |
| − | __TOC__{{TOC hidden}}
| |
| | | | |
| − | This article is focused on providing clear, simple, actionable defense guidance for preventing denial of service in your web applications. Denial of Service attacks are very common due to two factors :
| + | Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html Denial of Service Cheat Sheet] to see the latest version of the cheat sheet. |
| − | | |
| − | # The significant prevalence of cloud and web services
| |
| − | # Easy to get testing tools to cause denial of service attacks.
| |
| − | | |
| − | Because it's very simple to launch the DOS attack, any web services don't have Anti-DOS defenses mitigation in place will be vulnerable to DOS attacks.
| |
| − | | |
| − | To avoid and mitigate DOS attack, both developers and operations engineering will need to have layered of defenses in place:
| |
| − | | |
| − | a) Service: When the service is built, it's developed with anti-DOS in mind such Input validation, Resource handling, Size or Length validation.
| |
| − | | |
| − | b) Web Host: Every Web server such Apache, NginX or Linux host provides the configuration of connection. Properly configure these network configuration may also help to mitigate the DOS attacks.
| |
| − | | |
| − | c) Infrastructure: Signature-based or behavior detection firewalls, load balance, fail-over, cloud anti-DDoS service
| |
| − | | |
| − | This objective of the article is to provide a list of common techniques for preventing DOS attack regardless of technology and platforms.
| |
| − | | |
| − | | |
| − | =Coding Defenses=
| |
| − | | |
| − | === Typical Denial Of Service Cases ===
| |
| − | * CVE-2002-0298 Server allows remote attackers to cause a denial of service via certain HTTP GET requests containing a %2e%2e (encoded dot-dot), several "/../" sequences, or several "../" in a URI.
| |
| − | * CVE-2000-0168 Microsoft Windows 9x operating systems allow an attacker to cause a denial of service via a pathname that includes file device names, aka the "DOS Device in Path Name" vulnerability.
| |
| − | * CVE-2000-0655 Chat client allows remote attackers to cause a denial of service or execute arbitrary commands via a JPEG image containing a comment with an illegal field length of 1.
| |
| − | * CVE-2001-1186 Web server allows remote attackers to cause a denial of service via an HTTP request with a content-length value that is larger than the size of the request, which prevents server from timing out the connection.
| |
| − | * CVE-2003-0327 Server allows remote attackers to cause a denial of service via a remote password array with an invalid length, which triggers a heap-based buffer overflow.
| |
| − | * CVE-2004-0095 Policy manager allows remote attackers to cause a denial of service (memory consumption and crash) and possibly execute arbitrary code via an HTTP POST request with an invalid Content-Length value.
| |
| − | * CVE-2004-0774 Server allows remote attackers to cause a denial of service (CPU and memory exhaustion) via a POST request with a Content-Length header set to -1.
| |
| − | * CVE-2004-0956 Database allows remote attackers to cause a denial of service (application crash) via a MATCH AGAINST query with an opening double quote but no closing double quote.
| |
| − | * CVE-2001-0738 Logging system allows an attacker to cause a denial of service (hang) by causing null bytes to be placed in log messages.
| |
| − | * CVE-2002-1023 Server allows remote attackers to cause a denial of service (crash) via an HTTP GET request without a URI.
| |
| − | * CVE-2002-1077 Crash in HTTP request without a Content-Length field.
| |
| − | * CVE-2004-0276 Server earlier allows remote attackers to cause a denial of service (crash) via an HTTP request with a sequence of "%" characters and a missing Host field.
| |
| − | | |
| − | | |
| − | = Web Services Defenses =
| |
| − | General web services protection against DOS can be listed as 3 main approach
| |
| − | # Max connection per IP address
| |
| − | # Max size of every HTTP request
| |
| − | # Timeout value of each HTTP request connection
| |
| − | | |
| − | ==NginX secure configuration==
| |
| − | | |
| − | ==== 1. Max Connection ====
| |
| − | # Connection limit configurations
| |
| − | limit_conn ip_limit_zone 64;
| |
| − | | |
| − | # Keep Alive connection will help every http request connection to reuse the same TCP connection.
| |
| − | keepalive_requests 100;
| |
| − | http://nginx.org/en/docs/http/ngx_http_core_module.html
| |
| − | | |
| − | ==== 2. Request Size ====
| |
| − | Limit the size of http request to mitigate the buffer overflow attack
| |
| − | client_body_buffer_size 100K;
| |
| − | client_header_buffer_size 1k;
| |
| − | client_max_body_size 100k;
| |
| − | large_client_header_buffers 2 1k;
| |
| − | | |
| − | ==== 3. Connection Timeout ====
| |
| − | Define the connection timeout value.
| |
| − | client_body_timeout 10;
| |
| − | client_header_timeout 10;
| |
| − | keepalive_timeout 5 5;
| |
| − | keepalive_requests 100;
| |
| − | send_timeout 10;
| |
| − |
| |
| − | == Apache secure configuration ==
| |
| − | | |
| − | ==== 1. Max Connection ====
| |
| − | <nowiki>#</nowiki>Define the max Http requests connection is allowed per TCP connection.
| |
| − | | |
| − | MaxKeepAliveRequests 100
| |
| − | | |
| − | <nowiki>#</nowiki> Reuses the same TCP port per client connection.
| |
| − | | |
| − | KeepAlive On
| |
| − | | |
| − | <nowiki>#</nowiki>Timeout value per connection to free up the server resources.
| |
| − | | |
| − | ==== 2. Request Size ====
| |
| − | <nowiki>#</nowiki>Limit the size of request Body (100K)
| |
| − | | |
| − | LimitRequestBody 102400
| |
| − | | |
| − | <nowiki>http://httpd.apache.org/docs/2.4/mod/core.html#limitrequestbody</nowiki>
| |
| − | | |
| − | ==== 3. Connection Timeout ====
| |
| − | <nowiki>#</nowiki>Define the general timeout value of every connection.
| |
| − | | |
| − | Timeout 10
| |
| − | | |
| − | <nowiki>http://httpd.apache.org/docs/2.4/mod/core.html#timeout</nowiki>
| |
| − | | |
| − | KeepAliveTimeout 15
| |
| − | | |
| − | <nowiki>http://httpd.apache.org/docs/2.4/mod/core.html#keepalive</nowiki>
| |
| − | | |
| − | = Network Infrastructure Defenses =
| |
| − | | |
| − | =Related Articles=
| |
| − | | |
| − | | |
| − | = Authors and Primary Editors =
| |
| − | | |
| − | [[User:Tony_Hsu_HsiangChih|Tony Hsu]] - hsiang_chih[at]yahoo.com<br />
| |
| − | | |
| − | <br />
| |
| − | == Other Cheatsheets ==
| |
| − | | |
| − | {{Cheatsheet_Navigation_Body}}
| |
| − | | |
| − | [[Category:Cheatsheets]]
| |
| − | [[Category:Popular]]
| |
