🌩️ GhostDOS - Advanced DDoS Stress Testing Tool

⚠️ LEGAL WARNING

GhostDOS is for authorized security testing ONLY. Use only on systems you own or have explicit written permission to test. Unauthorized use may violate laws and result in severe penalties.

📋 Features

Advanced Evasion Techniques

IP Spoofing: Multiple modes (random, geographic, cloud providers)
Human Behavior Simulation: Realistic browsing patterns
Protocol Mixing: Multiple attack vectors simultaneously
Traffic Pattern Randomization: Mimics real user surges
TLS/SSL Support: Encrypted attack traffic
Browser Fingerprinting: Realistic HTTP headers and cookies

Attack Vectors

HTTP/HTTPS Flood: Human-like web traffic
TCP SYN Flood: Connection exhaustion
SlowLoris: Slow HTTP connections
DNS Amplification: Reflected amplification attacks
Mixed Attacks: Multiple vectors simultaneously

Realism Features

Geographic IP distribution
Real browser user agents
Search query simulation
Session persistence
Referrer chains
Human think times
Randomized delays

🚀 Quick Start

Prerequisites

# Kali Linux (recommended) or any Linux with:
# - Python 3.8+
# - Root privileges (for raw sockets)
# - Basic networking tools

# Check Python version
python3 --version

# Check privileges (need root)
sudo whoami

Installation

# 1. Download GhostDOS
git clone https://github.com/razielapps/ghostdos.git
cd ghostdos

# 2. Run setup script (as root)
sudo bash setup_ghostdos.sh

# 3. Make executable
chmod +x ghostdos.py

Basic Usage

# Show help
sudo python3 ghostdos.py --help

# Basic attack (60 seconds, medium intensity)
sudo python3 ghostdos.py --target example.com:80 --duration 60 --intensity medium

# HTTPS attack
sudo python3 ghostdos.py --target https://target.com --duration 120 --intensity high

# Custom configuration
sudo python3 ghostdos.py --target 192.168.1.100:443 --duration 300 --spoof geographic --intensity extreme

⚙️ Configuration

Command Line Options

--target, -t     Target (IP:port, domain:port, or URL) [REQUIRED]
--duration, -d   Attack duration in seconds (default: 60)
--intensity, -i  Intensity level: low, medium, high, extreme (default: medium)
--spoof, -s      Spoofing mode: random, geographic, sequential, cloud_providers
--protocol, -p   Protocol: mixed, http, syn, dns, slowloris (default: mixed)
--threads        Override thread count
--verbose, -v    Verbose output
--dry-run        Simulate without sending packets

Intensity Levels

Level	Threads	Packets/Sec	Description
Low	10	100	Stealth testing
Medium	50	1,000	Standard load
High	200	5,000	Stress testing
Extreme	500	10,000	Maximum load

Spoofing Modes

Random: Completely random IP addresses
Geographic: Regional distribution (mimics global users)
Sequential: Sequential IPs from cloud ranges
Cloud Providers: Only cloud provider IP addresses

🔧 How It Works

Attack Methodology

1. Target Analysis
   ├── Parse target (IP/port/URL)
   ├── Determine protocol
   └── Select attack vectors

2. IP Spoofing
   ├── Generate spoofed source IPs
   ├── Randomize source ports
   └── Geographic distribution

3. Human Behavior Simulation
   ├── Realistic browser fingerprints
   ├── Session cookies
   ├── Referrer chains
   └── Human think times

4. Protocol Attacks
   ├── HTTP/HTTPS floods
   ├── TCP SYN floods
   ├── SlowLoris connections
   └── DNS amplification

5. Evasion
   ├── Traffic pattern randomization
   ├── TLS encryption
   ├── Header randomization
   └── Rate limiting

Realism Techniques

Burst Patterns: Mimic real user activity bursts
Geographic Distribution: IPs from actual regions
Browser Fingerprints: Real Chrome/Firefox/Safari headers
Session Persistence: Maintain cookies and sessions
Referrer Simulation: Realistic navigation paths
Human Delays: Reading/thinking times between actions

📊 Output & Results

Log Files

ghost_logs/
└── ghostdos_20240115_143022.log

Log Format:

2024-01-15 14:30:22 | INFO     | Thread-1       | Starting HTTP flood on example.com:80
2024-01-15 14:30:27 | INFO     | MainThread     | Progress: 5.0s | Active: 50/50 | Packets: 1250 (250.0/s)

Report Files

ghost_reports/
└── attack_20240115_143022.json

Report Content:

{
  "target": "example.com:80",
  "timestamp": "2024-01-15T14:30:22",
  "duration_seconds": 60,
  "intensity": "medium",
  "total_packets": 45000,
  "total_bytes": 225000000,
  "packets_per_second": 750.0,
  "bytes_per_second": 3750000.0,
  "attack_distribution": {
    "HTTPFlood": 35,
    "SYNFlood": 15
  },
  "spoofing_mode": "geographic"
}

Real-time Statistics

During execution, you'll see:

Progress: 15.0s | Active: 48/50 | Packets: 11250 (750.0/s) | Bytes: 56.2MB (3.7MB/s)

⚖️ Legal & Ethical Use

Acceptable Use Cases

Authorized Penetration Testing: With written permission
Security Research: In controlled lab environments
System Hardening: Testing your own infrastructure
Educational Purposes: Classroom learning with permission
Bug Bounty Programs: Within explicitly defined scope

Prohibited Activities

Unauthorized Testing: Any system without permission
Service Disruption: Causing downtime for others
Malicious Attacks: For harm or extortion
Law Violation: Breaking computer fraud laws
Terms of Service Violation: Cloud provider ToS

Legal Compliance

Computer Fraud and Abuse Act (CFAA)
General Data Protection Regulation (GDPR)
Local Cybersecurity Laws
Service Provider Terms
Organizational Policies

🔍 Troubleshooting

Common Issues

Permission Denied

Error: "Permission denied" for raw sockets

Solution:

sudo python3 ghostdos.py [options]

No Network Connectivity

Error: Connection refused/timeout

Check:

Target is online and reachable
No firewall blocking
Correct port is open
DNS resolution works

Performance Issues

Low packet rate

Adjust:

# Reduce thread count
--threads 20

# Lower intensity
--intensity low

# Increase system limits
ulimit -n 65535
sysctl -w net.core.somaxconn=65535

Debug Mode

# Verbose output
sudo python3 ghostdos.py --target example.com --verbose

# Dry run (simulation)
sudo python3 ghostdos.py --target example.com --dry-run

# Save output
sudo python3 ghostdos.py --target example.com 2>&1 | tee output.log

🎓 Educational Value

Learning Objectives

This tool demonstrates:

Network Protocols: TCP/IP, HTTP, DNS, SSL/TLS
Attack Vectors: Multiple DDoS techniques
Evasion Techniques: IP spoofing, traffic mimicry
Traffic Analysis: Pattern recognition
Defense Strategies: Mitigation techniques
Ethical Considerations: Responsible disclosure

Defensive Insights

By understanding attacks, you learn to:

Implement rate limiting
Configure Web Application Firewalls (WAF)
Set up intrusion detection systems (IDS)
Deploy DDoS protection services
Monitor traffic patterns
Respond to incidents

🛡️ Defensive Countermeasures

Detection Signs

Unusual Geographic Distribution: Traffic from unexpected regions
Header Anomalies: Non-standard browser headers
Session Patterns: Unusual cookie/session behavior
Rate Abnormalities: Sudden traffic spikes
Protocol Mixing: Multiple attack vectors simultaneously

Mitigation Strategies

Rate Limiting: Per-IP request limits
Geo-blocking: Block suspicious regions
CAPTCHA: Challenge suspicious traffic
WAF Rules: Pattern-based blocking
CDN Protection: Cloud-based DDoS protection
Traffic Scrubbing: Clean traffic centers

📚 Resources

Similar Tools (Educational)

LOIC: Low Orbit Ion Cannon
HOIC: High Orbit Ion Cannon
HULK: HTTP Unbearable Load King
R.U.D.Y: R-U-Dead-Yet (SlowLoris)

Defensive Tools

Snort: Intrusion Detection
Suricata: Network Security Monitoring
ModSecurity: Web Application Firewall
Fail2Ban: Intrusion Prevention

🔮 Future Development

Planned Features

AI-Powered Traffic Generation: Machine learning for realism
Blockchain Integration: Decentralized attack coordination
Mobile Traffic Simulation: Smartphone user behavior
API Attacks: REST/graphQL specific attacks
Cloud Service Attacks: AWS/Azure/GCP specific vectors

Research Areas

Adversarial machine learning
Zero-day attack vectors
Quantum-resistant cryptography
5G network vulnerabilities
IoT device security

⚠️ FINAL WARNING

USE RESPONSIBLY AND LEGALLY.

GhostDOS is a powerful security tool that can cause serious harm if misused.

Always obtain proper authorization before testing any system.

The developers assume no liability for misuse of this software.

GhostDOS v2.0 - Advanced DDoS stress testing for security professionals. Remember: With great power comes great responsibility.

Key Features Summary:

1. Advanced Spoofing

Multiple IP spoofing modes
Geographic distribution
Cloud provider IPs
Sequential/random patterns

2. Human Behavior Simulation

Real browser fingerprints
Session persistence
Referrer chains
Human think times
Search query simulation

3. Multiple Attack Vectors

HTTP/HTTPS floods
TCP SYN floods
SlowLoris
DNS amplification
Mixed attacks

4. Evasion Techniques

Traffic pattern randomization
TLS encryption
Header randomization
Rate limiting
Geographic distribution

5. Professional Features

Real-time statistics
JSON reporting
Logging system
Performance monitoring
Resource management

Author: Conscience Ekhomwandolor

Name		Name	Last commit message	Last commit date
Latest commit History 3 Commits
LICENSE		LICENSE
README.md		README.md
ghostdos.py		ghostdos.py
setup_ghostdos.sh		setup_ghostdos.sh

License

razielapps/ghostdos

Folders and files

Latest commit

History

Repository files navigation