Top 13 Denial-of-Service (DoS) Tools for Kali Linux
Some of the Most Popular DoS Tools
Top 13 Denial-of-Service (DoS) Tools for Kali Linux. There is no way I can list and evaluate every DoS tool, but here is a limited list of some of the most popular and effective. This is far from an exhaustive list, but I hope to give you the basics on some of the most popular DoS and DDoS tools. If you have a favorite, by all means, please put it in the comments with a link to the download.
One quick note of warning: Be very careful when looking online for DoS or DDoS tools. Many of them simply take you to a malicious link and will install a trojan on your system. I don’t know anyone who would do that. 😉
The Low Orbit Ion Cannon (LOIC) may be the most popular DoS tool and has made its way into hacker lore. It is capable of sending mass amounts of ICMP or UDP packets to the target. Thereby saturating the bandwidth, and has been used in some of the most effective and notorious DoS attacks.
LOIC was effectively used by 4chan in the Project Chanology attack on the Church of Scientology website in 2009. And by Anonymous in the Operation Payback attack against PayPal, Visa, and MasterCard in retaliation for cutting off WikiLeaks donations.
LOIC attacks can be largely mitigated by limiting UDP and ICMP packets and limiting how many packets can be sent and delivered to any one client. You can download LOIC on SourceForge. This tool is Windows-based and almost as easy as pointing and clicking.
The HOIC was developed during Operation Payback by Praetox—the same folks who developed LOIC. The key difference is that HOIC uses a HTTP flood using booster files that enable a small number of users to effectively DoS a website by sending a flood of randomized HTTP GET and POST requests. It is capable of simultaneously DoSing up to 256 domains. You can download it from SourceForge.
XOIC is another easy-to-use DoS tool. The user simply needs to set the IP address and port of the target, select a protocol (HTTP, UDP, ICMP, or TCP), then begin to fire away! You can download it on SourceForge
HTTP Unbearable Load King, or HULK, is another tool capable of bringing down web servers. This tool uses various obfuscation techniques to limit the ability of the target to mitigate the attack. You can download it on Packet Storm.
5. UDP Flooder
UDP Flooder does just as you would expect—it sends a flood of UDP packets to the target. It has been effectively used to knock gamers off their networks (online games primarily use UDP). You can download it at SourceForge.
R-U-Dead-Yet, or RUDY, takes a different approach to DoSing websites. It enables the user to select a form from the web app and then use that form to send a flood of POST requests. You can download it from Hybrid Security.
7. ToR’s Hammer
ToR’s Hammer was designed to be run through the ToR network to anonymize the attack and limit mitigation. The problem with this strategy is that the ToR network tends to be very slow, thereby limiting the rate at which the packets can be sent and thereby limiting the effectiveness of this tool. You can download it from Packet Storm or SourceForge. Top 13 Denial-of-Service (DoS) Tools for Kali Linux.
Pyloris is another DoS tool, but with still a different strategy. It allows the user to construct their own, unique HTTP request headers. It then attempts to keep open these TCP connections as long as possible in order to exhaust the connection queue. When it does this, no legitimate connections can be made and new attempts to connect by other users will be dropped. You can download it on SourceForge.
9. OWASP Switchblade
The Open Web Application Security Project (OWASP) and ProactiveRISK developed the Switchblade DoS tool to be used to test the resiliency of a web app to DoS attempts. It has three modes, 1. SSL Half-Open, 2. HTTP Post, and 3. Slowloris. You can download it from OWASP.
DAVOSET (DDoS attacks via other sites execution tool) is a DDoS tool, written in Perl, that uses zombie systems to distribute the attack across multiple systems. This tool uses Abuse of Functionality and XML External Entities vulnerabilities on other sites to “zombie” them and attack the target site. It includes over 160 zombie services. You can download it from Packet Storm or GitHub. Top 13 Denial-of-Service (DoS) Tools for Kali Linux.
11. GoldenEye HTTP DoS Tool
GoldenEye is simple DoS tool that loads an HTTP server attempting to exhaust its resource pool. It’s great for testing your website, but not really effective in the real world as most perimeter defenses will detect it. You can download it from GitHub. Top 13 Denial-of-Service (DoS) Tools for Kali Linux.
This DDoS tool (built right into Kali) is different from most DoS tools in that it doesn’t require huge amounts of bandwidth and can be conducted with a single system. It attacks vulnerabilities in SSL to bring down the server. You can download it from THC, but if you are using Kali, you already have it.
13. DDOSIM – Layer 7 DDoS Simulator
This tool from Storm Security simulates a DDoS attack from various zombies with random IP addresses. It attempts to create a full TCP connection (SYN-SYN/ACK-ACK). As the name implies, it operates at the application layer (layer 7). It is also capable of simulating a DDoS attack upon the SMTP server and a TCP flood at random ports. You can download it from SourceForge. Top 13 Denial-of-Service (DoS) Tools for Kali Linux.
Keep coming back, my fledgling hackers, as we continue to explore the tools and techniques of the most valuable skill set of the future—hacking!