Web Application Defender's Cookbook

Recipe 12-1: Detecting High Application Access Rates

This recipe shows you how to use ModSecurity to determine when individual clients are making a large number of requests within a specified time window.

Ingredients

• OWASP ModSecurity Core Rule Set (CRS)
  • modsecurity_crs_10_setup.conf
  • modsecurity_crs_11_dos_protection.conf
• ModSecurity
  • IP:DOS_COUNTER variable
  • IP:DOS_BURST_COUNTER variable
  • IP:DOS_BLOCK variable
  • @gt operator
  • setvar action

CAPEC-125: Resource Depletion through Flooding

An attacker consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow control in management of interactions. Since each request consumes some of the target’s resources, if a sufficiently large number of requests must be processed at the same time then the target’s resources can be exhausted.

The degree to which the attack is successful depends upon the volume of requests in relation to the amount of the resource the target has access to, and other mitigating circumstances such as the target’s ability to shift load or acquired additional resources to deal with the depletion. The more protected the resource and the greater the quantity of it that must be consumed, the more resources the attacker may need to have at their disposal. A typical TCP/IP flooding attack is a Distributed Denial-of-Service attack where many machines simultaneously make a large number of requests ...