Proj 17: Slowloris in Python (10 pts.)

What you need

Any computer with Python. I used a Mac.

Purpose

To practice capturing HTTP requests from Chrome and sending them with Python.

Task 1: GET in Python (10 pts.)

HEAD Request

Using a text editor, such as nano or Notepad, place this code in a file named head.py.

import socket s = socket.socket() req = """HEAD / HTTP/1.1 Host: ad.samsclass.info """ s.connect(("ad.samsclass.info", 80)) s.send(req) print s.recv(1024) s.close()

Save the file. Run the code with this command:

python head.py

You get a "200 OK" reply, as shown below.

Viewing a GET Request in Chrome Developer Tools

Open Chrome. On the top right, there is an icon with either three dots or three dashes. Click that icon, then click "More Tools", "Developer Tools".

In Chrome, go to http://ad.samsclass.info/

In Chrome Developer tools, click the Network tab. Scroll to the top. You should see a Name of ad.samsclass.info, as shown below.

In Chrome Developer Tools, click ad.samsclass.info. On the right side, scroll down to see the "Request Headers", as shown below.

In Chrome Developer Tools, in the "Request Headers" section, click "view source".

Highlight the source code, right-click it, and click Copy, as shown below.

GET Request in Python

Copy the head.py file to a new file named get.py

Open get.py in a text editor. Delete the contents of the "req" variable and paste in the text you copied from Chrome Developer Tools, as shown below.

At the end of the "req" text, insert two carriage returns, as shown below.

Save the file. Run the code with this command:

python get.py

You get a "200 OK" reply, as shown below.

Saving a Screen Image

Make sure the "200 OK" reply is visible, as shown above.

Capture a whole-desktop image.

YOU MUST SUBMIT A FULL-SCREEN IMAGE FOR FULL CREDIT!

Save the image with the filename "YOUR NAME Proj 17a", replacing "YOUR NAME" with your real name.

Task 2: HTTP Slowloris Attack (10 pts. extra credit)

To make the Slowloris attack, start with a working get.py script and make these three changes:

Remove one of the carriage returns at the end of the "req"
Send 100 requests, not just one
Open a new socket for each request. I recommend Creating a list of objects in Python
Pause before stopping the program, using either sleep() or a raw_input statement.

Open this page to see the effect of your attack:

http://ad.samsclass.info/server-status

Capture a whole-desktop image showing more than 100 requests being processed, as shown below.

Turning in your Project

Email the images to cnit.124@gmail.com with the subject line: Proj 17 from YOUR NAME.

Posted 9-5-17 by Sam Bowne