background

htpasswDoS: Local Denial of Service via Apache httpd password hashes

htpasswdos

In this repository you'll find examples to cause a denial of service via htpasswd files in Apache httpd.

In the subdirectory htpasswdos-manual you can find a simple .htaccess and password file. Uploading that to a webserver with htaccess and authentication enabled and trying to log into it with the username guest and any password will cause several hours of ressource exhaustion on the server. The file path in the file "pass" needs to be adapted.

In the subdirectory htpasswdos-php you'll find a php script that will do all that automatically. It'll create a suitable .htaccess and password file in a subdirectory and will then call it multiple times via iframes.

If you want to protect against this kind of attack you can apply this patch against apr-util. This was applied upstream in apr-util 1.6.0.