bugtraq - Web Application DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <6194.1101844754@www49.gmx.net>
Date: Tue, 30 Nov 2004 20:59:14 +0100 (MET)
From: "kcope" <kingcope@....net>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: Web Application DoS


+-----------------------------------+
| Web Application Denial of Service |
+-----------------------------------+
There is a denial of service condition not in a specific software product
but in several web based applications.
The idea is to make a rather small HTTP request and get a big amount of
data back from the HTTP daemon.
The HTTP protocol for a client could be as simple as a normal one line GET
request for a specific web site on the server.
Now let´s take the example of a search engine on a web site.
Most times one will be able to search for just an ``A`` and get back a
big result set of the data searched inside the information database.
Of course the result set will be limited in good search applications.
But if it is possible to manipulate the amount of results to a very high
value and there is much information stored in the database the result
set is very big and therefore the answer from the http daemon will also
seem endless if no timeout is set.
If one finds a way to manipulate this GET or POST request and automates the
process through a very simple script which just loops over and over
making this request the http daemon will not be able to handle its own
reponse
data. The result is that the website is not reachable anymore because the
server
is busy sending back nonsense data to the client (which will not wait for
any but
only makes small requests). I guess this works regardless of the underlying 
software running on the website, even powerful Sun Applications seem to be
vulnerable.
It should be mentioned that it has not to be a search application. Other
server side scripts
may be manipulated also to give the same effect. The only thing needed is
that after
a small request the http server is convinced to answer with an endless
stream of bytes.
No ultra fast connection is needed to make a rather big server with large
connection bandwidth unavailable.
No throughout test was done so this could be a false positive.
But by testing even ``important`` business sites didn`t like this type of
DoS.

kcope 2k4
kingcope[at]gmx.net

-- 
Geschenkt: 3 Monate GMX ProMail + 3 Top-Spielfilme auf DVD
++ Jetzt kostenlos testen http://www.gmx.net/de/go/mail ++

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html