infinity redirection as Dos Attack

Question

I was wondering that infinite redirection could be used as a dos attack

in my case, I have this test.php

    <?php 
        $url = $_GET['url'];
        header('Location: '.$newURL);
    ?>

if I use it like http://mysite.com/test.php?url=http://mysite.com/test.php?url=http://mysite.com/test.php?url=http://mysite.com/test.php?url=...

Can that cause dos attack?

I know that the browser will block redirection after so many redirects but I talk about using a specific script to do attack?

Answer 1

No, it is no Denial of Service vulnerability. Even if a single browser were to constantly request resources from your server, it would likely not go down.

A Denial-of-Service attack can have multiple reasons:

1. A vulnerability that causes the server to crash.
   For example, an attacker can cause the server to read /dev/zero. As the file is of infinite length, the server never stops and hangs.
2. A vulnerability that causes the server to work a lot more on a response than the client for a request. This is called an amplification attack.
3. Many many people request resources from your server, and your server doesn't have the memory and/or bandwidth to keep up. This is usually refered to as "Distributed Denial-of-Service" (DDoD).

As you see, your "redirect to self" vulnerability really doesn't fall in any of these categories, for multiple reasons:

1. Any modern, non-malicious browser will stop redirects after a certain amount, and display an error message, as answered by Joseph.
2. Even if that were not the case, URLs can only have a limited length, so you would end up with ~100 requests, not infinite ones.
3. A malicious user could just keep holding Ctrl+F5 to infinitely refresh your page and get the exact same effect. The fact that they can do this is independent of your redirect, and can be done to any server.

Answer 2

No, it can't. Even if you were to make an infinite loop, browsers will quickly give up following it, and show a message like this (this one in particular is from Firefox):

The page isn’t redirecting properly

Firefox has detected that the server is redirecting the request for this address in a way that will never complete. This problem can sometimes be caused by disabling or refusing to accept cookies.