0

If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?

2
  • By adding a single record?
    – schroeder
    Commented Feb 5, 2021 at 15:44
  • No, the user can add more records. One for each request.
    – Maicake
    Commented Feb 5, 2021 at 15:45

1 Answer 1

1

Of course. Depending on how the database is configured to handle growth. The database can grow to fill an entire disk or partition, for instance, and that can crash the database, the service, or the entire server.

4
  • Can this happen also if the user can increase just the number of tables instead of their dimensions? like 100000000000 tables of 3 records each or by default there are some limitations posed by databases implementations?
    – Maicake
    Commented Feb 5, 2021 at 15:51
  • um - how would a user add a table?
    – schroeder
    Commented Feb 5, 2021 at 15:59
  • The user would implicitly add a table as a consequence of a specific POST request. So my guess is: an attacker with a botnet could send several requests of that kind to increase table number.
    – Maicake
    Commented Feb 8, 2021 at 8:07
  • That's entirely up to the program design. And ultimately, no different in effect from adding a row if that's how the application works. You can consider them equivalent in terms of threat even though the size impact might be different.
    – schroeder
    Commented Feb 8, 2021 at 9:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .