1
<?php
if (!isset($_SESSION)) {
        session_start();
}
// anti flood protection
if($_SESSION['last_session_request'] > time() - 2){
        // users will be redirected to this page if it makes requests faster than 2 seconds
        header("location: http://www.example.com/403.html");
        exit;
}
$_SESSION['last_session_request'] = time();
?>

I've already tested this script as you higher the second It Will keep redirecting to http://www.example.com/403.html without any reason.

Can anyone tell me why?

4
  • 1
    Debugging tip: echo the variable before the if statement to make sure it is what you think it is.
    – sachleen
    Sep 23, 2012 at 15:34
  • Try making your first line just be session_start() without the if statement
    – sachleen
    Sep 23, 2012 at 15:36
  • 1
    I've just tested this script - it works perfectly. It doesn't keep on redirecting for myself.
    – David
    Sep 23, 2012 at 15:36
  • Well Higher seconds to 8 then it will keep redirecting
    – Unknown3r
    Sep 23, 2012 at 15:41

9 Answers 9

8

Let's think about this logically for a second...

The attacker's request is already being sent to the web-server and through to the PHP script. The bottle-neck which causes failure in DDoS attacks is the web-server.

The idea behind a DDoS attack is just that - to cause a denial of service, in which the website/server is unable to process any new requests. So in escense, this approach is irrational. You need to go up the ladder of request handling.

If you have a server to your disposal, it's easier. You could simply implement a rate limiting rule on the kernel firewall/iptables. But assuming you do not have access to that, Apache is still at your disposal - although not as efficient.

Implementing a rule within .htaccess is a better solution, but still not perfect. But depending on the DDoS attack, there's no real solution at the developer's disposal to block it.

7
  • then i have my own private server but iptables doesnt limit 6 requests per ip
    – Unknown3r
    Sep 23, 2012 at 16:09
  • Really? You can implement a rule set that will block x number of requests within x amount of second that have a certain state. See: debian-administration.org/articles/187
    – nand
    Sep 23, 2012 at 16:14
  • By The Way I have Already Tried This . i need to limit requests per ip automaticaly
    – Unknown3r
    Sep 23, 2012 at 16:23
  • Well there are plenty of articles out there, just google. :) google.com/search?q=rate+limit+with+iptables
    – nand
    Sep 23, 2012 at 16:27
  • i have saw as many articles but still having same problem. iptables configured properly though.
    – Unknown3r
    Sep 23, 2012 at 16:28
2

I'm using a good anti-flood script that des not need cookies (perfect for webservices). It's not perfect against advanced DDOS attacks but it's enough for preventing beginners attacks and automatic multiple requests.

For using it, before it's needed to create "flood" folder with a "ctrl" file inside and a "lock" subfolder. Also needed to be setted with correct permissions.

Already tested by me.

define("SCRIPT_ROOT", dirname(__FILE__));

// number of allowed page requests for the user
define("CONTROL_MAX_REQUESTS", 3);
// time interval to start counting page requests (seconds)
define("CONTROL_REQ_TIMEOUT", 2);
// seconds to punish the user who has exceeded in doing requests
define("CONTROL_BAN_TIME", 5);
// writable directory to keep script data 
define("SCRIPT_TMP_DIR", SCRIPT_ROOT."/flood");
// you don't need to edit below this line
define("USER_IP", $_SERVER["REMOTE_ADDR"]);
define("CONTROL_DB", SCRIPT_TMP_DIR."/ctrl");
define("CONTROL_LOCK_DIR", SCRIPT_TMP_DIR."/lock");
define("CONTROL_LOCK_FILE", CONTROL_LOCK_DIR."/".md5(USER_IP));
@mkdir(CONTROL_LOCK_DIR);
@mkdir(SCRIPT_TMP_DIR);


if (file_exists(CONTROL_LOCK_FILE)) {
    if (time()-filemtime(CONTROL_LOCK_FILE) > CONTROL_BAN_TIME) {
        // this user has complete his punishment
        unlink(CONTROL_LOCK_FILE);
    } else {
        // too many requests
        echo "<h1>DENIED</h1>";
        echo "Please try later.";
        touch(CONTROL_LOCK_FILE);
        die;
    }
}

function antiflood_countaccess() {
    // counting requests and last access time
    $control = Array();

    if (file_exists(CONTROL_DB)) {
        $fh = fopen(CONTROL_DB, "r");
        $control = array_merge($control, unserialize(fread($fh, filesize(CONTROL_DB))));
        fclose($fh);
    }

    if (isset($control[USER_IP])) {
        if (time()-$control[USER_IP]["t"] < CONTROL_REQ_TIMEOUT) {
            $control[USER_IP]["c"]++;
        } else {
            $control[USER_IP]["c"] = 1;
        }
    } else {
        $control[USER_IP]["c"] = 1;
    }
    $control[USER_IP]["t"] = time();

    if ($control[USER_IP]["c"] >= CONTROL_MAX_REQUESTS) {
        // this user did too many requests within a very short period of time
        $fh = fopen(CONTROL_LOCK_FILE, "w");
        fwrite($fh, USER_IP);
        fclose($fh);
    }
    // writing updated control table
    $fh = fopen(CONTROL_DB, "w");
    fwrite($fh, serialize($control));
    fclose($fh);
}

Taken from here: https://github.com/damog/planetalinux/blob/master/www/principal/suscripcion/lib/antiflood.hack.php

0

just change > to <:

<?php        

if (!isset($_SESSION)) {
        session_start();
}
// anti flood protection
if($_SESSION['last_session_request'] < time() - 2){
        // users will be redirected to this page if it makes requests faster than 2 seconds
        header("location: http://www.example.com/403.html");
        exit;
}
$_SESSION['last_session_request'] = time();
?>
8
  • This will redirect the user who make requests slower then 2 seconds.
    – xdazz
    Sep 23, 2012 at 15:47
  • wasn't that the problam at first? Sep 23, 2012 at 15:50
  • i need to redirect user if he made more then 5 requests in 6 seconds
    – Unknown3r
    Sep 23, 2012 at 15:50
  • than you will have to save somewhere the time of the first request Sep 23, 2012 at 15:52
  • I just need to fix this php script just to limit 5 requests in 6 seconds
    – Unknown3r
    Sep 23, 2012 at 15:57
0

What spudinksi said still holds true, however here is what your looking for:

 <?php


 if (!isset($_SESSION)) {
         session_start();
 }

 if($_SESSION['last_session_request'] > (time() - 5)){
    if(empty($_SESSION['last_request_count'])){
        $_SESSION['last_request_count'] = 1;
    }elseif($_SESSION['last_request_count'] < 5){
        $_SESSION['last_request_count'] = $_SESSION['last_request_count'] + 1;
    }elseif($_SESSION['last_request_count'] >= 5){
            header("location: http://www.example.com/403.html");
            exit;
         }
 }else{
    $_SESSION['last_request_count'] = 1;
 }

 $_SESSION['last_session_request'] = time();

 ?>
0
0

For stop DDos add a null route for that ip, like this:

route add -host ???.???.???.??? reject
1
  • This doesn't actually "stop" a DDoS in any sense; it just ignores it.
    – user149341
    Jul 11, 2015 at 17:20
0

There is a script called IOSec, which is quite old, but it might help.

1
  • 2
    That link is not active anymore Nov 10, 2016 at 8:56
0

This will count page reloads & also save time after 3 seconds .... if it gives problems or to easy for newbies to bypass then leave comment..

if(empty($_SESSION['AFsys_time']) || $_SESSION['AFsys_time'] == '0') {
    $tGoal = time() + 3; // Pluss Seconds
    $_SESSION['AFsys_time'] = $tGoal;
}

if(empty($_SESSION['AFsys_pReloads']) || $_SESSION['AFsys_pReloads'] == 0 ) { $_SESSION['AFsys_pReloads'] = 1; } else { $_SESSION['AFsys_pReloads']++; };

if($_SESSION['AFsys_time'] < time()){
    $_SESSION['AFsys_time'] = 0; // Session Reset
    $_SESSION['AFsys_pReloads'] = 0; // Session Reset
}

if($_SESSION['AFsys_pReloads'] > '5' && $_SESSION['AFsys_time'] > time()){
    $_SESSION['AFsys_time'] = 0; // Session Reset
    $_SESSION['AFsys_pReloads'] = 0; // Session Reset
    header("location: http://www.example.com/403.html");
    exit; 
}
-1

this code not work for curl looping like this. session will create again on every curl exec;

for ($i=0;$i<999999999999999;$i++){

    /**/
    $c=curl_init();
    curl_setopt($c,CURLOPT_URL,"URL YOU WANT ATTACK");
    curl_setopt($c,CURLOPT_DNS_USE_GLOBAL_CACHE,TRUE);//dns
    curl_setopt($c,CURLOPT_HEADER,0);//get the header
    curl_setopt($c,CURLOPT_CONNECTTIMEOUT ,10);//get the header
    curl_setopt($c,CURLOPT_NOBODY,0);//and *only* get the header
    curl_setopt($c,CURLOPT_RETURNTRANSFER,1);//get the response as a string from curl_exec(), rather than echoing it
    curl_setopt($c,CURLOPT_FRESH_CONNECT,1);//don't use a cached version of the url
    curl_setopt($c, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko Firefox/11.0');
    curl_setopt($c, CURLOPT_HTTPHEADER, array('Content-type: application/x-www-form-urlencoded;charset=UTF-8' ));

    echo "\n $i";

}
-1

Session may be not work, because we haven't session coockie.

I recommend such

$load = sys_getloadavg();
if ($load[0] > 20) {
    header('HTTP/1.1 503 Too busy, try again later');
    die('Server too busy. Please try again later.');
}

Or you can

shell_exec('/sbin/iptables -I INPUT -j DROP -s ' . $ip);

for ddosing $ip

2
  • So in this case, as soon as the server load is over 20%... no one will access your server.... hmmmm i think not
    – Angry 84
    Jun 7, 2016 at 5:23
  • @Mayhem Разберись, что такое load average и в чем он измеряется!
    – M-A-X
    Jun 8, 2016 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.