rudy
rudy copied to clipboard
darkweak
RUDY is an acronym used to describe a Denial of Service (DoS) tool used by hackers to perform slow-rate a.k.a. “Low and slow” attacks.
RUDY (R-U-Dead-Yet?)
What is the RUDY Attack?
R.U.D.Y., short for R U Dead yet, is an acronym used to describe a Denial of Service (DoS) tool used by hackers to perform slow-rate a.k.a. “Low and slow” attacks by directing long form fields to the targeted server. It is known to have an interactive console, thus making it a user-friendly tool. It opens fewer connections to the website being targeted for a long period and keeps the sessions open as long as it is feasible. The amount of open sessions overtires the server or website making it unavailable for the authentic visitors. The data is sent in small packs at an incredibly slow rate; normally there is a gap of ten seconds between each byte but these intervals are not definite and may vary to avert detection.
The victim servers of these types of attacks may face issues such as not being able to access a particular website, disrupt their connection, drastically slow network performance, etc.
This project is for educational, testing and research purpose.
The RUDY attack opens concurrent POST HTTP connections to the HTTP server and delays sending the body of the POST request to the point that the server resources are saturated. This attack sends numerous small packets at a very slow rate to keep the connection open and the server busy. This low-and slow attack behavior makes it relatively difficult to detect, compared to flooding DoS attacks that raise the traffic volume abnormally.
How to install and run rudy?
Using go install
go install -u github.com/darkweak/rudy/cmd/rudy@latest
rudy [command]
Using directly go
git clone https://github.com/darkweak/rudy
cd rudy
go run rudy.go [command]
Using go build
git clone https://github.com/darkweak/rudy
cd rudy
go build rudy.go -o rudy
rudy [command]
Commands
Attack a target
rudy run -u http://domain.com
There are some options to change the rudy default behaviour
| Name | Description | Long flag | Short flag | Example value | Default value |
|---|---|---|---|---|---|
| URL | The target URL to run the attack on. | --url |
-u |
http://domain.com |
|
| Concurrent requests | The number of concurrent requests to send on the target. | --concurrents |
-c |
4 |
1 |
| Filepath | Filepath to the payload to send. By default it's a random payload (1MB). | --filepath |
-f |
/somewhere/file |
|
| Interval | Interval duration between the requests. | --interval |
-i |
3s |
10s |
| Size | Random payload size to send. Used if no filepath given. | --payload-size |
-p |
1GB |
1MB |
| Tor | Use TOR proxy to send the requests. | --tor |
-t |
socks5://tor_endpoint |
Run the testing server
It will start a serer on the port :8081
rudy server
darkweak