SecurityDoS is a professional-grade infrastructure resilience testing framework built in Go. Designed for Red Team operations and SRE (Site Reliability Engineering) teams, it provides deep insights into how your systems behave under extreme load.
Unlike traditional stress testing tools, SecurityDoS combines a high-performance concurrent engine with real-time analytics, 11 attack vectors, protocol-level abuse testing, multi-tenant support, Kubernetes-native scheduling, and an intelligent observation system that automatically identifies technical breaking points and security triggers.
- 11 Attack Vectors: HTTP/HTTPS, TCP Flood, UDP Flood, Slowloris, RUDY, H2 Rapid Reset, HTTP Smuggling, gRPC, GraphQL, WebSocket, SSE
- Protocol Support: HTTP/1.1, HTTP/2, HTTP/3 (QUIC), gRPC, GraphQL, WebSocket, SSE
- TLS Fingerprint Evasion: uTLS-based ClientHello randomization (Chrome, Firefox, Safari, iOS, Android, Edge)
- WAF & DDoS Evasion: Dynamic User-Agent rotation, IP spoofing (XFF), Referer randomization, X-Device-ID headers
- Protocol-Level Abuse: Malformed WebSocket frames, partial handshakes, fragmented control frames, SSE deep nesting, payload abuse, malformed events
- AI Breaking Point Finder: Binary search algorithm that probes targets at increasing RPS to find the exact breaking point
- Automated Analysis: Breaking point detection, latency degradation, security interception (WAF/rate-limit), load balancer imbalance, recovery detection
- Test Run Diff: Compare two test reports for regression detection with severity levels
- Adaptive Ramp: Dynamic stage generation based on target response
- Distributed Multi-Node: Coordinator forwards tests to worker nodes for horizontal scaling
- Test Scheduling: Cron-like recurring test jobs with pause/resume and max-runs limits
- Multi-Tenant Auth: Per-tenant tokens, RPS quotas, concurrent run limits, daily request limits, report isolation
- 24/7 Server Mode: Log rotation, report retention, idle optimization, health endpoint
- Config Hot-Reload: SIGHUP or
/api/reloadto reload configuration without restart - Checkpoint/Resume: Save test state and re-run from checkpoint
- Alerting: Webhook notifications on breaking point detection
- Headless Mode:
--headless <scenario.yaml>for automated pipelines with JSON output and exit codes - Helm Chart: Full K8s deployment with HPA, ingress, PVC, probes
- K8s Operator: CRD-based test scheduling via
SecurityDoSTestcustom resources - Prometheus Metrics:
/metricsendpoint for Grafana integration
- Real-time Monitoring: WebSocket-based live charts (RPS, TPS, latency p95/p99, status codes)
- Responsive UI: Works across desktop, tablet, and mobile
- System Detection: Detects CPU, RAM, FD limits, recommends max workers
- Target Type Selector: 13 target types with auto-configuration (webapp, WAF, LB, DNS, gRPC, etc.)
- 11 Vector Dropdown: Full vector selection with abuse mode support
- Report History: Browse, filter, and review past test results
The Kill Switch is a critical safety feature designed as an "Emergency Brake" for authorized testing.
- Instant Termination: Terminates all active load-generation goroutines in < 1 second.
- System Locking: Once activated, the system enters a "Locked" state. New tests cannot start until explicitly reset.
- API Access:
POST /api/killto activate,DELETE /api/killto reset.
Identifies structural failures when the Error Rate exceeds 5% (configurable) consistently for 3 seconds.
When average latency exceeds your configured threshold (e.g., 2000ms), identifies service degradation.
If more than 15% of traffic receives HTTP 429 or 403, detects active WAF/DDoS protection.
Binary search algorithm that probes the target at increasing RPS levels, detecting the exact breaking point via error rate + p99 latency thresholds. ~10% precision in 20 iterations max.
| # | Vector | Target | Category |
|---|---|---|---|
| 1 | HTTP / HTTPS | Web apps, APIs, WAFs | Volumetric |
| 2 | TCP Flood | Servers, proxies | Volumetric (L4) |
| 3 | UDP Flood | DNS, game servers | Volumetric (L4) |
| 4 | Slowloris | Proxies, LBs | Low-and-slow |
| 5 | RUDY | Servers, APIs | Low-and-slow |
| 6 | H2 Rapid Reset | HTTP/2 servers | Protocol abuse (CVE-2023-44487) |
| 7 | Smuggling Detection | Proxies | Detection (CL.TE, TE.CL, TE.TE) |
| 8 | gRPC Flood | Microservices | Volumetric (gRPC) |
| 9 | GraphQL Attack | GraphQL APIs | Application abuse (BATCH, ALIAS, DEEP) |
| 10 | WebSocket Flood | WS servers, streaming | Volumetric (WS) |
| 11 | SSE Flood | SSE endpoints, streaming | Connection exhaustion |
WebSocket:
| Mode | Description |
|---|---|
partial_handshake |
Incomplete WS upgrade requests to exhaust connection handling |
malformed_frames |
Invalid opcodes, oversized control frames, binary garbage |
fragmented_control |
Interleaved ping/text/close (protocol violation) |
SSE:
| Mode | Description |
|---|---|
deep_nesting |
50-level nested JSON POST to trigger parsing exhaustion |
payload_abuse |
64KB oversized payload to SSE endpoint |
malformed_events |
Binary/null/broken-JSON data as event stream content |
| Endpoint | Method | Description |
|---|---|---|
/api/start |
POST | Start a test run |
/api/stop |
POST | Stop the current test |
/api/status |
GET | Get current test status |
/api/metrics |
GET | Get current metrics snapshot |
/api/history |
GET | Get metrics history |
/api/report |
GET | Get current test report |
/api/reports |
GET | List all saved reports |
/api/health |
GET | Health check (no auth) |
/api/sysinfo |
GET | System information |
/api/kill |
POST/DELETE | Activate/reset kill switch |
/api/config |
GET | Get configuration |
/api/config/profiles |
GET | List test profiles |
/api/reload |
POST | Reload configuration from disk |
/api/bfind |
POST | Start AI breaking point finder |
/api/bfind/status |
GET | Check finder status |
/api/cluster/status |
GET | Check worker node statuses |
/api/checkpoints |
GET | List saved checkpoints |
/api/resume |
POST | Resume test from checkpoint |
/api/diff |
POST | Compare two test reports |
/api/tenants |
GET | List configured tenants |
/api/tenants/usage |
GET | Get per-tenant usage and quotas |
/api/schedule |
GET/POST | List/create scheduled test jobs |
/api/schedule/{id} |
GET/DELETE/POST | Get/remove/pause-resume a job |
/api/dashboard/settings |
GET/PUT | Get/update dashboard settings |
/metrics |
GET | Prometheus metrics export |
/ws/metrics |
WS | WebSocket metrics stream |
go install github.com/qyzan/SecurityDoS@latestgit clone https://github.com/qyzan/SecurityDoS.git
cd SecurityDoS
go mod tidy
go build -o securitydos .docker-compose up -d --build./securitydos
# Open http://localhost:8090./securitydos --guard./securitydos --headless configs/scenario_stress.yaml --guard
# Exit codes: 0=pass, 1=error, 2=breaking point detected
# JSON report to stdout, logs to stderr./securitydos --operator --guard
# Watches SecurityDoSTest CRs and triggers tests automaticallykill -HUP $(pgrep securitydos)
# Reloads config.yaml without restartconfigs/config.yaml:
server:
addr: ":8090"
safety:
allowed_targets:
- "api.test.internal"
- "localhost"
max_rps: 50000
max_duration: "2h"
auth_tokens:
- "your_secret"
tenants:
- name: "team-a"
token: "team-a-token"
max_rps: 5000
analysis:
breaking_point_rate: 0.05
latency_threshold_ms: 2000.0
security_trigger_rate: 0.15
dashboard:
refresh_interval_ms: 1000
max_chart_points: 300
theme: "dark"
default_unit: "RPS"
alerting:
enabled: true
webhook_url: "https://hooks.slack.com/services/..."
auth_header: "Bearer slack-token"
cluster:
workers:
- url: "http://worker1:8090"
token: "worker1-token"
name: "worker-1"helm install securitydos deploy/helm/
helm upgrade securitydos deploy/helm/ -f my-values.yamlkubectl apply -f deploy/k8s/crd.yaml
kubectl apply -f deploy/k8s/operator.yaml
kubectl apply -f deploy/k8s/example-test.yaml- Unrestricted Mode (Default): Ignores
allowed_targets,max_rps, andauth_tokens. - Protected Mode (
--guard): Enforces all safety policies, blocks unauthorized targets, requires valid API tokens.
go test ./... -race -count=1
# 80 tests across 9 packagesSecurityDoS is for authorized security testing only. Unauthorized use against targets you do not own or have explicit permission to test is strictly prohibited and may be illegal.
SecurityDoS v1.1.0 | Red Team Platform with 11 Vectors, K8s Operator, Multi-Tenant & Protocol Abuse