Browser ddos application in business

Generally, browser ddos is mainly used to crash the browser, but has not seen any real anti-attack methods applied in the business. In a recent case, the attack steps are as follows:

1. attackers steal accounts and use tools to constantly refresh pages to maintain persistent session logon.

2. The victim finds the account has been stolen and changes the password.

3. Due to business logic implementation problems, attackers cannot log off the web login user and perform operations on the victim.

4. Attackers use valid sessions to maintain sessions and continue attacks.

Due to business logic problems, the biggest problem here is to set the user's status to invalid.

Anti-attack: the purpose is to re-log on to the user. Here, we only need to let the user's browser crash and re-open the page session to expire,

At this time,

You need to log on again. Because the victim can change the password immediately, attackers cannot log on and achieve our goal.

:

Difficulties encountered during counterattack:

1. Attackers need contact information, such as QQ and email, and then send webpages with ddos attacks.

2. The success of an attacker clicking a link: This requires forging tempting words, such as: Look, naked girl wow, or the front desk of XX Company! Http://www.xxx.com/ddos.html

3. Determine whether the user's default browser is the same as the browser that refreshes the session. If a program captures data packets,

Replay attacks use the same browser to control and share session objects.

4. You need to blur the browser and version used by attackers to store our browser ddos exploit code.

Solution:

The session invalidation function is enabled. When the password is changed, the shared session server of the cluster server is required to be invalid, and the user's status is set to invalid.

Others:

The browser ddos exploit code can be obtained from sites such as https://www.exploit-db.com/,http://www.securityfocus.com.

Summary:

Because many technical and Psychological knowledge needs to be taken into account in the anti-Attack Process, the success rate depends on the method used by the anti-attacker. Based on the above, we can imagine that the attack method can be combined with the business in many scenarios to make our attacks more meaningful.

Reprinted Please note: woyiguis blog