jseidl/GoldenEye

This repository has been archived on 24/Apr/2024
Stars
1,324
Rank 35,502 (Top 0.7 %)
Language
Python
Created about 12 years ago
Updated 12 months ago

jseidl/GoldenEye

jseidl

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

GoldenEye Layer 7 (KeepAlive+NoCache) DoS Test Tool

THIS PROJECT IS NO LONGER MAINTAINED

GoldenEye

GoldenEye is a Python 3 app for SECURITY TESTING PURPOSES ONLY!

GoldenEye is an HTTP DoS Test Tool.

Attack Vector exploited: HTTP Keep Alive + NoCache

Usage

 USAGE: ./goldeneye.py <url> [OPTIONS]

 OPTIONS:
    Flag           Description                     Default
    -u, --useragents   File with user-agents to use                     (default: randomly generated)
    -w, --workers      Number of concurrent workers                     (default: 50)
    -s, --sockets      Number of concurrent sockets                     (default: 30)
    -m, --method       HTTP Method to use 'get' or 'post'  or 'random'  (default: get)
    -d, --debug        Enable Debug Mode [more verbose output]          (default: False)
    -n, --nosslcheck   Do not verify SSL Certificate                    (default: True)
    -h, --help         Shows this help

Utilities

util/getuas.py - Fetches user-agent lists from http://www.useragentstring.com/pages/useragentstring.php subpages (ex: ./getuas.py "http://www.useragentstring.com/pages/useragentstring.php?name=All") REQUIRES BEAUTIFULSOUP4
res/lists/useragents - Text lists (one per line) of User-Agent strings (from http://www.useragentstring.com)

Changelog

2016-02-06 Added support for not verifying SSL Certificates
2014-02-20 Added randomly created user agents (still RFC compliant).
2014-02-19 Removed silly referers and user agents. Improved randomness of referers. Added external user-agent list support.
2013-03-26 Changed from threading to multiprocessing. Still has some bugs to resolve like I still don't know how to propperly shutdown the manager.
2012-12-09 Initial release

To-do

Change from getopt to argparse
Change from string.format() to printf-like

License

This software is distributed under the GNU General Public License version 3 (GPLv3)

LEGAL NOTICE

THIS SOFTWARE IS PROVIDED FOR EDUCATIONAL USE ONLY! IF YOU ENGAGE IN ANY ILLEGAL ACTIVITY THE AUTHOR DOES NOT TAKE ANY RESPONSIBILITY FOR IT. BY USING THIS SOFTWARE YOU AGREE WITH THESE TERMS.

Babadook

Connection-less Powershell Persistent and Resilient Backdoor

virtuaplant

VirtuaPlant is a Industrial Control Systems simulator which adds a “similar to real-world control logic” to the basic “read/write tags” feature of most PLC simulators.

hass-magic_areas

Areas with batteries included for Home Assistant

Multi-TOR

Shellscript opens multiple TOR instances

torblock

TORBlock is a BASH script to automatically download the list of TOR exit-nodes and add them to your IPTables ruleset.

GoldenEye-Mobile

GoldenEye Mobile Android Layer 7 HTTP DoS Test Tool

usernamer

Pentest Tool to generate usernames/logins based on supplied names.

peach-pit

Peach Fuzzer PIT Files

ha-room

Room presence custom_component for Home Assistant

bifrost

bifröst - Intelligent Self-Learning Whitelist-based Web Application Firewall

liboutplus

C library for structured output in many formats as text, csv, json, xml, html etc

etter.filter.hrf

The HRF (HTTP Request/Response Filter) is an ettercap filter that virtually downgrades HTML pathes on-the-fly replacing 'https' strings to 'http' forcing data to be sent over plaintext

nsrlex

Computer forensics tool to extract from NSRL signature files the known-good and known-bad hashsets.

iDRACula

iDRACula uses the Shodan API (www.shodanhq.com) to search for Dell iDRAC boards exposed to the internet with default credentials

whitespace

Whitespace Programming Language Tools

debian-bootstrap

Script for bootstrapping a debian-based distro

envmgr

Safely and easily manage service API keys to be used as environment variables

Talks

Materials from talks on conferences

prick

The PHP Resource Information Conformity checKer will scan through all your PHP file's variable's and function's names to check for consistency of the used character set in order to detect obfuscated (and potentially malicious) values for those entities.

pi-weather-station

Weather Station for Raspberry Pi

mita

Man-in-the-App Proof-of-concept code

Wordpress-Do

Apple's Quicksilver / Gnome Do-like quick action manager for Wordpress

cpft

Copy-and-Paste File Transfer is a simple proof-of-concept VBS script that encodes and decodes base64-encoded binaries thus allowing to transfer files via text-only interfaces.

esphome-packages

Handy packages for ESPHome