Skip to content
master
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 

README.md

background

htpasswDoS: Local Denial of Service via Apache httpd password hashes

htpasswdos

In this repository you'll find examples to cause a denial of service via htpasswd files in Apache httpd.

In the subdirectory htpasswdos-manual you can find a simple .htaccess and password file. Uploading that to a webserver with htaccess and authentication enabled and trying to log into it with the username guest and any password will cause several hours of ressource exhaustion on the server. The file path in the file "pass" needs to be adapted.

In the subdirectory htpasswdos-php you'll find a php script that will do all that automatically. It'll create a suitable .htaccess and password file in a subdirectory and will then call it multiple times via iframes.

If you want to protect against this kind of attack you can apply this patch against apr-util. This was applied upstream in apr-util 1.6.0.

About

Proof of concept for Apache htpasswd denial of service

Resources

License

Releases

No releases published

Languages

You can’t perform that action at this time.