How my comments section got nuked (and how I fixed it)

A few days ago, my comments section faced its first real test. A friend decided to practice some scripting and “light” web security, and my site became the guinea pig.

The protection was non-existent. My comments API was wide open:

• No rate limiting (Spam away!)
• No captchas or session handling.
• Zero request validation—if it was JSON, my backend liked it.

The “attacker” quickly realized that the PHP script accepted any JSON payload and appended it to a file. It didn’t take a sophisticated botnet to bring the endpoint down, only a tiny Python script using requests.post().

Here is the “hacking tool” in question:

import requests
import time
from sys import argv, exit as sys_exit

# Simplified version of the script used
def send_comment(author, body):
    payload = {"author": author, "body": body}
    headers = {"Accept": "application/json", "Content-Type": "application/json"}
    
    response = requests.post(
        "[https://zenisoft.net.ua/comments.php](https://zenisoft.net.ua/comments.php)",
        json=payload,
        headers=headers
    )
    return response.json()

# ... you get the idea.

Technically, it wasn’t a masterclass in hacking, but it proved how fragile an unprotected endpoint is. My comments JSON file eventually bloated to about 500KB, filled with hundreds of spam entries. Luckily, since it was all just plain text, cleaning it up was easier than fixing a corrupted database.

But they didn’t stop there. After the spam, they pulled out Bombardier to stress-test the server:

bombardier -c 250 -n 1000000000000 https://zenisoft.net.ua

Ironically, my hosting provider’s (Ukraine.com.ua) infrastructure-level protection kicked in faster than my own code did. The server stayed up mostly because the host did the heavy lifting for me.

What I changed

Even a small hobby project needs basic security. I’ve since added:

• Basic Rate Limiting: No more infinite posts per second.
• Validation: Checking whether the data makes sense before saving it.
• Improved Logging: So I can see exactly who is “testing” things next time.
• Cooldowns: Adding a mandatory wait time between comments.

I don’t see this as a “betrayal.” A technical attack on your own system is an extremely aggressive bug report.

If someone can break your site in five minutes for fun, someone else will eventually do it for real. I used the incident as a free security lesson and made the site harder to abuse.

Special thanks to the guy at themomer.ru for accidentally becoming my unpaid QA engineer.