You don't need a botnet to bring a web site down - most of the time. Here we take a look at most common pitfalls of web application design and implementation which a single machine to take them offline at will.

1. Vladimir Garbuz
FILLING THE VOID:
Application-level DoS

2. fear the XML: billion laughs

3. fear the XML: oversized XXE

4. fear the XML: soap arrays

5. fear the XML: too much to handle

6. fear the XML: large soap for DOM parsers

7. fear the XML: xslt processing

8. fear the XML: signatures - many, xslt

9. fear the XML: signatures – RetrievalMethod

10. fear the XML: signatures/encryption reference

11. fear the XML: nested encryption

12. processing oversized data

13. REDoS – catastrophic backtracking

14. complex operations – look-alike, globbing, etc

15. logic fuckups – multiple sorting, grouping, etc

16. zero-bytes in input

17. unpacking: recursion

18. unpacking: large low-entropy data

19. heavy functionality invokation

20. slow HTTP

21. Questions and Discussion