0

If a user through a request can add a record to a table (for each request) is theoretically possible that he could cause a dos attack just increasing the size of a table?

2
  • By adding a single record? – schroeder Feb 5 at 15:44
  • No, the user can add more records. One for each request. – Maicake Feb 5 at 15:45
1

Of course. Depending on how the database is configured to handle growth. The database can grow to fill an entire disk or partition, for instance, and that can crash the database, the service, or the entire server.

4
  • Can this happen also if the user can increase just the number of tables instead of their dimensions? like 100000000000 tables of 3 records each or by default there are some limitations posed by databases implementations? – Maicake Feb 5 at 15:51
  • um - how would a user add a table? – schroeder Feb 5 at 15:59
  • The user would implicitly add a table as a consequence of a specific POST request. So my guess is: an attacker with a botnet could send several requests of that kind to increase table number. – Maicake Feb 8 at 8:07
  • That's entirely up to the program design. And ultimately, no different in effect from adding a row if that's how the application works. You can consider them equivalent in terms of threat even though the size impact might be different. – schroeder Feb 8 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.