Simple function to check for the "Apache Killer" (see http://lists.grok.org.uk/pipermail/full-disclosure/2011-August/082299.html)

gistfile1.aw

<?php
    function testForExploit($strUrl = NULL) {
        // I would love to use “filter_var($strLongUrl, FILTER_VALIDATE_URL)” here,
        // but let us be honest, it sucks even more than regular expressions do.
        // (http://snipplr.com/view/14198/useful-regex-functions/)
        if (!preg_match('/^(http|https|ftp):\/\/([A-Z0-9][A-Z0-9_-]*(?:\.[A-Z0-9][A-Z0-9_-]*)+):?(\d+)?\/?/i', $strUrl)) {
            return false;
        }
        $oCurl = curl_init($strUrl);
        curl_setopt_array($oCurl, array (CURLOPT_HTTPHEADER => array('Range: bytes=0-4')
                                        ,CURLOPT_RETURNTRANSFER => 1
                                        ,CURLOPT_TIMEOUT => 15
                                        ,CURLOPT_CONNECTTIMEOUT => 0
                                        ,CURLOPT_SSL_VERIFYHOST => 0
                                        ,CURLOPT_SSL_VERIFYPEER => 0
                                        ,CURLOPT_FOLLOWLOCATION => 1
                                        ,CURLOPT_HEADER => 1
                                        ,CURLOPT_NOBODY => 1
                                        ,CURLOPT_ENCODING => 'gzip'));
        $strReturn = curl_exec($oCurl);
        if (strpos($strReturn, 'Partial') !== false) {
            echo "Probably exploitable: ".$strReturn."\n\n";
        } else {
            echo "Probably NOT exploitable: ".$strReturn."\n\n";
        }
    }

    testForExploit('http://www.apache.org/');
?>

You should add "Accept-Encoding: gzip" to the HTTPHEADER as in the original exploit code.

Uh, is this really needed? Actually I have no idea. :)

Hello Fabian, In my tests some (vulnerable) hosts need this for the test to work, as without it the site doesn't show up as vulnerable. The header is inserted in the original exploit code as well. Regards, George Moses Op 25-08-11 11:02, FabianBeiner schreef:

…

Uh, is this really needed? Actually I have no idea. :)

Added, thanks! :)