Home
Calendar
Certifications
Columns
Features
Forum
Resources
Vitals
Latest Additions
April 2013 Free Giveaway Sponsor - eLearnSecurity
Human Intelligence to Navigate the Security Data Deluge
February 2013 Free Giveaway Winner of SANS CyberCon Training
Interview: Bugcrowd Founders on Herding Ninjas for Crowdsourced Bug Bounties
Network Forensics: The Tree in the Forest
March 2013 Free Giveaway Sponsor - Mile2
Book Review: Violent Python
February 2013 Free Giveaway Sponsor - SANS
Holiday 2012 Free Giveaway Winner of Metasploit Pro by Rapid7
Course Review: SANS FOR408 Computer Forensic Investigations – Windows In-Depth
The Security Consulting Sugar High
Tutorial: Fun with SMB on the Command Line
Interview: Ilia Kolochenko, CEO of High-Tech Bridge
October 2012 Free Giveaway Winner of LearningGate Training
The Broken: Assessing Corporate Security in 2012 to Make a Better 2013
EH-Net Login
Welcome Guest.
Username:
Password:
Remember me
Lost Password?
No account yet?
Register
Who's Online
We have 44 guests and 2 members online
Free Business and Tech Magazines and eBooks
You are here:
Home
Ethical Hacking Discussions and Related Certifications
Web Applications
DOS bug I found
EH-Net
May 22, 2013, 01:27:02 AM
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
: Go back to The Ethical Hacker Network Online Magazine
Home Page
Home
Help
Calendar
Login
Register
EH-Net
>
Ethical Hacking Discussions and Related Certifications
>
Web Applications
(Moderator:
don
) >
DOS bug I found
Pages:
1
[
2
]
Go Down
« previous
next »
Print
Author
Topic: DOS bug I found (Read 6481 times)
0 Members and 1 Guest are viewing this topic.
sternone
Full Member
Offline
Posts: 129
Re: DOS bug I found
«
Reply #15 on:
August 22, 2012, 06:58:37 AM »
How is Amazon doing it ?
Logged
Try harder....hmpf!!
Jamie.R
Sr. Member
Offline
Posts: 429
Re: DOS bug I found
«
Reply #16 on:
August 22, 2012, 07:00:36 AM »
The item was reported to the client as DOS bug. I am not sure what the recommendation was to the client, as I did not finish the report or was in the call to the client.
I think the client was made aware of it was enought for them. I mean from the feedback the client gave the bug had been in the application for well over 10 years.
I am not sure how Amazon are doing it but I would think most companies are using the same sort of method.
«
Last Edit: August 22, 2012, 07:31:48 AM by Jamie.R
»
Logged
OSWP | Hackingdojo Nidan | eCPPT
m0wgli
Full Member
Offline
Posts: 248
Re: DOS bug I found
«
Reply #17 on:
August 22, 2012, 07:23:38 AM »
Quote from: sternone on August 22, 2012, 06:58:37 AM
How is Amazon doing it ?
I'm not sure. As far as I'm aware Amazon don't offer reserve and collect as they don't have retail premises.
My experience of the reserve and collect process is based off of how major UK retailers such as Argos and PC World are doing it. The item is removed from stock until the end of the next business day without requiring payment.
Quote from: Jamie.R on August 22, 2012, 07:00:36 AM
The item was reported to the client as DOS bug. I am not sure what the recommendation was to the client, as I did not finish the report or was in the call to the client.
I think the client was made aware of it was enought for them. I mean from the feedback the client gave the bug had been in the application for well over 10 years.
I am not sure how Amazon are doing it but I would say most companies that are using the same methods.
Jamie, thanks for the information.
Logged
Security + | OSWP | eCPPT | CSTA
sternone
Full Member
Offline
Posts: 129
Re: DOS bug I found
«
Reply #18 on:
August 22, 2012, 07:43:00 AM »
Just my 2cents.
If an outside company would report a functional bug as a DoS to me I would have serious questions who I'm dealing with.
I have so much stuff more to learn in my life, but apparently I'm not the only one ;-)
Logged
Try harder....hmpf!!
Jamie.R
Sr. Member
Offline
Posts: 429
Re: DOS bug I found
«
Reply #19 on:
August 22, 2012, 07:55:51 AM »
I think its hit and miss tbh I would say agree with all comments here I would say its 50/50 as a DOS and functional bug.
So we put it as a DOS and explain to the client why it happend and what we could do.
An intresting question would be if you have a phone that has a lock feature on it and your friend decides to play a game. He enters your pin wrong 3 times this then lock the phone for 1 min. He then does it again 3 more times and lock the phone for 10 min. He then keeps on doing this until the phone is locked for 60min.
Would you say that was a DOS ? as mentioned above you not really using resources up like ram, HDD or the processor. you are just locking him out of his phone and stoping him from using the phone for 1 hour.
Logged
OSWP | Hackingdojo Nidan | eCPPT
m0wgli
Full Member
Offline
Posts: 248
Re: DOS bug I found
«
Reply #20 on:
August 22, 2012, 08:29:31 AM »
Quote from: Jamie.R on August 22, 2012, 07:55:51 AM
An intresting question would be if you have a phone that has a lock feature on it and your friend decides to play a game. He enters your pin wrong 3 times this then lock the phone for 1 min. He then does it again 3 more times and lock the phone for 10 min. He then keeps on doing this until the phone is locked for 60min.
Would you say that was a DOS ? as mentioned above you not really using resources up like ram, HDD or the processor. you are just locking him out of his phone and stoping him from using the phone for 1 hour.
Personally, I would consider this a clearcut DoS through abuse of the account lockout functionality.
Logged
Security + | OSWP | eCPPT | CSTA
Jamie.R
Sr. Member
Offline
Posts: 429
Re: DOS bug I found
«
Reply #21 on:
August 22, 2012, 08:40:47 AM »
So what the difference between locking someone phone and denying someone access to make a purchase? As I think there is no difference or a really small amount of difference that does not matter.
Logged
OSWP | Hackingdojo Nidan | eCPPT
m0wgli
Full Member
Offline
Posts: 248
Re: DOS bug I found
«
Reply #22 on:
August 22, 2012, 10:17:43 AM »
I believe the distinction between the two is that the DoS condition you refer to in the reserve and collect function is a consequence of the applications flawed functionality/logic. It is this flaw that is the underlying issue and is therefore the issue that should be reported. If the functionality was implemented correctly it couldn't be abused to cause the situation you describe.
The account lockout functionality isn't flawed as it is functioning as intended, i.e. reacting to incorrect logins. It is the abuse of it's intended function resulting in a DoS, that would be the issue.
Logged
Security + | OSWP | eCPPT | CSTA
Jamie.R
Sr. Member
Offline
Posts: 429
Re: DOS bug I found
«
Reply #23 on:
August 22, 2012, 10:54:39 AM »
Good points but would the developer not argue that the reserve and collect was implemented and is a function of the site.And in both cases the phone case and the collet and reserve case the features are being abused?
I am just trying to look at this from different points of view as I have said I think its very 50/50 on being a DOS/Logic-function flaw.
I think everyone will have a different view on what they would class it as.
Logged
OSWP | Hackingdojo Nidan | eCPPT
sternone
Full Member
Offline
Posts: 129
Re: DOS bug I found
«
Reply #24 on:
August 22, 2012, 11:00:18 AM »
The phone locking out the user is not a DoS. It's how the system was programmed.
A denial of service is just a condition when for example because of an attack the servers become unresponsive or the network is unreachable.
You guys are confusing bugs and software functionality to lock out a user as a Denial of Service.
Otherwise every condition with a bug or with a programmed function becomes a DoS, why would you call them bugs ? Just call them all DOS then or even more, call every 'programmed safety function' that takes out a user for a certain time (as intended too!!) as a DoS !!
It's almost funny...
Logged
Try harder....hmpf!!
Jamie.R
Sr. Member
Offline
Posts: 429
Re: DOS bug I found
«
Reply #25 on:
August 22, 2012, 11:24:48 AM »
sternone I don’t think we confusing them I just trying point out that it sometimes hard to decide between the two. Even if you look this post some people said it’s a type of DOS some said no way so there is a lot of confusing around it.
Wikipedia says "In computing, a denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users"
So by purchasing the entire shop when you have no intention to pay for them are you not in a way making resources unavailable to its intended users?
If you stop your friends from having access to his phone by entering the pin so many times wrong are you not denying him access to his machine?
I just trying say that it sometimes hard to identify if an issue is a DOS, Logical or any other type of flaw.
Logged
OSWP | Hackingdojo Nidan | eCPPT
sternone
Full Member
Offline
Posts: 129
Re: DOS bug I found
«
Reply #26 on:
August 22, 2012, 11:33:09 AM »
Quote from: Jamie.R on August 22, 2012, 11:24:48 AM
sternone I don’t think we confusing them I just trying point out that it sometimes hard to decide between the two. Even if you look this post some people said it’s a type of DOS some said no way so there is a lot of confusing around it.
Wikipedia says "In computing, a denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users"
So by purchasing the entire shop when you have no intention to pay for them are you not in a way making resources unavailable to its intended users?
If you stop your friends from having access to his phone by entering the pin so many times wrong are you not denying him access to his machine?
I just trying say that it sometimes hard to identify if an issue is a DOS, Logical or any other type of flaw.
No you are not.
Wikipedia is very correct, they are talking about having the servers or networks being not responding.
If you use a bug to lock up a certain function of the program in this case ordering a product for a certain period that is not making the servers or the network unresponsive.
I'm done with this discussion, you can have it all, sure, all bugs are 'denial of service' and hey, even if we programmed it so you get locked out for a certain period well then its a 'denial of service' also.
Yeah right. there is hope in this industry for me after all, if I need to compete with you guys... Sigh...
Logged
Try harder....hmpf!!
Jamie.R
Sr. Member
Offline
Posts: 429
Re: DOS bug I found
«
Reply #27 on:
August 22, 2012, 11:50:00 AM »
I was only trying get people opinion was not stating facts or saying you’re wrong and I am right I just trying to look at it from different people’s points of view.
Logged
OSWP | Hackingdojo Nidan | eCPPT
m0wgli
Full Member
Offline
Posts: 248
Re: DOS bug I found
«
Reply #28 on:
August 22, 2012, 12:09:45 PM »
Quote from: sternone on August 22, 2012, 11:33:09 AM
Quote from: Jamie.R on August 22, 2012, 11:24:48 AM
sternone I don’t think we confusing them I just trying point out that it sometimes hard to decide between the two. Even if you look this post some people said it’s a type of DOS some said no way so there is a lot of confusing around it.
Wikipedia says "In computing, a denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users"
So by purchasing the entire shop when you have no intention to pay for them are you not in a way making resources unavailable to its intended users?
If you stop your friends from having access to his phone by entering the pin so many times wrong are you not denying him access to his machine?
I just trying say that it sometimes hard to identify if an issue is a DOS, Logical or any other type of flaw.
No you are not.
Wikipedia is very correct, they are talking about having the servers or networks being not responding.
If you use a bug to lock up a certain function of the program in this case ordering a product for a certain period that is not making the servers or the network unresponsive.
I'm done with this discussion, you can have it all, sure, all bugs are 'denial of service' and hey, even if we programmed it so you get locked out for a certain period well then its a 'denial of service' also.
Yeah right. there is hope in this industry for me after all, if I need to compete with you guys... Sigh...
I wouldn't entirely rely on Wikipedia for a source of information if at all. They are discussing DoS at the network layer, DoS can also occur at the application layer.
With regard to abusing the account lockout process to cause a DoS, heres a couple of links that I suggest you read:
http://projects.webappsec.org/w/page/13246921/Denial%20of%20Service
https://www.owasp.org/index.php/Denial_of_Service
http://technet.microsoft.com/en-us/library/cc737614%28v=ws.10%29.aspx
Logged
Security + | OSWP | eCPPT | CSTA
Jamie.R
Sr. Member
Offline
Posts: 429
Re: DOS bug I found
«
Reply #29 on:
August 23, 2012, 03:31:58 AM »
Thanks for the links
Logged
OSWP | Hackingdojo Nidan | eCPPT
Pages:
1
[
2
]
Go Up
Print
« previous
next »
Jump to:
Please select a destination:
-----------------------------
EH-Net
-----------------------------
=> Calendar Of Events
===> ChicagoCon 2007
===> ChicagoCon 2008s
===> ChicagoCon 2008f
===> ChicagoCon 2009s
=> Ethical Hacktivism
=> News Items and General Discussion About EH-Net
===> Greetings
=> Special Events
-----------------------------
Ethical Hacking Discussions and Related Certifications
-----------------------------
=> General Certification
===> Networking
===> OS
===> Security
=> Compliance, Regulations & Standards
=> Control Systems
=> Cyber Warfare
=> Forensics
===> CCE / MCCE - (Master) Certified Computer Examiner
===> CHFI - Computer Hacking Forensic Investigator
===> EnCE - EnCase® Certified Examiner
===> GCFA - GIAC Certified Forensics Analyst
=> Hardware
=> Incident Response
===> CSIH - Computer Security Incident Handler
===> GCIH - GIAC Certified Incident Handler
=> Malware
===> Advisories
=> Mobile
=> Network Pen Testing
===> CEH - Certified Ethical Hacker
===> CPTC - Certified Penetration Testing Consultant
===> CPTE - Certified Penetration Testing Engineer
===> CSTA - Certified Security Testing Associate
===> eCPPT - eLearnSecurity Certified Professional Penetration Tester
===> ECSA - EC-Council Certified Security Analyst
===> GPEN - GIAC Certified Penetration Tester
===> OSCP - Offensive Security Certified Professional
=> Physical Security
=> Programming
=> Social Engineering
=> Web Applications
=> Wireless
===> CWNP Certs
===> GAWN - GIAC Assessing Wireless Networks
===> OSWP - Offensive Security Wireless Professional
=> Other
-----------------------------
Columns
-----------------------------
=> Editor-In-Chief
=> Andress
=> Gates
=> Haddix
=> Hadnagy
=> Heffner
=> Hoffman
=> Linn
=> RichM
=> Murray
=> J. Peltier
=> Weidman
=> Wilson
-----------------------------
Features
-----------------------------
=> /root
=> Book Reviews
=> Opinions
=> Skillz
===> Examples
===> May 06 - Star Hacks, Episode V: The Empire Hacks Back
===> July 06 - Hack Bill!
===> Sept 06 - Netcat in the Hat
===> Nov 06 - Hitch-Hackers Guide to the Galaxy
===> Dec 06 - A Christmas (Hacking) Story
===> Feb 07 - Charlottes Web Site
===> April 07 - Microsoft Office Space
===> June 07 - Serenity Hack
===> Oct 07 - Worst. Ethical. Hacker. Challenge. Ever.
===> Dec 07 - Frosty the Snow Crash
===> March 2008 - It Happened One Friday
===> Oct 2008 - Scooby Doo and the Crypto Caper
===> Dec 08 - Santa Claus Is Hacking to Town
===> Feb 2009 - Brady Bunch Boondoggle
===> July 2009 - Prison Break
===> October 2009 - SSHliders
===> December 2009 - Miracle on Thirty-Hack Street
===> December 2010 - The Nightmare Before Charlie Browns Christmas
-----------------------------
Resources
-----------------------------
=> Career Central
===> Looking For Work
===> Looking To Hire
=> Links to cool sites.
=> Mass Media
=> News from the Outside World
=> Tools
=> Tutorials
===> Tutorial Requests
Loading...
Exclusive Deal
SANSFIRE 2013
June 15 - 22
5% Off
w/ Code
:
EHN_5
SANS Deals 4 EH-Netters
5% OFF
Any
SANS Course
in Any Format!
Coupon Code:
EHN_5
Including
SANS Rocky Mountain 2013
&
SANS Boston 2013
Polls
Compared to this year, 2013 will be:
Great!
Better.
About the same.
Little worse.
FUBAR!
Recent Forum Topics
Programming
: Finished Python Course in Codecademy now what?
(15) by
hanyhasan
Network Pen Testing
: Ruby on Rails Vulnerabilities/Attacks in BackTrack 5 r3
(0) by
SUdoctstudent
Network Pen Testing
: De-ICE 1.140 released!
(2) by
superkojiman
Network Pen Testing
: AIX Vulnerability Assessments
(1) by
3xban
General Certification
: CPT Practical Submission
(1) by
UNIX
OSCP - Offensive Security Certified Professional
: Failed my first attempt at the OSCP exam
(94) by
azmatt
Tools
: Social-Engineer Toolkit (SET) Version 5.0 “The Wild West” Released
(2) by
m0wgli
Malware
: EICAR?
(3) by
UKSecurityGuy
Advisories
: HTB23154: Multiple Vulnerabilities in Exponent CMS
(0) by
AndyP
Advisories
: HTB23153: Multiple Vulnerabilities in Jojo CMS
(0) by
AndyP
Advisories
: HTB23151: Cross-Site Request Forgery (CSRF) in UMI.CMS
(0) by
AndyP
Tutorials
: Need guidance
(8) by
r0ckm4n
OSCP - Offensive Security Certified Professional
: Class Scheduled 6/8 - Linux n00b
(7) by
Taemyks
OSCP - Offensive Security Certified Professional
: OSCP exam scheduled
(6) by
gbhat
Incident Response
: LinkedIn Forensics
(0) by
AFENTIS_Forensics
General Certification
: Red Team/Blue Team
(1) by
ajohnson
Career Central
: Starter cert?
(3) by
Grendel
Network Pen Testing
: Beginner Ethical Hacker
(1) by
m0wgli
Web Applications
: Nessus and Nikto
(4) by
Seen
Network Pen Testing
: Cracking salted MD5 hash
(4) by
n37sh@rk
CEH - Certified Ethical Hacker
: Passed my C|EH
(3) by
n37sh@rk
Mass Media
: EC-council hacked, irony at his best?
(0) by
j0rDy
Web Applications
: SQL Injection into an INSERT statement.
(6) by
eyenit0
Network Pen Testing
: Solution for sipXtapi INVITE Message CSeq Field Header Remote Overflow
(1) by
m0wgli
Web Applications
: dns
(2) by
H1t M0nk3y
Other
: BSides Boston
(0) by
3xban
Career Central
: InfoSec in Central, FL
(2) by
tturner
Web Applications
: Web vulnerability scanner
(4) by
H1t M0nk3y
EH-Net News Feeds
Latest Additions
Privacy Notice
for TDCC & All Properties
© 2013 The Ethical Hacker Network
Joomla!
is Free Software released under the GNU/GPL License.