DDoS Tools 2026: The GitHub Flood Stack

[Blackhatpakistan]

A denial-of-service writeup that lists tools alphabetically is useless, because a flooder is only as interesting as the layer it attacks and the defense it has to beat. The 2026 GitHub landscape sorts cleanly along those lines: amplification kits that rent borrowed bandwidth, protocol flooders that chew state tables, slow-loris cousins that hold sockets open like patient fingers, and HTTP armies that pretend to be ten thousand bored users - plus one 16.8k-star Swiss Army knife that refuses to pick a layer at all. Below: the whole stack sorted by attack class with live repository links and star counts, what each class actually stresses on the defending side, a lab flooder you can read in one sitting, a ceiling tester that measures YOUR server's breaking point instead of guessing it, and the lab discipline that keeps all of this pointed at boxes you own. Post your ceiling - the cleanest lab report gets pinned, first fifteen get the load-test harness.

TL;DR - DDoS is a war of bottlenecks: the attacker picks whichever resource the defender has least of - bandwidth (volumetric), connection state (protocol), request rate (application), or open sockets (slow class) - and spends the cheapest resource he has against it. The GitHub map: MatrixTM/MHDDoS is the center of gravity at 16.8k stars with 56 methods spanning layers, gkbrk/slowloris (2.8k) and shekyan/slowhttptest (1.7k, actively updated) anchor the slow class, jseidl/GoldenEye (1.5k) does keep-alive Layer 7, 649/Memcrashed (1.4k) weaponizes Memcached reflection via Shodan-discovered servers, OffensivePython/Saddam (1.1k) does amplification, Leeon123/CC-attack (1.1k) drives proxy-distributed HTTP floods, and the long tail covers SYN floods (jiangeZh, C), TCP/UDP floods, C2-style multi-method kits (RevengeC2) and teaching tools like MertOzerdem/DDOS-TOLL with its HULK/Ping-of-Death/Smurf/Slowloris sampler. Defense maps to class: anycast CDN and upstream scrubbing for volumetric, SYN cookies and conntrack tuning for protocol, rate limiting and browser challenges for HTTP, aggressive timeouts and worker-slot discipline for slow. Code block one is a compact keep-alive flooder for the lab; code block two is the ceiling tester - ramp load against your own endpoint, log latency percentiles and error curves, find where YOUR stack breaks before anyone else does. Lab rules: own infrastructure only, sacrificial VPS targets, monitoring running the whole time, staged ramps. Six-question self-check, scoreboard below.

THE FOUR CLASSES: PICK YOUR BOTTLENECK

- Volumetric - the pipe. Reflection and amplification send more traffic to the target than the sender used: Memcached, DNS, NTP and SNMP responders answer small queries with oversized replies, spoofed to the victim's address. Defended by anycast capacity, upstream filtering and clean providers - not by the target box itself.
- Protocol - the state table. SYN floods, fragmented garbage, packet storms that fill conntrack tables and half-open connection slots until legit handshake traffic has nowhere to sit. Defended by SYN cookies, backlog tuning and dropping junk early at the edge.
- Application - the request rate. Ten thousand GETs that each look human-ish but arrive at a rate no app server was provisioned for. Defended by rate limits, CDN-level bot challenges, caching discipline and honest capacity planning.
- Slow class - the socket table. Connections opened politely, then dribbled: headers held half-finished, POST bodies arriving one byte per second, keep-alive sessions that never complete. Each connection costs the server a worker slot; a few thousand is an outage. Defended by aggressive read timeouts, worker-slot budgets and fronting proxies that finish handshakes on the client's behalf.

THE GITHUB MAP, BY CLASS

- MatrixTM/MHDDoS - 16.8k stars, updated days ago. The heavyweight: 56 methods across layers, proxy support, layer 4 and 7, the reference implementation everything else gets compared to.
- 649/Memcrashed-DDoS-Exploit - 1.4k stars. Memcached amplification with Shodan to discover open responders - the purest example of borrowed bandwidth economics.
- OffensivePython/Saddam - 1.1k stars. Amplification toolkit in Python, readable enough to understand reflection mechanics from source.
- Leeon123/CC-attack - 1.1k stars. Proxy-distributed HTTP/HTTPS flood - the CC-attack pattern where each request arrives from a different exit.
- jseidl/GoldenEye - 1.5k stars, archived but canonical: keep-alive plus no-cache Layer 7 testing, the tool that taught a generation what a worker slot costs.
- gkbrk/slowloris - 2.8k stars. The slow class distilled: open connections, send headers one line at a time, keep them alive forever. Low bandwidth, high patience.
- shekyan/slowhttptest - 1.7k stars, C++, updated this month. Self-described application-layer DoS simulator with performance metrics - half tool, half measuring instrument, which is why defenders run it too.
- valyala/goloris - 380 stars, Go. Slowloris aimed specifically at nginx worker models.
- jiangeZh/SYN_Flood - 123 stars, C. Raw SYN flood for the protocol class; Leeon123/TCP-UDP-Flood (164 stars) covers the UDP side.
- MrSanZz/RevengeC2 - the C2 pattern: SYN, ICMP, TCP, HTTP, UDP, DNS flood, Slowloris and TLS under one roof - command-and-control shape rather than single-shot script.
- D4Vinci/PyFlooder - 403 stars, minimal HTTP flood; dotfighter/torshammer (343 stars) does slow POST - the application-layer cousin of loris.
- codeshold/ddos-dos-tools - 739 stars, a collection; Red-company/RDDoS_Tool (507), thehackingsage/ddos (292, Windows/Linux/Android), cutipu/HASOKI (131), Mrprogrammer2938/DDos-Attack (149), firefoxbug/ddos (145), Laorynas/Saphyra (189) fill out the mid-field.
- MertOzerdem/DDOS-TOLL - the sampler: HULK, Ping of Death, UDP, SNMP, Smurf ICMP and Slowloris in one teaching collection - a museum of classes in a single repo.

CODE: THE LAB FLOODER

The whole application class compresses to this: many threads, keep-alive connections, headers that look ordinary, a rate the target did not budget for. Thirty lines, stdlib only - read it to see how little separates "load test" from "attack" besides whose hostname is in the variable. Point it at infrastructure you own.

import socket, threading, random, time

HOST, PORT = "127.0.0.1", 8080        # lab target: your own box, always

THREADS, DURATION = 200, 30           # ramp these DOWN first, not up

PATHS = ["/", "/index.html", "/api/status"]

UAS = ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131.0.0.0",

       "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"]

stop = time.time() + DURATION

lock = threading.Lock()

sent = [0]

def worker():

    while time.time() < stop:

        try:

            s = socket.create_connection((HOST, PORT), timeout=5)

            s.settimeout(5)

            req = ("GET %s HTTP/1.1\r\nHost: %s\r\nUser-Agent: %s\r\n"

                   "Accept: */*\r\nConnection: keep-alive\r\n\r\n") % (

                random.choice(PATHS), HOST, random.choice(UAS))

            s.sendall(req.encode())

            # hold the socket: read once, keep alive, repeat

            while time.time() < stop:

                s.sendall(("GET %s HTTP/1.1\r\nHost: %s\r\nConnection: keep-alive\r\n\r\n"

                           % (random.choice(PATHS), HOST)).encode())

                with lock:

                    sent[0] += 1

                time.sleep(random.uniform(0.05, 0.2))   # trickle, not blast

            s.close()

        except Exception:

            time.sleep(0.1)

threads = [threading.Thread(target=worker) for _ in range(THREADS)]

for t in threads: t.start()

for t in threads: t.join()

print("requests dispatched:", sent[0], "over", DURATION, "s")

# watch the TARGET's metrics in another pane: latency, error rate, worker slots

CODE: THE CEILING TESTER

Attack class theory is trivia until you know where your own stack bends. This tester ramps concurrent load against your endpoint in stages, records latency percentiles and status-code mix per stage, and prints the stage where p95 latency or the error rate falls off a cliff - your ceiling, measured, with the stage number you can hand to whoever does your capacity planning. Run it against your own hosts or a client's authorized staging environment; the numbers it produces are the same ones a real flood would eventually produce, at a rate you chose.

import concurrent.futures as cf, statistics, time, urllib.request, sys

URL = sys.argv[1] if len(sys.argv) > 1 else "http://127.0.0.1:8080/"

STAGES = [10, 25, 50, 100, 200, 400]   # concurrent workers per stage

DURATION = 10                          # seconds per stage

def hit(_):

    t0 = time.time()

    try:

        r = urllib.request.urlopen(urllib.request.Request(URL,

            headers={"User-Agent": "ceiling-tester/1.0"}), timeout=10)

        code = r.status

        r.read(1024)

    except urllib.error.HTTPError as e:

        code = e.code

    except Exception:

        code = 0                        # connection refused / reset / timed out

    return (time.time() - t0) * 1000, code

print("%-8s %-8s %-9s %-9s %-7s" % ("stage", "reqs", "p50 ms", "p95 ms", "errs"))

ceiling = None

for stage in STAGES:

    lat, codes = [], {}

    t_end = time.time() + DURATION

    with cf.ThreadPoolExecutor(max_workers=stage) as ex:

        futs = [ex.submit(hit, i) for i in range(stage * 8)]

        for f in cf.as_completed(futs):

            ms, c = f.result()

            lat.append(ms)

            codes[c] = codes.get(c, 0) + 1

    lat.sort()

    p50 = lat[len(lat) // 2]

    p95 = lat[int(len(lat) * 0.95) - 1]

    errs = sum(v for k, v in codes.items() if k in (0, 429, 503))

    err_rate = 100.0 * errs / max(1, len(lat))

    print("%-8d %-8d %-9.0f %-9.0f %5.1f%%" % (stage, len(lat), p50, p95, err_rate))

    if ceiling is None and (p95 > 3000 or err_rate > 5):

        ceiling = stage                  # first stage where the cliff appears

    time.sleep(1)

print("CEILING: stage %s (%d concurrent) - first stage past p95>3s or errors>5%%"

      % (ceiling if ceiling else "not reached", ceiling or STAGES[-1]))

HOW THE OTHER SIDE SEES IT

Every class has a mirror on the defense side, and knowing the mirror is what separates a useful lab test from a wasted weekend. Volumetric dies at the edge: anycast absorption and upstream scrubbing mean the target's own box never sees most of it - which is why testing volumetric against a CDN-fronted site mostly measures the CDN's patience. Protocol floods meet SYN cookies and conntrack budgets tuned so half-open state costs the attacker more than the defender. Application floods meet rate limits, caching and challenge pages - and the tell that you are behind one is a p95 that plateaus while errors climb, exactly the shape the ceiling tester plots. Slow class meets short timeouts: modern frontends finish or kill handshakes in under a second, which is why GoldenEye-era Apache tricks bounce off nginx with aggressive read timeouts - and why goloris targeting nginx specifically is the more honest test. Run the tester against your own stack, read which stage cliffs first, and you know which class an attacker would reach for - because that is the resource you ran out of first.

TEST YOURSELF: SIX QUESTIONS

Score honestly: (1) name the four attack classes and one resource each one exhausts. (2) your website behind a CDN - which class can even reach your origin, and which dies at the edge? (3) what does SYN cookies actually prevent? (4) where does your own stack's ceiling sit - which concurrency stage does p95 blow past three seconds? (5) why does a slowloris variant need a different counter than a request-rate flood? (6) if someone ran PyFlooder against your production URL right now, which layer would absorb it and what would the first metric to move be? Zero to one: theory without a single measurement. Two to three: you know the map, go get your ceiling number. Four plus: you run load tests like you run backups - on a schedule - post the report.

POST YOUR CEILING

Scoreboard format, lab-honest: stack (CDN or origin, web server, instance size), tool used, ceiling stage from the tester (concurrency number), first symptom that moved (p95, error rate, worker slots, conntrack table), and which class that symptom says you are weakest against. Own infrastructure only - describe setups, not third-party targets. Cleanest lab report gets pinned to the node, first fifteen posters get the load-test harness (the ceiling tester wired with ramp profiles for Apache, nginx and a containerized app stack) via PM.

LAB DISCIPLINE

- Target ownership, always - your VPS, your staging, your client's written scope. Every tool above runs fine against 127.0.0.1, and the ceiling numbers are identical.
- Ramp down first - start at stage ten, let monitoring graph it, walk up. A test that jumps straight to 400 workers teaches you nothing about WHERE it broke.
- Monitoring is the point - latency percentiles, error mix, worker-slot occupancy and conntrack depth logging DURING the run. Without telemetry a flood test is just noise with intent.
- Sacrificial targets - a disposable VPS for destructive tests, never the box serving real users mid-ramp; snapshots before every session.
- Network manners on shared infra - upstream providers log volumetric signatures even from test traffic; keep amplification-class experiments on isolated lab segments, not production links.
- Write the report - stage, symptom, fix. The ceiling tester's output pinned next to your nginx worker config is the difference between a hobby and capacity planning.

FAQ

- Q: Is MHDDoS worth its 16.8k stars, or is it star-farming?

A: It is genuinely the most complete single repo - method breadth, proxy handling, active maintenance. As a library of technique it is unmatched; as a first read it is overwhelming, which is why the class-sorted map above exists.
- Q: Why do slow-class tools still work in 2026?

A: Because connection state is still finite everywhere - even hardened frontends have worker slots and timeout budgets, they just moved the cliff. goloris targeting nginx exists precisely because nginx's cliff is in a different place than Apache's.
- Q: Can any of this take down a site behind Cloudflare?

A: Volumetric dies at their edge, generic HTTP floods hit their challenge layer - what survives is whatever reaches YOUR origin directly: stale DNS records, origin IP exposure, uncached expensive endpoints. The real lesson of CDN-era DDoS is attack surface hygiene, not bigger pipes.
- Q: What is the difference between a stresser and these repos?

A: Same methods, different packaging - booters rent these techniques behind a web panel with someone else's bandwidth. Reading the repos tells you exactly what a rented stresser is doing, usually for free and with better code.
- Q: Do defenders really use attack tools?

A: slowhttptest openly calls itself a simulator with performance metrics and gets run by server operators; the ceiling tester above is the same discipline pointed inward. You cannot size a defense you have never measured.
- Q: Which single number should a small site know?

A: Its ceiling: the concurrency at which p95 latency crosses three seconds or errors pass five percent. One number, one afternoon with the tester, and every capacity decision afterwards has a floor to stand on.

RELATED

What Is Malware 2026: 9 Types Ranked by Damage - Which One Hit You?

Evil Twin WiFi Attack 2026: 7 Signs the Hotspot Is Fake (Lab Build Inside)

Proxies for Carding 2026 - Complete Proxy Guide

njRAT 2026 - Complete Guide: How the Most Famous RAT Works, Detection & Research