0

I am working on an application. There is a new feature implemented where a user create some IDs and secret keys for that application.

I have observed that there is no rate limit for creating those.

I have sent the request to intruder and created nearly 11000 sets of IDs and secrets.

So whenever any user tries to access that page, it loads continuously and displays a message that page has become unresponsive and as a result it doesn't let user to access anything in the page.

In my point of view, this is a vulnerability because lack of rate limiting is leading to inaccessibility of the page for all the users in the application.

However, I am confused if it is as considered as a DOS attack or valid rate limiting issue.

Please suggest with valid justification.

1
  • 1
    The underlying problem is a rate limiting issue. You've used this problem to deny the service for others, so you've used it in a DoS attack. There can be a variety of problems leading to possible DoS attacks, like inability to cope with long passwords. Jul 10, 2020 at 19:09

1 Answer 1

1

I would definitely call this a DOS attack. More precisely it is an application layer DOS attack in that it doesn't malformed packets and other network layer denial of service tricks like small window sizes to be effective. These are hardest to defend against because many DDOS protection products are looking for the network layer attacks.

I think in the DOS lingo, these would be called "heavy" requests as each legitimate request consumes server resources. This CloudFlare article says it well:

Application layer attacks or layer 7 (L7) DDoS attacks refer to a type of malicious behavior designed to target the “top” layer in the OSI model where common internet requests such as HTTP GET and HTTP POST occur. These layer 7 attacks, in contrast to network layer attacks such as DNS Amplification, are particularly effective due to their consumption of server resources in addition to network resources.

1
  • Hi @mcgyver5 , thank you for the answer.Your answer has given proper insight. Jul 11, 2020 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.