![]() The time durable for these connections varies. Hulk tries to create various keep-alive connections. This trick makes it tough for intrusion prevention systems to detect the anomaly. So, for each request being generated, a random User Agent is picked. Hulk uses a good long list of known User Agents (see it in the next section) to obfuscate requests. To boost attack’s rate, you will have to use multiple nodes and deploy significantly-heavy client-side resources.For this test, he sent out all requests from the same host. ![]() The script made the victim server kneel in < 1 minute. Shteiman tested it against a MS IIS7 server with 4 GB RAM.Due to the versatility of its request, each request is capable of bypassing caching aids, intrusion detection tools, and other filtering mechanisms.Once the total of such requests reaches the concurrent connection count limit of server, legitimate user requests cannot be entertained By doing so, it tries to exhaust the server’s resource pool and bring it down. Hulk sends multiple unique requests to its target server sequentially.Let’s summarize the hulk web server tool’s working next: This makes it really tough to filter the traffic/packets.Īlso, the tool has several features like referer request obfuscation and hiding the actual agent/actor. So, not only does it run a DDoS attack, the script also tries to prevent the network's defense mechanism from guessing the attack pattern. HULL generates a number of unique requests at irregular intervals from the same host. HULK is very different from regular pentesting tools, attack scripts, and exploit methods. The purpose of its creation was to launch 'more real' attacks and test the actual efficiency of any server. ![]() He wrote this Python script for DDoS attack testing. With its help, security specialists can find loopholes in their security implementation against DDoS, and correct them before an actual threat actor exploits it.īarry Shteiman, a cybersecurity specialist (currently, the CTO of BlastRadius), created HULK in May, 2012.īarry was frustrated seeing how most of the pentesting tools generate predictable load packets or HTTP SYN requests, prohibiting security experts from checking the actual defense ability of their organizational networks. It is mainly designed for research purpose, and helps pen testers check the efficiency of a server. HULK is an abbreviation for HTTP Unbearable Load King, which is a web server Distributed Denial of Service tool.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |