Application Level

Application-Level Denial of Service

Overview of the Vulnerability

Application-level denial of service (DoS) attacks are designed to deny service to users of an application by flooding it with many HTTP requests. This makes it impossible for the server to respond to legitimate requests in any practical time frame.

There is an application-level DoS vulnerability within this application that an attacker can use to exhaust resources, making the application unavailable for its designed purpose to legitimate users.

Business Impact

Application-level DoS can result in indirect financial loss for the business through the attacker’s ability to DoS the application. These malicious actions could also result in reputational damage for the business through the impact to customers’ trust.

Steps to Reproduce

  1. Navigate to {{url}}

  2. Use the following payload:

{{payload}}

  1. In the URL, insert the payload into the following parameter:

{{parameter}}

  1. Observe that the payload causes a denial of service

Proof of Concept (PoC)

The screenshot below demonstrates the denial of service:

{{screenshot}}

Guidance

Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. Your submission must include evidence of the vulnerability and not be theoretical in nature.

For a Denial of Service (DoS), please include a simple URL or HTTP payload that can be executed to easily demonstrate and reproduce the issue.

Attempt to escalate the DoS vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC).

Recommendation(s)

It is recommended to perform input validation to limit the total request size, and file upload and extension sizes. and, It’s also important to prevent any user input based function or threading interaction. These preventative measures help against application-level DoS attacks.

For more information, refer to the following resources:

PreviousSystemic BiasNextApp Crash

Last updated