java的hash漏洞_HashMap漏洞 | 学步园

== Java ==

Java offers the HashMap and Hashtable classes, which use the

String.hashCode() hash function. It is very similar to DJBX33A (instead of 33, it uses the

multiplication constant 31 and instead of the start value 5381 it uses 0). Thus it is also

vulnerable to an equivalent substring attack. When hashing a string, Java also caches the

hash value in the hash attribute, but only if the result is different from zero.

Thus, the target value zero is particularly interesting for an attacker as it prevents caching

and forces re-hashing.

Different web application parse the POST data differently, but the ones tested (Tomcat,

Geronima, Jetty, Glassfish) all put the POST form data into either a Hashtable or HashMap

object. The maximal POST sizes also differ from server to server, with 2 MB being the most

common.

A Tomcat 6.0.32 server parses a 2 MB string of colliding keys in about

44 minutes of i7 CPU time, so an attacker with about 6 kbit/s can keep one i7 core constantly

busy. If the attacker has a Gigabit connection, he can keep about 100.000 i7 cores busy.