browser.forkbomb.txt

1999-08-17T00:00:00
ID PACKETSTORM:15118
Type packetstorm
Reporter Packet Storm
Modified 1999-08-17T00:00:00

Description

                                        
                                            `Jim Paris <jim@JTAN.COM>  
  
http://home.jtan.com/~jim/bugs/both/fork.html  
  
Repeated Browser Spawning  
  
New browser windows can be opened automatically with Javascript's window.open command. This page simply spawns a neverending supply of  
windows. This is similar to the Unix "while(1){fork();}" attack. Any browser that supports opening new windows with Javascript is vulnerable.  
  
I read that Netscape 4.x has a 100 window limit for untrusted pages. There are two problem with this. First, 100 is still a lot of windows to have open at  
once. Also, as soon as you close the 100th browser window, a new one is spawned.  
  
Sometimes you can close the windows faster than they come up, and once you close them all, it will stop. Sometimes you can't, and rebooting is  
necessary.  
  
The most effective way to write this script would be to have each new window run a new copy, making the browser spawning exponential. This can put  
a load on the remote server, however, because each new window would request a new copy of the page if the user's browser is configured to always  
check for new pages. As a result, all of the spawned windows are empty in the example below.  
  
The link below points to the following HTML page:  
  
<html><head><title>Browser Spawning!</title></head><body>  
<script>while(1) window.open("")</script>  
</body></html>  
`