Summary PHP and Apache based hosting is becoming very popular these days. A denial of service attack against the web server can be created using a very simple PHP script being called through the web server's normal web interface (NOTE: The DoS requires the attacker to have at least local file access to the web server, i.e. being able to store a PHP file on the remote host).
Details PHP has many functions available that enable it to connect to remote sites to retrieve HTML such as fopen, fsockopen and some third party libraries such as the popular curl. Many ISPs allow at least one or more of these functions including some free web page providers.
By creating an endless loop using these functions it is possible, even with the script timeout set to 30 seconds, to create a Denial of Service of both PHP and the web server itself (in this case Apache).
Example: Create a file called for example : loop.php containing the following code: <? fopen("http://127.0.0.1/loop.php","r"); ?>
replacing the web server location to the place where you have uploaded the script.
Then all you have to do is to open the page in a webbrowser. This will render Apache unable to serve any streams and will eventually crash the process.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
