1.Right click to view the verification code image address
2.Found width and height in the url
3.Use burpsuite to fetch data and see the size of the returned package
4.Try modifying the length and width values and seeing the size of the returned package
5.Through the above test, we know that the vulnerability exists. If we send a 10000 packet to the server and the server takes 10s to process, then if we send 10 10000 packets?
10x10 = 100s
That is, the server takes 100s to process. When we send 100 such packets (of course, you should never throw them with 100 packets. Generally speaking, 20-50 test results can lead to website crashes.)