2

I'm trying to understand this vulnerability.

How can I reproduce this?

Improve this question

1 Answer 1

Reset to default
6

This vulnerability forces your proxy to go into an infinite loop, causing a DOS because of exhaustion of local resources like CPU, RAM or any other resource.

The reason that it would go into infinite loop is because basically all you're proxy is doing is forwarding requests to someone else. What happens when you tell your proxy to forward the request to itself? It would receive the request, forward it to himself, receive it again, forward it to himself again and so on.

Now at first this may not be a big problem with just 1 request looping, however if you send thousands of proxy connections like these it will build up as a problem really fast.

The same thing could be done in internet routing protocols if it had not been for the TTL (Time to live) flag in the IP packets. According to rfc2616 you're proxy should not forward requests if Max-Forwards field is set to 0.

To reproduce this you would create a HTTP packet looking something like this:

  CONNECT <proxy connection>:80 HTTP/1.1
  Host: <proxy connection>:80
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .