Slowloris DoS Attack: How Partial HTTP Requests Exhaust Server Resources
Which DoS attack exploits the HTTP protocol by sending partial HTTP requests to keep connections open, exhausting server resources?
Quick Answer
The answer is Slowloris. This Denial of Service attack exploits the HTTP protocol by sending partial HTTP requests—specifically, incomplete HTTP headers—to a web server, then maintaining those connections open indefinitely by periodically sending additional header fragments. Because the server waits for the request to complete before releasing the thread, each partial request consumes a server thread, and when enough connections are opened simultaneously, the server exhausts its thread pool and becomes unable to respond to legitimate traffic. On the Certified Ethical Hacker CEH exam, this question tests your understanding of application-layer DoS attacks versus network-layer floods; a common trap is confusing Slowloris with a SYN flood, but remember that Slowloris operates at Layer 7 using HTTP keep-alive mechanics. A useful memory tip: think of a slow-moving lizard—Slowloris sends headers slowly, one byte at a time, to keep the server waiting.
⚠ Common exam trap
EC-Council often tests the distinction between network-layer attacks (SYN flood, UDP flood) and application-layer attacks (Slowloris), so candidates mistakenly choose SYN flood because they associate 'partial requests' with TCP handshake manipulation rather than HTTP header manipulation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Slowloris
Slowloris is a DoS attack that exploits HTTP by opening multiple connections to the target web server and sending partial HTTP requests (e.g., incomplete headers) while never completing them. The server keeps each connection open, waiting for the rest of the request, eventually exhausting its connection pool and denying service to legitimate users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SYN flood
Why it's wrong here
SYN flood attacks the TCP handshake.
- ✓
Slowloris
Why this is correct
Slowloris keeps HTTP connections open.
- ✗
Ping of Death
Why it's wrong here
Ping of Death uses oversized ICMP packets.
- ✗
UDP flood
Why it's wrong here
UDP flood sends many UDP packets.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are examples of protocol-based DoS attacks? (Choose two.)
medium- ✓ A.Smurf attack
- ✓ B.SYN flood
- C.HTTP flood
- D.Slowloris
- E.UDP flood
Why A: The Smurf attack is a protocol-based DoS attack that exploits ICMP echo requests (ping) sent to a network's broadcast address with a spoofed source IP of the victim. This causes all hosts on the network to reply to the victim, overwhelming it with ICMP replies. It relies on the ICMP protocol at the network layer, making it a classic protocol-level attack. A SYN flood is also a protocol-based DoS attack that exploits the TCP three-way handshake. The attacker sends a flood of SYN requests to a server but never completes the handshake (doesn't send the final ACK). This leaves the server with many half-open connections, consuming its resources and preventing legitimate connections. It relies on the TCP protocol at the transport layer, making it a classic protocol-level attack.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.