Slow POST Attack

The Slow POST Attack, also known as RUDY (R U U Dead Yet) works by sending HTTP POST requests to a targeted server. These requests include a very large value in the Content-Length field, signaling to the server that a significant amount of data is forthcoming. However, the attacker transmits only a minimal amount of data (e.g., a single byte). This process is then repeated, with the attacker sending small data packets at random intervals, as illustrated in Fig. With this strategy, the attacker can consume server resources using a relatively small amount of traffic. Due to the server’s expectation of receiving a large data volume based on the high Content-Length value, it keeps the connection open indefinitely. This overwhelm the server resources and prevent legitimate clients to connect.