lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <6194.1101844754@www49.gmx.net> Date: Tue, 30 Nov 2004 20:59:14 +0100 (MET) From: "kcope" <kingcope@....net> To: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com Subject: Web Application DoS +-----------------------------------+ | Web Application Denial of Service | +-----------------------------------+ There is a denial of service condition not in a specific software product but in several web based applications. The idea is to make a rather small HTTP request and get a big amount of data back from the HTTP daemon. The HTTP protocol for a client could be as simple as a normal one line GET request for a specific web site on the server. Now let´s take the example of a search engine on a web site. Most times one will be able to search for just an ``A`` and get back a big result set of the data searched inside the information database. Of course the result set will be limited in good search applications. But if it is possible to manipulate the amount of results to a very high value and there is much information stored in the database the result set is very big and therefore the answer from the http daemon will also seem endless if no timeout is set. If one finds a way to manipulate this GET or POST request and automates the process through a very simple script which just loops over and over making this request the http daemon will not be able to handle its own reponse data. The result is that the website is not reachable anymore because the server is busy sending back nonsense data to the client (which will not wait for any but only makes small requests). I guess this works regardless of the underlying software running on the website, even powerful Sun Applications seem to be vulnerable. It should be mentioned that it has not to be a search application. Other server side scripts may be manipulated also to give the same effect. The only thing needed is that after a small request the http server is convinced to answer with an endless stream of bytes. No ultra fast connection is needed to make a rather big server with large connection bandwidth unavailable. No throughout test was done so this could be a false positive. But by testing even ``important`` business sites didn`t like this type of DoS. kcope 2k4 kingcope[at]gmx.net -- Geschenkt: 3 Monate GMX ProMail + 3 Top-Spielfilme auf DVD ++ Jetzt kostenlos testen http://www.gmx.net/de/go/mail ++ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Powered by blists - more mailing lists