Collected research

Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS!

Orange Tsai · Orange Tsai · 17 August 2022

Three flaws in Microsoft IIS hash tables: a key-splitting bug amplifying hash-flooding until a default install is unresponsive at about 30 connections per second; an output cache that keys on the first duplicate query parameter while ASP.NET concatenates all of them, giving cache poisoning; and a token cache comparing the username twice instead of the password, allowing authentication bypass.

Record

Researcher

Orange Tsai

Published by

Orange Tsai

Date

17 August 2022

Topic

Crypto

In the archive

• Collected in the 2022 research round

Related sources

• Presentation slides Whitepaper
• Let's Dance in the Cache Destabilizing Hash Table on Microsoft IIS｜HITCON PEACE 2022
• DEF CON 30 - Orange Tsai - Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS
• Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS

Tags

• cache-poisoning
• auth-bypass
• algorithmic-complexity
• dos
• aspnet
• cache
• dotnet
• cve
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Orange Tsai, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.