GO KALI FREE

GoldenEye

Stress Testing

Intermediatehigh risk

GoldenEye is an HTTP denial-of-service testing tool that utilizes KeepAlive and NoCache headers to simulate heavy concurrent traffic and test web server resilience.

Installation

git clone https://github.com/jseidl/GoldenEye.git

Basic Syntax

python goldeneye.py <url> [options]

Quick Facts

Full Name
GoldenEye
License
MIT License
Author
Jan Seidl (jseidl)
Written In
Python
Platforms
Linux, macOS, Windows
Category
Stress Testing
First Release
2013
Attack Type
HTTP KeepAlive DoS

Tool Overview

GoldenEye is an HTTP stress testing tool designed to evaluate web server resilience against sustained HTTP connections. It uses KeepAlive headers to maintain persistent connections and NoCache headers to force server-side processing, maximizing resource consumption on the target server.

Unlike Slowloris which relies on incomplete requests, GoldenEye sends complete HTTP requests over KeepAlive connections. This makes it effective against a broader range of web servers, including event-driven servers like Nginx that are immune to Slowloris-style attacks.

GoldenEye features configurable worker threads and sockets per worker, allowing testers to dial up the load gradually. It also supports random HTTP methods (GET/POST) to simulate more realistic traffic patterns and avoid simple rate limiting.

Common Commands

./goldeneye.py http://example.comLaunch a basic HTTP GET flood against the target URL
python goldeneye.py http://example.comRun GoldenEye with the Python interpreter explicitly
./goldeneye.py https://example.comAttack an HTTPS target (SSL sockets are handled automatically)
./goldeneye.py http://example.com -w 10Spawn 10 concurrent worker processes
./goldeneye.py http://example.com -s 500Allow up to 500 concurrent socket connections per worker
./goldeneye.py http://example.com -m getUse the HTTP GET method for the flood
./goldeneye.py http://example.com -m postUse the HTTP POST method for the flood
./goldeneye.py http://example.com -m randomRandomly mix GET and POST requests
./goldeneye.py http://example.com -w 50 -s 1000High-intensity run with 50 workers and 1000 sockets each
./goldeneye.py http://example.com -dEnable debug output to troubleshoot the attack
./goldeneye.py http://example.com --debugLong-form flag to enable debug output
./goldeneye.py http://example.com -nDisable SSL certificate verification / no-SSL-check mode
./goldeneye.py http://example.com --nosslcheckLong-form flag to skip SSL certificate validation
./goldeneye.py http://example.com -w 25 -m post25 workers issuing POST requests
./goldeneye.py http://example.com -s 750 -m random750 sockets per worker with mixed methods

Step-by-Step Guide

  1. 1Double-check your authorization paperwork before initiating capacity testing
  2. 2Download the script and verify your Python environment is ready
  3. 3Launch the script using the base URL of your target environment
  4. 4Scale up the thread and socket limits to match your testing requirements
  5. 5Observe the target's performance metrics and responsiveness during the test

Warnings

Use Cases

Web Stress Testing

Simulate high-traffic conditions to evaluate web server performance and connection handling under load.

KeepAlive Testing

Test how servers handle persistent HTTP KeepAlive connections with sustained request volume.

Capacity Planning

Determine maximum concurrent connection capacity and identify bottlenecks in web infrastructure.

WAF Validation

Test if Web Application Firewalls can detect and mitigate HTTP flood attacks.

Load Balancer Testing

Evaluate load balancer behavior under sustained HTTP request loads across multiple servers.

Key Features

Related Tools

Slowloris

Stress Testing

Slow HTTP DoS testing with incomplete requests for connection exhaustion.

hping3

Stress Testing

Network packet crafting with SYN flood capability for layer 4 testing.

Metasploit

Exploitation

Auxiliary DoS modules for integrated HTTP flood testing.

Wireshark

Sniffing & Spoofing

Packet capture for analyzing HTTP traffic during stress tests.

Frequently Asked Questions

What is GoldenEye and how does it work?

GoldenEye is an HTTP denial-of-service testing tool that uses KeepAlive and NoCache headers to open persistent HTTP connections and send repeated requests. It simulates heavy concurrent traffic by maintaining many connections and continuously sending HTTP requests with random methods to consume server resources.

How is GoldenEye different from Slowloris?

GoldenEye sends complete HTTP requests (using KeepAlive to keep connections open) while Slowloris sends incomplete requests. GoldenEye is effective against more server types (including Nginx) because it consumes server resources through legitimate traffic volume rather than connection exhaustion. GoldenEye requires more bandwidth but works against a wider range of targets.

What parameters can I configure?

GoldenEye supports: -w (worker threads, default 10), -s (sockets per worker, default 500), -m (HTTP method: get, post, random), and -n (NoCache mode). Increasing workers and sockets creates more load. Random method mode alternates between GET and POST requests.

Is GoldenEye legal to use?

GoldenEye is a stress testing tool intended for authorized security assessments. Using it against systems without explicit written permission constitutes a denial-of-service attack and is illegal under laws like the CFAA. Never use GoldenEye against production systems without authorization.

Tags

#stress-testing#dos#http#networking

Output Explanation

Displays live statistics on open sockets and the average time taken for the server to reply.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.