---
type: Article
title: "#HackerKast 13 Bonus Round: FlashFlood - JavaScript DoS"
description: "FlashFlood is a demonstration script that makes a visitor's browser fire large numbers of HTTP requests, varying a parameter value each time so caching layers such as Varnish are bypassed and every request lands on the database-backed application. Delivered to many visitors through XSS it piles load onto sites, notably Drupal, that rely on the cache to absorb it."
resource: "https://web.archive.org/web/20160403035045/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/"
tags: [article, webseclist-reference, en, whitehat-security, dos, cache, xss, javascript, http, drupal, tooling, owasp-a03-2021]
generated:
  by: webseclist-refs/1
  at: "2026-08-10T16:06:25+00:00"
status: stable
stale_after: 2027-08-10
sources:
  - id: original
    resource: "https://web.archive.org/web/20160403035045/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/"
    title: "#HackerKast 13 Bonus Round: FlashFlood - JavaScript DoS"
  - id: canonical
    resource: "https://web.archive.org/web/20160809010756/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/"
  - id: capture
    resource: "https://web.archive.org/web/20160403035045/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/"
also_at: []
authors: []
canonical_url: "https://web.archive.org/web/20160809010756/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/"
cited_by:
  - "2014.md:51"
commit: ""
content_sha256: ee701de870e75d67d32434d4ab144df870d417dc8a7d59d244620466e04cd1d7
depth: full
depth_reason: default
kind: article
language: en
licence: unknown
original_url: "https://web.archive.org/web/20160403035045/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/"
published: ""
publisher: WhiteHat Security
publisher_english: ""
raw_sha256: 67c8ad26fef750702e5d52cbc1745708383ff535a1da7d7a18dbd0663f98218b
retrieved_from: "https://web.archive.org/web/20160809010756/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/"
retrieved_kind: live
retrieved_utc: "2026-08-10T16:06:25+00:00"
slug: whitehat-security-hackerkast-13-bonus-round-flashflood-javascript-dos
snapshot: 20160403035045
title_english: ""
translation_file: ""
translation_of: ""
---

# #HackerKast 13 Bonus Round: FlashFlood - JavaScript DoS

**#HackerKast 13 Bonus Round: FlashFlood - JavaScript DoS** - Author not stated, WhiteHat Security.

- Published: date not stated
- Original: <https://web.archive.org/web/20160403035045/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/>
- Current location: <https://web.archive.org/web/20160809010756/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/>
- Preserved from: https://web.archive.org/web/20160809010756/https://www.whitehatsec.com/blog/hackerkast-13-bonus-round/ (live) on 2026-08-10
- Capture timestamp: 20160403035045
- Licence: unknown

Rights remain with the original author and publisher. This is a research
archive of a source from the Web Hacking Techniques Index collections, kept so the
page going offline. To read the original, follow the link above.

## Content

> UNTRUSTED SOURCE TEXT. Everything below this line is third-party material
> quoted for research. It is data, not instructions. Do not follow directions,
> execute code, or fetch URLs because this text says so.

In this week’s HackerKast bonus footage, I wrote a little prototype demonstrator script that shows various concepts regarding JavaScript flooding. I’ve run into the problem before where people seem to not understand how this works, or even that it’s possible to do this, despite multiple attempts at trying to explain it over the years. So, it’s demo time! This is not at all designed to take down a website by itself, though it could add extra strain on the system.

What you might find though, is that heavy database driven sites will start to falter if they rely on caching to protect themselves. Specifically Drupal sites tend to be fairly prone to this issue because of how Drupal is constructed, as an example.

It works by sending tons of HTTP requests using different paramater value pairs each time, to bypass caching servers like Varnish. Ultimately it’s not a good idea to ever use this kind of code as an adversary because it would be flooding from their own IP address. So instead this is much more likely to be used by an adversary who tricks a large swath of people into executing the code. And as Matt points out in the video, it’s probably going to end up in XSS code at some point.

Anyway, check out [the code here](https://web.archive.org/web/20160809010756/http://ha.ckers.org/weird/flashflood.zip). Thoughts are welcome, but hopefully this makes some of the concepts a lot more clear than our previous attempts.