Difference in HEAD and GET for HTTP Request - why HEAD Request could be used for DDoS Attack?

This is something asasociated with HTTP Request - simply web browser request. I was curious why client request my website in differen t manners.

Below is web log I got recently stored in my apache web server log - actually the client source (IP address) is different:

270.137.243.151 - - [10/Oct/2024:11:06:02 -0700] "GET /knowledgebase/395/Snack-that-makes-my-mouth-happy-when-winter-comes/ HTTP/1.1" 200 85447 "https://abjohn.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
134.206.227.125 - - [10/Oct/2024:11:06:03 -0700] "HEAD /knowledgebase/395/Snack-that-makes-my-mouth-happy-when-winter-comes HTTP/1.1" 200 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"

The peculiar thing is that users call the same URL, one called GET and one called HEAD.

the difference between the GET and HEAD methods relates to how the HTTP requests interact with the server:

1. GET Request:
   • The GET method is used to request the full content of a resource (like a webpage, file, or other data).
   • In the first log entry, the GET request retrieves the full content of the webpage /knowledgebase/395/Snack-that-makes-my-mouth-happy-when-winter-comes/, and the response size is 85447 bytes (which indicates the server returned that much data).
2. HEAD Request:
   • The HEAD method is similar to GET, but it only requests the headers of the resource, without the body (i.e., it does not download the actual content of the webpage).
   • In the second log entry, the HEAD request for the same URL returned a 200 OK response but with no body (-), as indicated by the absence of a response size.

To summarize:

• GET retrieves the full content of the resource.
• HEAD retrieves only the headers (e.g., metadata like the content type or status code) without downloading the resource itself. This is often used to check the status of a resource without needing to download it.

I was wondering if HEAD method could be treated as DDoS attack. HEAD requests can be used as part of a DDoS (Distributed Denial of Service) attack, though on their own, they are less commonly used compared to GET or other methods in DDoS attacks. Here's why and how they could be involved:

Why HEAD Requests Could Be Used in DDoS Attacks:

1. Low Bandwidth, High Request Rate: Since HEAD requests only retrieve headers and not the full content, they require less bandwidth on the attacker’s side. This allows attackers to send a higher volume of requests in a short amount of time, overwhelming the server’s ability to process them.
2. Resource Consumption: Even though a HEAD request does not return the body of the resource, the server still needs to process the request and generate the headers. If an attacker sends a large number of HEAD requests, it can still consume CPU, memory, and connection resources on the server, which can lead to resource exhaustion.
3. Detection Evasion: Since HEAD requests are legitimate in nature (used by browsers, bots, and search engines for checking the status of a page), attackers may use them to try and bypass certain security measures that are designed to detect or block more typical DDoS attacks involving GET requests.
4. Server-Side Processing: Some applications handle HEAD requests in a similar way to GET requests, meaning that even though no body is returned, the backend still processes the request fully, including database queries or other heavy operations.

Comparison to GET-Based DDoS:

• GET requests in DDoS attacks often consume more bandwidth, since they retrieve the full content, but the server processes both GET and HEAD requests in similar ways from a resource perspective.
• HEAD requests can allow attackers to perform high-frequency attacks with lower bandwidth usage, which could make them harder to detect in some cases, especially if the server isn’t rate-limiting them.

Mitigation Strategies:

• Rate Limiting: Implement rate limiting for all types of HTTP requests, including HEAD requests, to avoid abuse.
• Traffic Monitoring: Monitor traffic patterns and inspect request headers. Large volumes of HEAD requests from the same IPs or IP ranges can be a sign of suspicious activity.
• Firewall Rules: Use Web Application Firewalls (WAF) to filter out suspicious patterns of HEAD requests.
• Request Throttling: Throttle the number of requests per second per client (IP) to prevent overload.

While HEAD requests are not as commonly used in DDoS attacks as GET or POST, they can still be leveraged as part of a broader attack or in combination with other methods to create a multi-vector DDoS attack.