shekyan / slowhttptest

Application Layer DoS attack simulator
Apache License 2.0
1.51k stars 303 forks source link

Large cookies cause buffer overflow #89

Open aph3rson opened 7 months ago

aph3rson commented 7 months ago

When using -j, the cookie header can be populated by slowhttptest when sending the request.

However, there's an undocumented 1024-byte limit on the size of this header: https://github.com/shekyan/slowhttptest/blob/6e316be98f562dd129a76cb228faae83217030a8/src/slowhttptestmain.cc#L155

For applications that use large authorization cookies (e.g. JWTs), the cookie may exceed 1024 bytes. Using these cookies on the command line will trigger buffer overflow detection - while you're not overflowing the buffer, you're also not writing a null byte.

Improvements here may include:

aph3rson commented 7 months ago

Places that would need to be changed: