what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Julian Waelde

Hashtable Collisions

Posted Aug 31, 2024

Authored by Dan S. Wallach, Alexander Klink, Krzysztof Kotowicz, Christian Mehlmauer, Julian Waelde, Scott A. Crosby | Site metasploit.com

This Metasploit module uses a denial-of-service (DoS) condition appearing in a variety of programming languages. This vulnerability occurs when storing multiple values in a hash table and all values have the same hash value. This can cause a web server parsing the POST parameters issued with a request into a hash table to consume hours of CPU with a single HTTP request. Currently, only the hash functions for PHP and Java are implemented. This Metasploit module was tested with PHP + httpd, Tomcat, Glassfish and Geronimo. It also generates a random payload to bypass some IDS signatures.

tags | exploit, java, web, php

advisories | CVE-2011-4858, CVE-2011-4885, CVE-2011-5034, CVE-2011-5035

SHA-256 | b029e67e4fc45769ef0806adf780beee36692122a886f5bb14135c025f43efbc

Download | Favorite | View