What hit my webservice with 408?!
summary
A Java web service on AWS behind a load balancer goes unresponsive for half an hour after a scanner causes many requests to return 408 vs 404, costing CPU on EC2; the access logs show a single IP from Rapid7/Metasploit and short requests correlate with 408s. Investigation uses access logs analyzed with Excel pivot tables (million-row support), VPC flow logs, WAF request samples (no bodies) and a support ticket to Rapid7. Fix is whitelisting at the cloud edge, which reduces wasted processing and stops the 408 flood by handling requests before the app.
AI-written summary · about
chapters (4)
related talks
42mRunning at 99% Surviging an Application DoS
27mSecuring Applications and Managing WAFs at a large scale
01h 04mServer-Side Browsing Considered Harmful
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
52mKnock Knock: Understanding Who is Using Your Web Applications
52mDevSecOps
11mAWS On Air ft. Automatic Application Layer DDoS
47mHow Catch Group uses AWS WAF Bot Control on their ecommerce platform