https://github.com/b4fun/turtle
🐢 Turtle is a toolkit for simulating and validating application layer denial-of-service attacks in both live and unit testing environments.
https://github.com/b4fun/turtle
golang-http-attack security slowloris slowloris-attack
Last synced: about 2 months ago
JSON representation
🐢 Turtle is a toolkit for simulating and validating application layer denial-of-service attacks in both live and unit testing environments.
- Host: GitHub
- URL: https://github.com/b4fun/turtle
- Owner: b4fun
- License: mit
- Created: 2023-08-08T05:57:40.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2023-10-16T21:19:02.000Z (over 1 year ago)
- Last Synced: 2025-03-05T14:03:20.166Z (3 months ago)
- Topics: golang-http-attack, security, slowloris, slowloris-attack
- Language: Go
- Homepage:
- Size: 3.58 MB
- Stars: 2
- Watchers: 1
- Forks: 0
- Open Issues: 3
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
🐢 Turtle is a toolkit for simulating and validating application layer denial-of-service attacks in both live and unit testing environments.
## 🚨 Disclaimer
> **Important**: The use of this program for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to comply with all applicable local, state, and federal laws. The developers assume no liability and are not responsible for any misuse or damage caused by this program.
## 🎯 Why Use Turtle?
Exposing an application to the public internet is fraught with risks due to various types of denial-of-service attacks, such as:
- [slowloris][cf_slowloris]
- [low and slow attack][cf_low_and_slow]
- [R.U.D.Y][cf_rudy]
- ... and many more
While some applications may have well-configured settings that render them invulnerable to these attacks, others, such as those built with popular languages like Golang, might be [vulnerable by default][gonuts_slowloris].
Turtle provides an easy way to validate your application against these common threats to identify risks.
Furthermore, an application that is secure today may become vulnerable due to future changes.
Therefore, integrating these attack simulations into your regular validation process is crucial.
## 🛠 Features
Turtle provides:
- A Command-Line Interface (CLI) for validating real endpoints
- A Golang library for easy integration into unit/integration tests
### Supported Scenarios
Turtle current supports the following scenarios:
- [slowloris][cf_slowloris]
- [slow body read][cf_low_and_slow]
## 🚀 Getting Started
### Turtle CLI
You can install the CLI tool via:
```bash
go install github.com/b4fun/turtle/cmd/turtle@latest
```
Or download a release binary from the [GitHub Release page][gh_release].
### Using Turtle CLI
The turtle CLI embeds supported scenarios as sub-commands. A common way to invoke a scenario test:
```
$ turtle
```
Further details can be obtained by viewing the command's help message:
```
$ turtle -h
# Scenario specified help
$ turtle slowloris -h
```
To learn more, please checkout one of the following guides:
- [Is my server Slowloris-proofed?](/docs/usage/cli-slowloris.md)
### Turtle Golang Library
For the Golang library, documentation can be found on [GoDoc][godoc].
## 📜 LICENSE
Turtle is distributed under the [MIT license](/LICENSE)
[cf_slowloris]: https://www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris/
[cf_low_and_slow]: https://www.cloudflare.com/learning/ddos/ddos-low-and-slow-attack/
[cf_rudy]: https://www.cloudflare.com/learning/ddos/ddos-attack-tools/r-u-dead-yet-rudy/
[gonuts_slowloris]: https://groups.google.com/g/golang-nuts/c/MFZd6b8zQTQ
[gh_release]: https://github.com/b4fun/turtle/releases
[godoc]: http://godoc.org/github.com/b4fun/turtle