Hi all Im trying to understand how the billion laughs attack works(https://en.wikipedia.org/wiki/Billion_laughs_attack)

So far I get its obviously sending this payload: <?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ELEMENT lolz (#PCDATA)> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <lolz>&lol9;</lolz>

I get that it is an xml declaration has 10 entities that sort of self replicate like: &lol9; is a defined entity that means it translates to 10 &lol8; .

Is the whole point of this attack that each &lol# is a defined entity morphing to 10 other ones, and thus resulting in DOS attack?

Please advise. Thanks


To clarify DarkMatter's answer, it more specifically targets a programming construct called recursion.

The XML document tells itself to recursively include the entity before it. Thus infinitely looping while allocated data for the element it's referring to in the XML. This is what recursion looks like:

strong text

When the XML interpreter reads the XML, it doesn't ever get told to stop, which causes the CPU resources to become totally drained, RAM becomes full, and either the software or the operating system will crash depending on which level the XML is being interpreted at.

Edit: another interesting way to think about recursion is to visualize looking through a mirror at another mirror. They reflect eachother infinitely, that's what is happening with the data. See below for cool pic:

enter image description here

| improve this answer | |

The wikipedia article cited explains it fairly well...it is an exponential growth DoS attack. entity 9 is ten entity 8's, each of which is ten entity 7's, each of with is ten entity 6's, etc... nine times => 10 ^ 9 = 1 Billion.

This would have the effect of consuming resources such as memory until a state of service denial is reached (if allowed to parse without resource restriction).


| improve this answer | |
  • can you please be more verbose on this entity 9 is ten entity 8's, each of which is ten entity 7's, each of with is ten entity 6's, etc... nine times => 10 ^ 9 = 1. Like spell out what 1 ENTITY will look like once expanded? Thanks – Jshee May 8 '19 at 17:58
  • each entity is "lol" – DarkMatter May 8 '19 at 18:05
  • so the whole point of the attack is when we try to expand &lol9 we get 1 billion "lol". – DarkMatter May 8 '19 at 18:11
  • Then this line <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> will be 10MILLON lol since there are 10 &lol# (for example)? – Jshee May 8 '19 at 18:22
  • that line is just a definition...nothing has "happened" until you try to parse... <lolz>&lol8;</lolz> would be 100 million – DarkMatter May 8 '19 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.