Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding a scan rule for uploading a very large file for causing DDOS #16

Open
preetkaran20 opened this issue Feb 20, 2022 · 0 comments
Open
Labels
analysis enhancement New feature or request good first issue Good for newcomers

Comments

@preetkaran20
Copy link
Member

Is your feature request related to a problem? Please describe.
Currently, there is no rule which can detect that the application is vulnerable to no limitation on size check which can cause DOS as all the application resources are impacted due to that. So we need to add a new ScanRule.

All the attack vectors are present at: https://github.com/SasanLabs/owasp-zap-fileupload-addon/tree/main/src/main/java/org/sasanlabs/fileupload/attacks and we can add our code to one of them.

Describe the solution you'd like
It is very complex to find out how can we achieve this so need to look and research online to figure out ways to find such vulnerability.

Additional context
We are adding a level in Owasp Vulnerable App that will not have any size limitation and hence that can help in testing this feature. SasanLabs/VulnerableApp#351

@preetkaran20 preetkaran20 added analysis enhancement New feature or request good first issue Good for newcomers labels Feb 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
analysis enhancement New feature or request good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

1 participant