goldeneye.py

Test a specific website

$ [path/to/]goldeneye.py [url]

$ [path/to/]goldeneye.py [url] [[-u|--useragents]] 100 [[-s|--sockets]] 200

$ [path/to/]goldeneye.py [url] [[-n|--nosslcheck]]

$ [path/to/]goldeneye.py [url] [[-d|--debug]]

$ [path/to/]goldeneye.py [[-h|--help]]

goldeneye.py [options] <url>

-w <workers>, --workers <workers>
    Number of worker processes (default: 10)

-s <sockets>, --sockets <sockets>
    Sockets per worker process (default: 30)

-t <threads>, --threads <threads>
    Threads per worker process (default: 250)

-m, --multithreading
    Enable multithreading

-d, --debug
    Enable debug output

-k, --keepalive
    Enable keep-alive connections

-u <useragent>, --useragent <useragent>
    Custom user-agent string

-x, --proxy
    Use single proxy from list

-r, --randomize
    Randomize proxy list

-c <cookies>, --cookies <cookies>
    HTTP Cookie header

-p <proxyfile>, --proxy-file <proxyfile>
    File containing proxy list

-a, --accept
    Include Accept header

-2, --http2
    Enable HTTP/2 support

-3, --http3
    Enable HTTP/3 support

-j, --json
    POST JSON payloads

-n, --nofollow
    Disable following redirects

-f, --force
    Force POST requests

-o, --only-headers
    Send only headers

-g, --gzip
    Enable gzip compression

-y, --verify
    Verify SSL certificates

-z, --timeout <timeout>
    Connection timeout (seconds)

-l, --latency
    Display latency stats

-v, --verbose
    Verbose output

GoldenEye.py is a pure Python 3 script for generating high-volume HTTP GET/POST floods to simulate Layer 7 DDoS attacks. It opens multiple sockets per thread, maintaining persistent connections to overwhelm web servers. Designed for stress testing your own infrastructure, it supports proxies, custom user-agents, and multithreading.

Key features include random IP spoofing via proxies, keep-alive connections, and POST data payloads. It mimics browser behavior to evade basic protections but is detectable by advanced WAFs. Warning: Misuse constitutes a criminal offense under laws like the CFAA. Only use with explicit permission on targets you control. Not for production or unauthorized testing.

Legal warning: DDoS attacks are illegal without authorization. Use solely for testing owned systems. High resource usage may crash your own machine. Incompatible with Python 2; requires Python 3+. Proxies must be HTTP/SOCKS5 format.

Basic test: python3 goldeneye.py http://example.com
With workers/proxies: python3 goldeneye.py -w 50 -s 100 -p proxies.txt https://target.com

Requires requests, urllib3. Install via pip install -r requirements.txt. No root needed.

Originally inspired by 2014 GoldenEye malware. Rewritten in Python 3 by jseidl (2016) on GitHub as a testing tool. Updated sporadically for modern HTTP/2+ support and bug fixes.

hping3(8), slowhttptest(1), ab(1)