Php sets the interval for refreshing to prevent cc attacks

 

Recently, CC attacks on several websites continue to learn about the principle of CC, and then try to find a method to temporarily defend against CC attacks. It cannot be hurt.
Attach the blocked attack

 

 

<? Php

 

 

@ Session_start ();

$ Allow_sep = "1"; // refresh time

If (isset ($ _ SESSION ["post_sep"])

{

If (time ()-$ _ SESSION ["post_sep"] <$ allow_sep)

{

Exit ("Please do not refresh repeatedly ");

}

Else

{

$ _ SESSION ["post_sep"] = time ();

}

}

Else

{

$ _ SESSION ["post_sep"] = time ();

}

?>

Attach another piece of code

<? Php

// Query the forbidden IP Address

$ Ip = $ _ SERVER ['remote _ ADDR '];

$ Fileht = ". htaccess2 ";

If (! File_exists ($ fileht) file_put_contents ($ fileht ,"");

$ Filehtarr = @ file ($ fileht );

If (in_array ($ ip. "\ r \ n", $ filehtarr) die ("Warning :"."

"." Your IP address are forbided by Mydalle.com Anti-refresh mechanic, IF you have any question Pls emill to root@zsl.name!

(Zsl. name Anti-refresh mechanic is to enable users to have a good shipping services, but there maybe some inevitable network problems in your IP address, so that you can mail to us to solve .) ");

// Add a prohibited IP Address

$ Time = time ();

$ Fileforbid = "log/forbidchk. dat ";

If (file_exists ($ fileforbid ))

{If ($ time-filemtime ($ fileforbid)> 30) unlink ($ fileforbid );

Else {

$ Fileforbidarr = @ file ($ fileforbid );

If ($ ip = substr ($ fileforbidarr [0], 0, strlen ($ ip )))

{

If ($ time-substr ($ fileforbidarr [1], 0, strlen ($ time)> 120) unlink ($ fileforbid );

Elseif ($ fileforbidarr [2]> 120) {file_put_contents ($ fileht, $ ip. "\ r \ n", FILE_APPEND); unlink ($ fileforbid );}

Else {$ fileforbidarr [2] ++; file_put_contents ($ fileforbid, $ fileforbidarr );}

}

}

}

$ Str = "";

$ File = "log/ipdate. dat ";

If (! File_exists ("log ")&&! Is_dir ("log") mkdir ("log", 0777 );

If (! File_exists ($ file) file_put_contents ($ file ,"");

$ AllowTime = 15; // anti-Refresh time

$ AllowNum = 2; // number of anti-Refresh attempts

$ Uri = $ _ SERVER ['request _ URI '];

$ Checkip = md5 ($ ip );

$ Checkuri = md5 ($ uri );

$ Yesno = true;

$ Ipdate = @ file ($ file );

Foreach ($ ipdate as $ k => $ v)

{$ Iptem = substr ($ v, 0, 32 );

$ Uritem = substr ($ v, 32, 32 );

$ Timetem = substr ($ v, 64, 10 );

$ Numtem = substr ($ v, 74 );

If ($ time-$ timetem <$ allowTime ){

If ($ iptem! = $ Checkip) $ str. = $ v;

Else {

$ Yesno = false;

If ($ uritem! = $ Checkuri) $ str. = $ iptem. $ checkuri. $ time. "1 \ r \ n ";

Elseif ($ numtem <$ allowNum) $ str. = $ iptem. $ uritem. $ timetem. ($ numtem + 1). "\ r \ n ";

Else

{

If (! File_exists ($ fileforbid) {$ addforbidarr = array ($ ip. "\ r \ n", time (). "\ r \ n", 1); file_put_contents ($ fileforbid, $ addforbidarr );}

File_put_contents ("log/forbided_ip.log", $ ip. "--". date ("Y-m-d H: I: s", time ()). "--". $ uri. "\ r \ n", FILE_APPEND );

$ Timepass = $ timetem + $ allowTime-$ time;

Die ("Warning :"."

". "Pls don't refresh too frequently, and wait ". $ timepass. "seconds to continue, IF not your IP address will be forbided automatic by Nanshan. biz Anti-refresh mechanic!

(Zsl. name Anti-refresh mechanic is to enable users to have a good shipping services, but there maybe some inevitable network problems in your IP address, so that you can mail to us to solve .) ");

}

}

}

}

If ($ yesno) $ str. = $ checkip. $ checkuri. $ time. "1 \ r \ n ";

File_put_contents ($ file, $ str );

?>

The following section judges Sessions and sends the possible cc ip address to 127.0.0.1, that is, the attacker.

 

<? Php

Session_start ();

$ Timestamp = time ();

$ Cc_nowtime = $ timestamp;

If (session_is_registered ('CC _ lasttime ')){

$ Cc_lasttime = $ _ SESSION ['CC _ lasttime'];

$ Cc_times = $ _ SESSION ['cc_times '] + 1;

$ _ SESSION ['cc_times '] = $ cc_times;

} Else {

$ Cc_lasttime = $ cc_nowtime;

$ Cc_times = 1;

$ _ SESSION ['cc_times '] = $ cc_times;

$ _ SESSION ['CC _ lasttime'] = $ cc_lasttime;

}

If ($ cc_nowtime-$ cc_lasttime) <5 ){

If ($ cc_times> = 10 ){

Header (sprintf ("Location: % s", 'HTTP: // 127.0.0.1 '));

Exit;

}

} Else {

$ Cc_times = 0;

$ _ SESSION ['CC _ lasttime'] = $ cc_nowtime;

$ _ SESSION ['cc_times '] = $ cc_times;

}

?>

If the proxy IP address is determined to be blocked on the Internet, the test fails. If VPN is used, the local machine fails to be used.