Apache Tomcat DoS Exploit (CVE-2024-24549)

Description

This repository contains a proof-of-concept (PoC) exploit for a denial-of-service (DoS) attack against Apache Tomcat version 9.0.83, based on an issue identified in the handling of HTTP headers and payloads. This script generates malicious HTTP requests using multiple threads to cause server overload.

Note: This exploit is for educational and research purposes only. It should not be used to attack systems without the express authorization of the owner.

Features

• Multi-threading support: Concurrent sending of malicious requests to maximize impact.
• Customizable configuration: Allows adjusting the number of requests, concurrent threads, request interval, and more.
• Activity logging: Saves details of each sent request to a log file.
• Dynamic payload: Generates random HTTP headers and request bodies to avoid predictable patterns.

Usage

Prerequisites

• Python 3.8+
• Python standard library (no additional installation required).

Installation

1. Clone this repository:
   root@kitploit:~

   git clone https://github.com/JFOZ1010/CVE-2024-24549.git
   cd CVE-2024-24549
   

2. Execution: (Run the script with the following arguments):
   root@kitploit:~

    python3 exploit.py --host <TARGET_IP> --port <PORT> --num-requests <NUM_REQUESTS> --concurrent-threads <THREADS> --request-interval <INTERVAL>
   

Parameters:

--host: Target server address (default: localhost).
--port: Target server port (default: 8080).
--num-requests: Total number of requests to send (default: 1000).
--concurrent-threads: Number of concurrent threads (default: 10).
--request-interval: Interval between requests in seconds (default: 0.5).
--log-file: Name of the log file (default: requests.log).