2023-10-04

tesla web缓存中毒导致的dos

#web_cache #dos

  1. WAF 看见“burpcollaborator.net” 就会给出您已经被阻止

  2. 缓存中毒，步骤，Any-Header为非缓存键

GET /en_GB/roadster?dontpoisoneveryone=1 HTTP/1.1  
Host: www.tesla.com  
Any-Header: burpcollaborator.net  
  
HTTP/1.1 403 Forbidden  
  
Access Denied. Please contact waf@tesla.com

Denial of service via cache poisoning

#web_cache #dos

  1. Drupal缓存链

  2. web缓存中毒 X-Forwarded-Port 非缓存建

  3. X-Forwarded-Port 重定向网站端口

GET /index.php?dontpoisoneveryone=1 HTTP/1.1  
Host: www.hackerone.com  
X-Forwarded-Port: 123  
  
HTTP/1.1 302 Found  
Location: https://www.hackerone.com:123/

DoS on PayPal via web cache poisoning

#web_cache #dos

  1. 原http响应头：Transfer-Encoding:www.example.com

  2. 替换为：Transfer-Encoding:231028

profile-picture name parameter with large value lead to DoS for other users and programs on the platform

#dos

Summary

上传头像的过程中，图片名称文本没有限制，过长的名称会导致DOS

Steps

Impact

  1. 邀请别人查看自己的信息/包含自己信息页面都会无法响应

  2. 将自己排名刷上去后，在排名界面放自己的照片

PreviousDOSNextIDOR

Last updated