Content
- Attack scenarios4
HTTP - DoS Detection
Collection
- Version
- 0.3
- Name
- crowdsecurity/http-dos
Installation
sudo cscli collections install crowdsecurity/http-dosThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: crowdsecurity/http-dosscenarios:- crowdsecurity/http-dos-bypass-cache- crowdsecurity/http-dos-random-uri- crowdsecurity/http-dos-switching-ua- crowdsecurity/http-dos-invalid-http-versionslabels:label: "HTTP - DoS Detection"author: crowdsecuritytags:- security_engine- web- dos- http
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
Detecting HTTP DOS
This collection of scenarios detects specific HTTP DoS tools that are not detected by default HTTP scenarios.
To work correctly, it requires the associated HTTP collection of your webserver to be present, such as nginx or apache2.
Given the very nature of the scenarios, proper testing is advised to avoid false-positives:
- By replaying "cold" logs to ensure no false-positives are present
- By setting the scenarios in "simulation mode" for observability