Cenzic 232 Patent
Paid Advertising
sla.ckers.org is
ha.ckers sla.cking
Sla.ckers.org
How do we crash systems, browsers, or otherwise bring things to a halt, and how do we protect those things? 
Go to Topic: PreviousNext
Go to: Forum ListMessage ListNew TopicSearchLog In
ddosing with xss?
Posted by: SpoofGhost
Date: March 31, 2009 07:46AM

hi there just a quick quistion wich concerns also xss

well if you got an xss bug like when u post your code on a guestbook so that if some one visit that page it will fire your code is it possible to create a ddos attack with this like a bot net?

as an example i post some code on a guest book with an iframe wich loads a pecific site in it without the visitor in quistion you actually send data to that server so if you do this with loads of people that visit that guest book

is it possible to take down a site or so?

Options: ReplyQuote
Re: ddosing with xss?
Posted by: thornmaker
Date: March 31, 2009 01:08PM

Yes, it is possible to do a DDOS using XSS. For example if you have XSS on a high traffic webpage and the XSS points to a low capacity site (like your guest book iframe example), then you could have a DDOS situation.

I think there are some fun/interesting ways that the above scenario could be improved. If an attacker could seed several sites with persistent XSS and have the injected code pull from a remote site a target server and attack time (or time interval, or some way of synchronizing the attack) then you could have a more potent DDOS that doesn't rely on finding XSS on a single high traffic page. Perhaps synchronizing the attacks isn't even needed if enough vulnerable sites are seeded. I like the idea of synchronizing the attacks though since you can have a more potent DDOS with fewer XSS victims.

Options: ReplyQuote
Re: ddosing with xss?
Posted by: Albino
Date: March 31, 2009 03:31PM

I guess it might be possible to DDOS the page with the vulnerability itself, using the principles of a fork bomb.

Insert two iframes of the page itself, thus creating two iframes inside two iframes inside two iframes etc.

Not the subtlest of attacks, however.

Options: ReplyQuote
Re: ddosing with xss?
Posted by: nEUrOO
Date: March 31, 2009 04:47PM

Not sure what you want to DOS (not DDOS) here, since it's gonna be insert iframes to your browser, it's client-side stuff...
The number of request done will be limited when your browser won't support the iframe level anymore; shouldn't hit the server.

nEUrOO -- http://rgaucher.info -- http://twitter.com/rgaucher

Options: ReplyQuote
Re: ddosing with xss?
Posted by: SpoofGhost
Date: March 31, 2009 04:57PM

well as thornmaker said to attack another site with trafic

everytime some one visite the bugged site an iframes opens up with www.sitetoattack.com so sitetoattack gets lot more travic that way.

as what thornmaker said if you can manage to make more trafic then the sitetoattack can handle it won't be reachable.

well ofcourse you need loads of site hits to make it malfunction.

on the other hand alot of site's can only have an x amount of trafic every month
so you can try to up use that limit no trafic possible i suppose i'm quite new to this so i don't really know how this all works.

but i assume this is possible this way.

as for the xss hol forking an iframe you can also just run a enless loop if i'm right.

Options: ReplyQuote
Re: ddosing with xss?
Posted by: Albino
Date: April 01, 2009 06:52AM

Well, if the average browser could open 10 iframes before it crashed, this would increase the number of requests to the website by a factor of 10. Whether that would be enough to cause dos, who knows.

Options: ReplyQuote
Re: ddosing with xss?
Posted by: Reiners
Date: April 01, 2009 07:37AM

correct me if Im wrong but you could also use one iframe and refresh it all the time, like
<iframe id="1" src="http://www.target.bla"></iframe>
<script>
var c=0;
function run() 
{ 
c++;
document.getElementById(1).src="http://www.target.bla/?"+c;
setTimeout("run()", 500);
}
run();
</script>
but I dont think that you will cause a DoS with that unless you XSS a high traffic site.

Options: ReplyQuote
Re: ddosing with xss?
Posted by: gat3way
Date: April 02, 2009 08:14AM

I was thinking about that...

http://www.gat3way.eu/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=21&cntnt01returnid=15

Unfortunately it's not in English. And Google translate does not cope well with Bulgarian translations..

Anyway, ddos attacks agains other TCP services are possible (not only HTTP). Theoretically, even against UDP services but that's a bit trickier.

Options: ReplyQuote
Re: ddosing with xss?
Posted by: SpoofGhost
Date: April 03, 2009 08:05PM

but would it be use full against normal users so no website just a user?

Options: ReplyQuote
Re: ddosing with xss?
Posted by: gat3way
Date: April 04, 2009 12:44PM

What do you mean?

Options: ReplyQuote
Re: ddosing with xss?
Posted by: SpoofGhost
Date: April 05, 2009 08:41AM

well like just a normal home user wich uses his ip is it possible to dos such a person like you and me not a webdomain or mail server etc just the home user ;)

Options: ReplyQuote
Re: ddosing with xss?
Posted by: gat3way
Date: April 06, 2009 01:47AM

Well it is possible to conduct a dDoS attack against any target, not only a webserver. You'll just need to exploit a persistent XSS bug on a busy site.

Options: ReplyQuote
Re: ddosing with xss?
Posted by: SpoofGhost
Date: April 06, 2009 02:48AM

well what i want to create as project is a botnet of site's with presistent xss bugs. i know mail servers etc are possible. but i want to be able to attack also normal users, not just webservers. so if fill in my ip i start to ddos my own ip ;). but as far as i know i could only manage this if some one hosts a router orso? not sure tho that's why i'm asking.

Options: ReplyQuote
Re: ddosing with xss?
Posted by: SpoofGhost
Date: April 11, 2009 06:08AM

no one has an idea? i really would love to know if this is possible

Options: ReplyQuote


Sorry, only registered users may post in this forum.