0

I am testing a bug bounty website, and found an endpoint like www.example.com/infinite. When open it, it keep doing 302 redirect to itself until browser stops it for redirecting too many times.


For example:

www.example.com/infinite ==> 302 - location: ?
www.example.com/infinite? ==> 302 - location: ?
www.example.com/infinite? ==> 302 - location: ?
15-20 times, browser stops it.

For example 2: with parameter

www.example.com/infinite?hello=all ==> 302 - location: ?hello=all
www.example.com/infinite?hello=all ==> 302 - location: ?hello=all
www.example.com/infinite?hello=all ==> 302 - location: ?hello=all
15-20 times, browser stops it.

Does this behavior have any impact to www.example.com, or is it just a friendly bug?

2
  • What you show so far is only a friendly bug or simply a harmless response to some invalid and unexpected input which will never happen in normal use (and it does not matter if some "hacker" ends up in some endless redirect since it eats resources from the hacker as much as it eats resources from the server, i.e. no DoS). If there is an underlying problem which is more serious cannot be seen from this information alone, but I would suggest that the chance is low. Mar 28, 2021 at 6:20
  • @SteffenUllrich thank for answering me, i should move on then :) Mar 28, 2021 at 10:52

1 Answer 1

1

Not really.

The cost of a 302 Redirect should be negligible.

Moreover, most browsers detect an infinite loop at the second or third iteration (if no cookies are involved, then at the second). So you're getting double or triple load for that one endpoint; it's no great mischief.

If this is caused by a bug such as a wrong .htaccess rewrite rule, so that all your site behaves this way, then you do have a problem - your site is now unreachable - but usually, resource-wise, it means that a navigation made up of maybe five or more GETs will be broken into just two. SPAs and heavy-AJAX sites might be impacted more, but you'd need to get into edge cases for it to really be a significant problem.

Of course, this doesn't mean you don't have to fix it ;-) (not sure since I'm a complete and utter ignorant SEO-wise, but I don't think this can be good for your site ranking). By the same token, this situation might be indicative of below-average attention to the site's workings, and encourage some attacker - it's called the Broken Window effect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .