Share
## https://sploitus.com/exploit?id=B0B1EF25-DE18-534A-AE5B-E6E87669C1D2
# โก CVE-2023-44487 Demo โ HTTP/2 Rapid Reset Attack
This project demonstrates the HTTP/2 "Rapid Reset" vulnerability (CVE-2023-44487) that allows attackers to overwhelm servers using RST_STREAM frames, causing denial-of-service (DoS). It includes:
- โ
Exploit test using Golang-based tool
- โ
Vulnerable Apache HTTP/2 setup via Docker
- โ
Real-time monitoring with Webmin
- โ
Firewall-based mitigation with IPTables
---
## ๐ Folder Structure
- [`Setup/setup_guide.md`](Setup/setup_guide.md) โ Environment setup (attacker & victim)
- [`Detection/webmin_monitoring.md`](Detection/webmin_monitoring.md) โ Monitoring with Webmin
- [`Mitigation/iptables.md`](Mitigation/iptables.md) โ Firewall rule to stop the attack
- [`Images/`](Images/)
- `webmin_spike.png`
- `webmin_cpu.png`
- `apache_log.png`
- `README.md`
---
## โ๏ธ Setup Instructions
๐ View full setup guide here:
[`Setup/setup_guide.md`](Setup/setup_guide.md)
It includes:
- Cloning the original exploit repo
- Building the Golang tool
- Running the vulnerable Apache HTTP/2 container
- Installing and accessing Webmin
---
## ๐ต๏ธ Detection (Webmin Monitoring)
๐ **Guide**: Detection/webmin_monitoring.md
### ๐ธ Screenshots
Images/webmin_spike.png โ CPU spike during attack
Images/webmin_cpu.png โ Webmin CPU monitor
Images/apache_log.png โ Apache access logs
These visuals confirm that the exploit successfully triggers load and logs corresponding request activity.
---
## ๐ก๏ธ Mitigation (IPTables Firewall Rules)
๐ See: [`Mitigation/iptables.md`](Mitigation/iptables.md)
Highlights:
- Uses `hashlimit` to rate-limit connections per IP
- Drops excess HTTP/2 requests
- Protects the server from resource exhaustion
---
## Credits
This demo is based on [PatrickTulskie's `reset-rabbit`](https://github.com/PatrickTulskie/reset-rabbit), extended with:
- ๐ ๏ธ Step-by-step setup & detection documentation
- ๐ Visual proof of DoS using Webmin
- ๐ Custom IPTables rules to mitigate the attack
Created for educational use under controlled lab conditions.
---
## ๐ References
- [CVE-2023-44487 โ NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-44487)
- [Google Cloud โ Rapid Reset Blog](https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack)
- [Cloudflare: HTTP/2 vs HTTP/1.1](https://www.cloudflare.com/learning/performance/http2-vs-http1.1/)
- [Vicarius Security Blog. (2024)](https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause)
---
Created by **Harshitha Sha** โค๏ธ