0

I'm testing a website:

https://this-site.com/path/to/dirs

but what i've found is if I do the following below the site will load 4 pages in a infinite loop

https://this-site.com/path/to/dirs/.../.

I was thinking it would be something along the lines of some sort of input validation issue or even DOS as if I open up many tabs I could consume a great part of resources of that server. I've checked through google but I couldn't find anything related to what i've found .

  • 2
    "will load 4 pages in a infinite loop" - what do you exactly mean by this? Is it redirecting from one page to another in 4 separate requests? – tungsten Sep 25 '19 at 16:49
  • 1
    Hi @tungsten, it redirects from one page to another in separate request . – dlw Sep 25 '19 at 16:52
  • it might be a user experience in which the site is traversing all the underlying directories backwards in separate steps(that may contain different index.html's), the question is what was the final page you saw? blank? – tungsten Sep 25 '19 at 17:08
3

Not any sort of vulnerability; simply a usability issue that might affect users visiting the site from a malformed URL.

It is not an easy way to perform a DOS attack, because there is no evidence that this is taking any more resources on the server than hitting non-redirecting set of pages, or preventing other users from accessing different pages. You can set your browser to visit this redirect loop, but you can also use scripting tools or browser extensions to request any other page on the site repeatedly. This is a flood attack, and does not depend on any vulnerability on the server.

| improve this answer | |
  • Thanks, that does make sense . I guess you can theoretically create a script to do the same . – dlw Sep 25 '19 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.