HTTP Flood
{{Short description|Type of DDoS attack}}
{{Refimprove
| date = June 2017
}}
HTTP Flood is a type of Distributed Denial of Service (DDoS) attack in which the attacker manipulates HTTP and POST unwanted requests in order to attack a web server or application. These attacks often use interconnected computers that have been taken over with the aid of malware such as Trojan Horses. Instead of using malformed packets, spoofing and reflection techniques, HTTP floods require less bandwidth to attack the targeted sites or servers than layer-4 attacks.
Attack description
In an HTTP flood, the HTTP clients such as web browser interact with an application or server to send HTTP requests. The request can be either “GET” or “POST”. The aim of the attack is when to compel the server to allocate as many resources as possible to serving the attack, thus denying legitimate users access to the server's resources. Attackers inject legitimate looking, but randomised HTTP headers in an attempt to avoid detection, and make make use of proxies to hide their source IP address.
= GET flood =
The GET request is used to retrieve static content like images, scripts and style sheets. The request may simply fetch the root or specifically target large assets. The requests do not typically require authentication, cannot evade Captchas and induce relatively low load on the server per request.
= POST flood =
An HTTP POST flood (or simply POST flood) is a denial of service attack that uses POST requests, which are part of the Hypertext Transfer Protocol (HTTP).{{cite web|url=https://www.us-cert.gov/sites/default/files/publications/DDoS%20Quick%20Guide.pdf|publisher=National Cybersecurity and Communications Integration Center, Department of Homeland Security|title=DDoS Quick Guide|date=29 January 2014|access-date=2017-01-24}} As of late 2013, POST floods were increasingly being launched from mobile devices.{{cite web|last=Player |first=Chris |url=http://www.pcworld.com/article/2089510/mobile-devices-become-launchpads-for-ddos-attacks.html |title=Mobile devices become launchpads for DDoS attacks |publisher=PCWorld |date=2014-01-18 |accessdate=2017-01-24}}
POST requests are more likely to require the server to perform some kind of processing, such as looking up items in a database. Therefore, HTTP POST flood attacks typically impose higher load on the server per request.{{citationneeded|date=August 2022}}
Methods of mitigation
As HTTP flood attacks use standard URL requests, they are quite challenging to differentiate from valid layer-4 network traffic. One of the most effective mitigation methods is the combination of traffic profiling methods that mainly includes identification of IP reputation, tracking abnormal actions and employing progressive sanctuary challenges.{{Cite web|url=https://blog.sucuri.net/2014/02/layer-7-ddos-blocking-http-flood-attacks.html|title=Layer 7 DDOS – Blocking HTTP Flood Attacks|last=Cid|first=Daniel|date=February 6, 2014|website=Sucuri Blog|publisher=|access-date=December 7, 2016}}
References
{{reflist}}