Slowloris for nginx DoS. Written in go
Switch branches/tags
Nothing to show
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
.gitignore add host header option Oct 15, 2016
LICENSE Initial commit Jan 28, 2014 Added an answer to which nginx versions are vulnerable to goloris Jan 28, 2014
goloris.go add host header option Oct 15, 2016

Goloris - slowloris[1] for nginx DoS


  • Features

    • Uses as low network bandwidth as possible.
    • Low CPU and memory usage.
    • Automatically and silently eats all the available TCP connections to the server.
    • Supports https.
    • Easily hackable thanks to clear and concise Go syntax and powerful Golang features.
  • Limitations

    • Can eat up to 64K TCP connections from a single IP due to TCP limitations. Just use proxies if you want overcoming this limitation :)
  • How it works?

    It tries occupying and keeping busy as much tcp connections to the victim as possible by using as low network bandwidth as possible. If goloris is lucky enough, then eventually it should eat all the available connections to the victim, so no other client could connect to it. See the source code for more insights.

  • How quickly it can take down unprotected nginx with default settings?

    In a few minutes with default config options.

  • Which versions of nginx are vulnerable?

    All up to 1.5.9 if unprotected as described below (i.e. with default config).

  • How to protect nginx against goloris?

    I know the following options:

  • How to use it?

go get -u -a go build ./goloris -help

P.S. Don't forget adjusting `ulimit -n` before experimenting.

And remember - goloris is published for educational purposes only.