Bug Bounty POC: Long password to dos attack | aalst.be

Hello,
This POC Video is Made On Long Password To Application Level DOS.



Bounty: Hall of fame [Url:https://www.aalst.be/infofiche/respon...]
Name:Deepak Dhiman (a.k.a Virdoex_hunter)



Exploit Defined long pass to dos attack
Reference:Medium: long-string-dos


How it work:
So the methodology is when you signup on target you will find that password field if target does not gave any length to password field than if you put very long string over 1000 chars than at backend the target try to make hash of it which takes long memory consumption and keep the machine busy(db machine) which leads to disconnect the db machine from server and leads to app crash.



Steps:
1.Always check signup and forget password functionality for this bug but sometime it also possible on login function too (if the  target first hash your password)

2.So capture the signup request and put a very long string in password field[keep password and confirm password with same]
3.click on action do intercept response to this request check the status


📱Social Media📱

Instagram:@virdoex_hunter
Github:@Virdoexhunter
Telegram:@Virdoex_hunter

Facebook:@virdoex.me
Twitter:@Virdoex_hunter



Please like share and subscribe and follow me on my social media account for tips and hacking stuff.