New to CAPEC? Start Here
Home > CAPEC List > CAPEC-469: HTTP DoS (Version 3.9)  


Attack Pattern ID: 469
Abstraction: Standard
View customized information:
+ Description
An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wait to attacker's responses on the initiated HTTP sessions while the connection threads are being exhausted.
+ Typical Severity


+ Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
ChildOfMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.227Sustained Client Engagement
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
+ Prerequisites
HTTP protocol is usedWeb server used is vulnerable to denial of service via HTTP flooding
+ Resources Required
Ability to issues hundreds of HTTP requests
+ Mitigations
Configuration: Configure web server software to limit the waiting period on opened HTTP sessions
Design: Use load balancing mechanisms
+ Taxonomy Mappings
Section HelpCAPEC mappings to ATT&CK techniques leverage an inheritance model to streamline and minimize direct CAPEC/ATT&CK mappings. Inheritance of a mapping is indicated by text stating that the parent CAPEC has relevant ATT&CK mappings. Note that the ATT&CK Enterprise Framework does not use an inheritance model as part of the mapping to CAPEC.
Relevant to the ATT&CK taxonomy mapping (also see parent)
Entry IDEntry Name
1499.002Endpoint Denial of Service: Service Exhaustion Flood
+ References
[REF-406] Robert Hansen. "Slowris HTTP DoS". 2009-06-17. <>.
+ Content History
Submission DateSubmitterOrganization
(Version 2.6)
CAPEC Content TeamThe MITRE Corporation
Modification DateModifierOrganization
(Version 3.3)
CAPEC Content TeamThe MITRE Corporation
Updated Taxonomy_Mappings
(Version 3.4)
CAPEC Content TeamThe MITRE Corporation
Updated Mitigations
(Version 3.5)
CAPEC Content TeamThe MITRE Corporation
Updated Taxonomy_Mappings
(Version 3.8)
CAPEC Content TeamThe MITRE Corporation
Updated Taxonomy_Mappings
More information is available — Please select a different filter.
Page Last Updated or Reviewed: July 31, 2018