Hi,
Our organization hosts a public facing website on IIS 7.
This weekend a very simple DOS attack caused the application pool to crash.
2014-04-05 19:15:39 dst_address POST / - 80 - src_address - - - 500 0 64 131852
2014-04-05 19:15:39 dst_address POST / - 80 - src_address - - - 500 0 64 131852
2014-04-05 19:15:39 dst_address POST / - 80 - src_address - - - 500 0 64 131852
2014-04-05 19:15:39 dst_address POST / - 80 - src_address - - - 500 0 64 131852
2014-04-05 19:17:49 dst_address POST / - 80 - src_address - - - 500 0 64 262034
2014-04-05 19:17:49 dst_address POST / - 80 - src_address - - - 500 0 64 262034
2014-04-05 19:17:49 dst_address POST / - 80 - src_address - - - 500 0 64 262034
2014-04-05 19:17:49 dst_address POST / - 80 - src_address - - - 500 0 64 262019
2014-04-05 19:19:55 dst_address POST / - 80 - src_address - - - 500 0 64 387194
2014-04-05 19:19:55 dst_address POST / - 80 - src_address - - - 500 0 64 387194
2014-04-05 19:19:55 dst_address POST / - 80 - src_address - - - 500 0 64 387210
2014-04-05 19:19:55 dst_address POST / - 80 - src_address - - - 500 0 64 387210
2014-04-05 19:22:05 dst_address POST / - 80 - src_address - - - 500 0 64 517236
2014-04-05 19:22:05 dst_address POST / - 80 - src_address - - - 500 0 64 517392
2014-04-05 19:22:05 dst_address POST / - 80 - src_address - - - 500 0 64 517236
2014-04-05 19:22:05 dst_address POST / - 80 - src_address - - - 500 0 64 517221
2014-04-05 19:24:15 dst_address POST / - 80 - src_address - - - 500 0 64 647185
2014-04-05 19:24:15 dst_address POST / - 80 - src_address - - - 500 0 64 647294
2014-04-05 19:24:15 dst_address POST / - 80 - src_address - - - 500 0 64 647357
2014-04-05 19:24:15 dst_address POST / - 80 - src_address - - - 500 0 64 647248
2014-04-05 19:26:25 dst_address POST / - 80 - src_address - - - 500 0 64 777321
2014-04-05 19:26:25 dst_address POST / - 80 - src_address - - - 500 0 64 777259
That was all it took to bring IIS 7 offline.
A couple of things I noticed...
#1 / is a .php file but it is not a form action, so POSTing to it shouldn't really do anything.
#2 the HTTP result code being 500 is odd...
Does anyone know of any ways to mitigate this or is my only hope putting a better webserver infront as a reverse proxy?