• Close
  • Back to search

    Hashtable Collisions

    This module uses a denial-of-service (DoS) condition appearing in a variety of programming languages. This vulnerability occurs when storing multiple values in a hash table and all values have the same hash value. This can cause a web server parsing the POST parameters issued with a request into a hash table to consume hours of CPU with a single HTTP request. Currently, only the hash functions for PHP and Java are implemented. This module was tested with PHP + httpd, Tomcat, Glassfish and Geronimo. It also generates a random payload to bypass some IDS signatures.

    Free Metasploit Download

    Get your copy of the world's leading penetration testing tool

     Download Now

    Module Name



    • Alexander Klink
    • Julian Waelde
    • Scott A. Crosby
    • Dan S. Wallach
    • Krzysztof Kotowicz
    • Christian Mehlmauer <FireFart [at] gmail.com>




    Module Options

    To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

    msf > use auxiliary/dos/http/hashcollision_dos msf auxiliary(hashcollision_dos) > show actions ...actions... msf auxiliary(hashcollision_dos) > set ACTION <action-name> msf auxiliary(hashcollision_dos) > show options ...show and set options... msf auxiliary(hashcollision_dos) > run

    Related Vulnerabilities