Lets say I have a search form for a blog (or any other system that would use SQL to run queries) and I want to protect it from denial of service. An attacker wants to attack my site by flooding the search function, which would cause a lot of SQL queries and might result in DoS.
This is theoretical so it's not about a single type of language or database management system, but if you want to you can imagine it's PHP and MySQL (although I'm wondering about the effects in general rather than specific to one platform).
A request like
GET /search.php?s=[SEARCH] searches the database for all articles containing
[SEARCH] and returns them. Let's say the maximum character length for
[SEARCH] is 128.
I am wondering in terms of "performance loss" which would be the worst form of attack between these two scenarios:
- The attacker searches for a random string of 128 characters (ex.
- The attacker searches for a single character each time (ex.
At first I thought that attack #1 would be more effective, thus legitimizing a strict limit on the character length of the search query. But then I thought, since in my example we're talking about a blog, that multiple searches on a single character might return a lot more articles because almost anything you write will contain at least one vowel. So then I realized perhaps it's not such a clear cut answer.
Attack #1 will require more ressources to send the query and scan all the entries in the database, but it won't return anything, whereas attack #2 will do the opposite - it won't take up a lot of ressources to scan the database but since almost every entry will contain an occurrence of the search query, it will return almost every entry in the database
Which attack do you think will be more dangerous and use up more ressources?