DoS Attack for PHP Web APIs

What it does

In 2011 the Chaos Computer Club revealed a major complexity attack vulnerability that works across all major languages. PHP addressed the vulnerability for forms but never really fixed it. Nowadays every web application uses a JSON API, which is still vulnerable to complexity attacks. Hash Tables are optimized to be very fast in the average case. But if someone inserts keys that all collide with each other, we suddenly get really bad performance. If the hash table implementation uses open addressing, a colliding key is checked against all elements in the linked list. If you insert n elements you check 1+2+3+..+(n-1) elements for equality and therefore you have a complexity of O(n²) . If you…from lukasmartinelli.ch

• TP
  Tamper-proof web-apps using Data URLs2015 · geraintluff.bitbucket.org · ▲5
• 
  HTTP Prompt2016 · github.com · ▲128

  An interactive command-line HTTP client

• HH
  Helping Humans Detect Bad URLs and Avoid Email Attacks2020 · emailade.com · ▲6
• SA
  Sqreen API, a security toolbox for developers2017 · sqreen.io · ▲8
• FA
  Flubber – another PHP framework2014 · flubber.co · ▲6
• BC
  Bailiff – Codecademy of Web App Security2015 · bailiff.io · ▲9

• 
  SimCity, but with Permits▲905

  A free city-building game in your browser. You are the mayor. You know what the city needs. Now get it past the zoning board, the neighbors, the appeals court and the next election.

  Life & fun · 1d ago · permit.petercai.com

• IV
  I've been paying for a rural Tanzanian's education for 10 years▲778

  Life & fun · 13d ago · tanzaniaeducationproject.org

• 
  Bigwords.page – Turn any screen into a sign. The URL is the app▲728

  Turn a phone, tablet or TV into a sign. Type a message and it fills the screen: welcome signs, timers, Wi-Fi passwords and more. No app, no account, free.

  Life & fun · 14d ago · bigwords.page

• 
  Guitoro, a virtual guitar you strum with your keyboard▲573

  Play a free virtual guitar online with your keyboard or by touch. Slow songs down and see every chord, string and strum. Acoustic, classic, electric and bass.

  Life & fun · 8d ago · guitoro.com

• 
  See *almost* any carriers phone settings▲432

  Carrier settings from iPhone, Pixel and Galaxy firmware, decoded and compared: APNs, VoLTE, 5G and Wi-Fi Calling per carrier, and what each build changed.

  Life & fun · 12d ago · carrierexplode.com

• 
  The whole Solar System and every tracked satellite, live in the browser▲407

  Life & fun · 22d ago · space.bl2.net

• 
  Noizio▲779

  Ambient background sounds for your Mac

  Work · 2014 · noizioapp.com

• 
  Duet Display▲749

  Use your iPad as a second display for your Mac

  Work · 2014 · duetdisplay.com

• 
  Product Hunt Collections▲577

  A simple way to bookmark & curate product collections

  Life & fun · 2014

• 
  Workflow▲556

  Automate things you do every day on your iPhone/iPad

  Dev tools · 2014 · apps.apple.com

• 
  Grammarly for Chrome▲506

  Clear, effective, mistake-free writing everywhere you type.

  Work · 2014 · grammarly.com

• 
  Front 2.0▲500

  Shared team inboxes to manage Email, Twitter, SMS & more

  Work · 2014 · front.com