I was wondering that infinite redirection could be used as a dos attack

in my case, I have this test.php

        $url = $_GET['url'];
        header('Location: '.$newURL);

if I use it like http://mysite.com/test.php?url=http://mysite.com/test.php?url=http://mysite.com/test.php?url=http://mysite.com/test.php?url=...

Can that cause dos attack?

I know that the browser will block redirection after so many redirects but I talk about using a specific script to do attack?


No, it is no Denial of Service vulnerability. Even if a single browser were to constantly request resources from your server, it would likely not go down.

A Denial-of-Service attack can have multiple reasons:

  1. A vulnerability that causes the server to crash.
    For example, an attacker can cause the server to read /dev/zero. As the file is of infinite length, the server never stops and hangs.
  2. A vulnerability that causes the server to work a lot more on a response than the client for a request. This is called an amplification attack.
  3. Many many people request resources from your server, and your server doesn't have the memory and/or bandwidth to keep up. This is usually refered to as "Distributed Denial-of-Service" (DDoD).

As you see, your "redirect to self" vulnerability really doesn't fall in any of these categories, for multiple reasons:

  1. Any modern, non-malicious browser will stop redirects after a certain amount, and display an error message, as answered by Joseph.
  2. Even if that were not the case, URLs can only have a limited length, so you would end up with ~100 requests, not infinite ones.
  3. A malicious user could just keep holding Ctrl+F5 to infinitely refresh your page and get the exact same effect. The fact that they can do this is independent of your redirect, and can be done to any server.
  • I'm pretty sure a read of /dev/zero wouldn't hang the server. It would eat up as much bandwidth as it can supply to the client reading it, but that's certainly not enough to saturate its uplink. – forest Aug 4 '19 at 6:30
  • @forest I had some badly written applications that would hang as soon as they tried to read /dev/zero, and the only way to get them to un-hang was to kill the process and restart it. It's just an example how a DoS can be done in other ways than exhausting ressources. – MechMK1 Aug 4 '19 at 8:29

No, it can't. Even if you were to make an infinite loop, browsers will quickly give up following it, and show a message like this (this one in particular is from Firefox):

The page isn’t redirecting properly

Firefox has detected that the server is redirecting the request for this address in a way that will never complete. This problem can sometimes be caused by disabling or refusing to accept cookies.

  • what if an attacker used custom script !!!!!! – Trying to learn Aug 2 '19 at 21:01
  • The server voluntarily disabling it self is usually not considered a DoS. – vidarlo Aug 2 '19 at 21:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.