PHP DDOS ?

[d.shankar]

I got this script from a chinese website.

It seems that it can prevent DDOS attack ... :-X

 

If (preg_replace ( "/ https? : \ / \ / ([^ \ /]+).*/ I "," \ \ 1 ", $ HTTP_SERVER_VARS [ 'HTTP_REFERER'])! = $ _SERVER [ 'HTTP_HOST']) {
Exit ( 'warning - your operation has been banned. '); 
}  

 

Is it correct ?

[d.shankar]

???

[MadTechie]

It will NOT stop DDOS attacks but can slow some of them down

if (!preg_match('%https?://([^/]+)%i', $_SERVER['HTTP_REFERER'])))
{
 Exit ( 'warning - your operation has been banned. '); 
}

 

But will also cause problems for some users, who are not doing anything bad..

 

 

'HTTP_REFERER'

    The address of the page (if any) which referred the user agent to the current page. This is set by the user agent. Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted.

 

so to sum up, its more trouble that its worth..

[d.shankar]

Thanks MT..

 

How can it slowdown the attack ?

 

Also is it possible to develop a real time DDOS Script ?

[MadTechie]

basically it looks for where the script was called from (using $_SERVER['HTTP_REFERER']), if its not from the server then it fails..

 

the problem.. not all clients/proxies will set this thus they will fail, it can be changed to make it seam like its from the server so its unsafe..

 

also if you have a submit button someone could Still simply click it 10000000X of times to cause a kinda DDOS attak

 

so to someup $_SERVER['HTTP_REFERER'] is usless, and the whole script replies on it..!

 

your probably be better off using sessions and on each click check the time in a session then set the session to the currect time..

ie

if($_SESSION['Clicker'] >= time()+15)
{
$_SESSION['Clicker'] = time();
//process action
}

 

hope that makes sense!

[d.shankar]

Thx for the idea MT.

 

Here i got a Anti-DDOS Script From The Web.

Will this be really helpful ?

http://alternityrpg.net/downloads/misc/anti_dos_php.zip