Slash and dash DDOS - what are they trying to do?

Question

I've noticed a curious flood pattern on some of my sites - bots trying to access the page ​"/-​/-​/-​/-​/-​/-​/-​/-​/-​/-​/" on the root domain - that's 11 slashes alternated by 10 dashes.

The thing with this is that it may be quite difficult for firewalls to catch it - Cloudflare and Wordfence are doing poorly (only working in certain conditions). Well, due to the nature of the string I couldn't even find anything on google.

For now I'm doing a redirect to a sort of honey-trap, but I'm nonetheless curious what it's trying to achieve and how it can better be rid of.

Answer 1

This is called a Full Path Disclosure attack. This kind of attack allows the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. It keeps on adding slashes like ///// until it gets a file or anything interesting, and won't stop. It floods the site with slashes and special characters and the attacker may not know it but he is DDoSing the site. To stop this kind of attack you can use fail2ban or use nginx and set heavy caching of /.