app-layer-dos

What problem does it solve?

This Skill solves the problem of detecting application-layer denial-of-service (DoS) vulnerabilities that bypass infrastructure-level flood protections, which can exhaust server CPU, memory, or thread pools using low-volume, legitimate-looking requests that are often not blocked by traditional WAFs.

Core Features & Use Cases

• ReDoS Testing: Identify and exploit catastrophic backtracking in regex patterns used for input validation (email, URL, search fields) to pin server CPU cores for extended periods.
• Decompression Bomb Detection: Test if targets transparently decompress gzip-compressed request bodies, allowing small ~1KB payloads to expand to gigabytes and exhaust server memory.
• Slow-Endpoint Exploitation: Probe for endpoints with expensive server-side operations (PDF generation, image processing, report compilation) that can be abused to tie up worker threads.
• Cross-Protocol Amplification: Test for XML entity expansion (Billion Laughs), deeply nested JSON, and HashDoS vulnerabilities that cause uncontrolled resource consumption.
• Use Case: A penetration tester assessing a customer-facing web application can use this Skill to systematically validate all common application-layer DoS vectors without relying on volumetric flood attacks that trigger infrastructure-level rate limiting.

Quick Start

Use the app-layer-dos skill to test the target's email validation endpoint for ReDoS vulnerabilities by sending crafted input payloads and comparing response times to a baseline of normal valid input.