onlyadWRITEUP
INTERACTIVE WRITEUP · SELF-DOS

The Cookie Bomb, re-run.

A URL param is written straight into a cookie — then re-sent on every request until the server rejects the victim. Run it one step at a time, with your own target and payload.

LOW · CLIENT-SIDE DOS · $10K CLASS
progress node 1 / 6
Now: …
The Cookie Bomb — my first $10k
LOW · self-DoScookie bombing2019–2020

Sites write tracking params (gclid, utm_*, fbclid) straight into cookies. Send a ~4,000-char value → the browser re-sends it forever → the total header passes the server's 8,192 B cap → 400/414, victim bricked until they clear cookies. Earned the author $10k+ in a year.

1Pick a targetYOUR TURN
Hunt: "is this happening on other sites too?" — DevTools → Application → Cookies → look for gclid · utm_* · fbclid · dclid.
scan the target
Result✓ tracking found — gclid · utm_* · fbclid · dclid written to cookies. This site is a target.
✓ tracking stored — gclid · utm_* · fbclid · dclid
2Craft & send the payloadLOCKED
Random ~4,000-char string — "around the max size for cookies." Build the link, copy it, send it.
build the link
payload length4,000 chars
cookie jar — empty
Result✓ cookie planted — the victim's browser now re-sends your value on every request.
✓ cookie planted — re-sent on every request
3Verify it's storedLOCKED
"On reload, I checked if the string was stored as a cookie." Reload → read the Cookie header.
reload → read the header
Result✓ stored & re-sent — your value rides in the Cookie header of every request.
✓ stored & re-sent — rides every request
4Push past the capLOCKED
"Sometimes one parameter was enough, other times I combined multiple or repeated across subdomains." Get the header past 8,192 B.
combine → plant → reload
payload length4,000
total request size≈ 2.2 KB
under the 8,192 B cap
Result✓ 414 — total header ≈10.2 KB, past the 8,192 B cap. Server rejects.
✓ 414 — header ≈10.2 KB, past the cap
5Confirm brickedLOCKED
"The victim's session was essentially bricked until they cleared cookies." Reload — every request fails.
reload the app
https://target.com/
Welcome back
orders
cart
messages
414 URI Too Large — every reload fails until cookies are cleared.
Result✓ bricked — every reload fails until the victim clears cookies.
✓ bricked — everything fails until cookies cleared
6Report & fixLOCKED
"Simple to exploit, yet surprisingly widespread — $10k in my first year." Report it; cap the value before it's stored.
apply the fix → verify
Sandbox: vulnerable
default — payloads land
Result✓ defused — values capped at 128 B; the same link now does nothing.
✓ defused — capped at 128 B

Simulated victim — no traffic leaves this page. The one-line hint in each step shows how to run it on a real target.

✓