DDoS Attack Tool Glossary

BASHLITE / Gafgyt / LizardStresser

Prolific IoT and Linux botnet malware family (also known as Gafgyt, Lizkebab, Torlus, LizardStresser, and others). Source code leaked in 2015, spawning hundreds of variants. Attack capabilities include UDP flood, TCP/SYN flood, and TCP connection holding. Each mode maps independently to taxonomy entries. Active and widely forked; parent lineage to many subsequent IoT botnets including Dark Frost.

Taxonomy classification

BitTorrent reflection

Abuses BitTorrent DHT and tracker protocols to direct UDP traffic at the victim. At the network edge, presents as AT17.

Taxonomy classification

BlackEnergy 3 HTTP

HTTP attack component of the BlackEnergy malware family. Generates high-volume HTTP GET requests with URL randomization to bypass caching layers. Primary methodology is AT11 with Recursive GET characteristics.

Taxonomy classification

BlackNurse

Sends ICMP Type 3 Code 3 (Destination Unreachable / Port Unreachable) packets at relatively low packet rates that nonetheless saturate CPU on firewalls and routers. The specific ICMP type is a refinement to maximize CPU impact per packet; the underlying methodology is AT23.

Taxonomy classification

Bobik

Botnet recruited by NoName057(16) for DDoS campaigns. Infected machines execute HTTP flood and SYN flood attacks on command from the group's Telegram-based coordination infrastructure. Maps independently per mode.

Taxonomy classification

Brobot / ItsOKNoProblemBro

Botnet associated with Operation Ababil attacks against US financial institutions. Primarily launched high-volume HTTP GET floods against web targets. URL randomization behavior to evade caching maps to AT14 (Recursive GET).

Taxonomy classification

Carpet Bombing

Carpet bombing is a DDoS attack technique in which attack traffic is distributed across many destination IP addresses within a target prefix rather than concentrated on a single host. It is not a distinct attack methodology. In the field, carpet bombing typically consists of conventional spoofed volumetric floods, most commonly AT1, AT2, AT3 and AT9 on TCP, and AT17 for UDP.

Read the RioRey technical brief on carpet bombing attacks

Taxonomy classification

CLDAP reflection

Exploits the Connectionless LDAP protocol to generate amplified UDP responses directed at the victim. At the network edge, presents as AT17. High amplification ratio but same edge methodology.

Taxonomy classification

Cyclops Blink

State-sponsored modular botnet attributed to Russian GRU-linked group Sandworm. Successor to VPNFilter. Targets SOHO routers and firewall devices (WatchGuard, ASUS). Modular architecture allows DDoS capability alongside espionage and proxy functions. DDoS modules include UDP and SYN flood capabilities. Disrupted by DOJ/FBI in 2022 but notable for persistence mechanisms designed to survive firmware upgrades.

Taxonomy classification

Dark Frost

DDoS botnet targeting the gaming industry. Modeled on Mirai, supporting SYN flood, UDP flood, and ICMP flood modes. Each maps to a distinct taxonomy entry.

Taxonomy classification

Davoset

Command-line DDoS tool that exploits third-party websites with XML External Entity (XXE) vulnerabilities and abuse-of-functionality weaknesses to redirect their traffic at a target. Leverages sites with poor input validation to amplify attack traffic. The methodology is consistent with AT16 (exploiting faulty application design to exhaust server resources).

Taxonomy classification

DDOSIM (DDoS Simulator)

Linux-based DDoS simulation tool that generates spoofed zombie hosts establishing full TCP connections to the target. Modes include HTTP flood with valid requests, HTTP flood with invalid requests, SMTP flood, and random-port TCP connection flooding. The full TCP connection simulation with spoofed IPs maps to AT7; HTTP request flooding maps to AT11; connection exhaustion maps to AT8.

Taxonomy classification

DirtJumper / Chameleon

Russian-origin crimeware DDoS toolkit. Supports multiple attack modes including HTTP GET floods, UDP floods, and SYN floods. Each mode maps to a distinct taxonomy entry and would be detected and mitigated independently.

Taxonomy classification

DNS Water Torture

Sends high volumes of DNS queries for randomized, non-existent subdomains, forcing recursive resolvers and authoritative servers to perform exhaustive lookups. At the network edge, traffic presents as valid-looking spoofed DNS request packets at high volume. This behavior aligns with our AT19 methodology. The randomized subdomain component is an evasion refinement, not a distinct methodology.

Taxonomy classification

Fodcha

Rapidly growing IoT botnet first observed in 2022. Targets routers and DVRs via known CVEs and weak credentials. Attack capabilities include SYN flood, UDP flood, and DNS flood. Notable for ransom-based extortion model alongside DDoS capabilities.

Taxonomy classification

Fraggle

The UDP variant of Smurf. Uses the same broadcast amplification mechanic but with UDP packets instead of ICMP. At the network edge, presents as a spoofed UDP flood. Largely retired for the same reasons as Smurf.

Taxonomy classification

GoldenEye

HTTP DoS tool that uses HTTP Keep-Alive and Cache-Control headers to hold open persistent socket connections while continuously issuing requests, consuming all available server sockets. The persistent connection exhaustion maps to AT8; the ongoing request volume maps to AT11.

Taxonomy classification

HOIC (High Orbit Ion Cannon)

Successor to LOIC. Focuses on HTTP-layer attacks using high-volume GET and POST requests. Supports "booster" scripts that randomize target URLs to evade simple pattern detection. This behavior is consistent with Recursive GET methodology.

Taxonomy classification

hping3

Versatile open-source packet crafting and network testing tool widely used to manually construct and send SYN floods, UDP floods, ICMP floods, ping floods, and fragmented packet attacks with spoofed source IPs and configurable packet sizes. A staple of penetration testing and attack simulation. Each mode maps independently to its taxonomy entry.

Taxonomy classification

HULK (HTTP Unbearable Load King)

HTTP flood tool that generates unique, obfuscated GET requests to a web server, randomizing user agents, referrers, and request parameters to bypass caching layers and hit server resource pools directly. Each request is deliberately distinct to evade pattern-based detection. Maps to AT11 for high-volume HTTP request flooding; the request randomization also exhibits AT15 behavior.

Taxonomy classification

Hyenae

Open-source network attack framework supporting ARP flooding, ICMP echo flooding, SYN flooding, and UDP flooding with spoofed source addresses. Used primarily in penetration testing and lab environments. Each mode maps independently.

Taxonomy classification

Kaiten / Knight

IRC-based DDoS botnet malware supporting UDP flood, TCP flood, SYN flood, and PUSH+ACK flood modes. Uses random source IPs. Each mode maps independently to its taxonomy entry. Largely retired but historically significant as an early multi-vector IRC-controlled botnet.

Taxonomy classification

KillNet

Russian hacktivist DDoS collective and associated toolset, active since 2022 with attacks targeting NATO-aligned governments and critical infrastructure. Attack methods include HTTP flood, UDP flood, and SYN flood, often coordinated across Telegram-recruited volunteers. Each mode maps independently. Operates similarly to Anonymous/LOIC campaigns but with explicit state-aligned targeting.

Taxonomy classification

LAND Attack

Sends a spoofed TCP SYN packet where both the source and destination IP are set to the victim's address, forcing the host to respond to itself and exhaust resources. A canonical example of the Synonymous IP methodology.

Taxonomy classification

LOIC (Low Orbit Ion Cannon)

Open-source stress testing tool widely used for DDoS attacks. Operates in three modes: UDP flood, ICMP flood, and HTTP GET flood. Each mode maps to a distinct taxonomy entry and would be detected and mitigated as separate attack types regardless of common origin.

Taxonomy classification

Mantis

HTTP botnet responsible for one of the largest application-layer DDoS attacks on record (~26 million RPS in 2022, per Cloudflare). Operates from a small number of compromised high-throughput virtual machines and servers rather than large IoT botnets. Uses HTTPS request flooding and HTTP pipelining. Maps to AT11 and AT12. Demonstrates the high-volume-per-bot approach similar to Mēris.

Taxonomy classification

Media data / RTP flood

Floods the victim with spoofed RTP (Real-time Transport Protocol) media stream packets at high volume. Direct implementation of AT21 methodology.

Taxonomy classification

Memcached reflection ("Memcrashed")

Exploits misconfigured Memcached servers to amplify UDP traffic directed at the victim. Capable of extreme amplification ratios. At the network edge, the victim receives a spoofed high-volume UDP flood. The reflection/amplification mechanism is a traffic generation technique and the methodology seen at the edge is AT17.

Taxonomy classification

Mēris

Large-scale botnet responsible for record HTTP pipeline attack volumes (peaked at ~21.8 million RPS in 2021). Primarily exploits MikroTik routers. Uses HTTP pipelining,sending large numbers of requests through persistent connections without waiting for responses. This maps to AT12. Also capable of standard HTTP request floods mapping to AT11. Notable for demonstrating that small numbers of high-throughput devices can exceed the volumetric output of traditional large botnets.

Taxonomy classification

Méris botnet pipelining

Large-scale botnet known for HTTP pipelining attacks, sending large numbers of requests through persistent HTTP/1.1 connections without waiting for responses. Pipelining behavior maps to AT12. Also capable of high-volume standard HTTP request floods consistent with AT11.

Taxonomy classification

Mirai (classic)

Landmark IoT botnet responsible for record-scale attacks. Supported multiple attack vectors including SYN floods, UDP floods, UDP fragmentation, ICMP floods, HTTP GET floods, and DNS floods. Each vector maps to a distinct taxonomy entry and would be detected and mitigated independently. Active and actively forked.

Taxonomy classification

Mozi

P2P IoT botnet active from 2019. Attack modules include SYN flood, UDP flood, and HTTP flood capabilities. Each maps to a distinct taxonomy entry. Largely disrupted following law enforcement action in 2023.

Taxonomy classification

MStream

Early DDoS tool focused on sending large volumes of UDP packets with randomized data. Largely retired. Implements AT17 methodology.

Taxonomy classification

Nitol / IMDDOS / ChinaZ

Evolving Chinese-origin DDoS botnet malware family. Connects to C2 via TCP socket on installation. Supports SYN flood, UDP flood, and HTTP flood attack modes. Was identified in 2012 as pre-installed on counterfeit Windows systems sold in China. Each attack mode maps independently.

Taxonomy classification

NoName057(16)

Pro-Russian hacktivist group active since 2022 using a distributed DDoS tool called DDoSia. Recruits volunteers who install the tool to contribute bandwidth to coordinated attacks against Ukrainian and NATO-affiliated targets. Attack methods are primarily HTTP flood and UDP flood. Maps to AT11 and AT17 depending on mode.

Taxonomy classification

NTP amplification (monlist)

Exploits the NTP monlist command to generate amplified UDP responses directed at the victim. At the network edge, presents as a high-volume spoofed UDP flood consistent with AT17. The amplification mechanism affects volume, not methodology.

Taxonomy classification

OWASP HTTP POST (DoS tool)

OWASP-published slow HTTP POST test tool for evaluating web server timeout handling. Establishes valid HTTP sessions and sends POST data at minimal rates to hold connections open indefinitely. AT10 methodology. Intended for authorized security testing.

Taxonomy classification

Pandora botnet

Android-based DDoS botnet that recruits smart TVs and Android devices via trojanized app updates. Supports SYN flood, UDP flood, and HTTP flood attack capabilities. Notable as one of the first botnets to extensively weaponize Android TV devices. Each attack mode maps independently.

Taxonomy classification

Ping of Death

Sends malformed or oversized ICMP packets that exceed the maximum IP packet size, forcing fragmentation that the victim cannot properly reassemble, causing crashes or reboots. Maps to AT24, the taxonomy's oversized/fragmented ICMP packet methodology.

Taxonomy classification

PyLoris

Python implementation of the slow HTTP attack methodology, similar to Slowloris. Establishes many slow HTTP connections over SOCKS proxies or SSL, keeping them open as long as possible to exhaust server connection limits. AT10 methodology.

Taxonomy classification

R.U.D.Y. (R-U-Dead-Yet)

Establishes valid HTTP sessions then transmits POST body data byte-by-byte, as slowly as the server timeout allows. Achieves connection exhaustion through session duration rather than volume. Implements the same underlying AT10 methodology as Slowloris, targeting POST body delivery rather than headers.

Taxonomy classification

Random Recursive GET

Variant of Recursive GET targeting numerically indexed pages (forums, news sites) by inserting random numbers within valid page reference ranges. Direct implementation of AT15 methodology.

Taxonomy classification

Reaper / IoT-Reaper

IoT botnet successor to Mirai. Exploited router and IoT device vulnerabilities for recruitment. Attack capabilities include SYN flood, UDP flood, and HTTP-layer floods. Each mode maps independently to taxonomy entries.

Taxonomy classification

Recursive GET / CPPFlood

Tool designed specifically to walk through indexed or enumerable web content with sequential or randomized GET requests. Direct implementation of AT14 methodology.

Taxonomy classification

RUDY (Slow POST)

Establishes valid HTTP sessions then transmits POST body data byte-by-byte, as slowly as the server timeout allows. Like Slowloris, achieves connection exhaustion through session duration rather than volume. The slow POST behavior maps primarily to AT10, while the HTTP request activity may also exhibit AT11 characteristics.

Taxonomy classification

Satori / Masuta

Mirai-derived IoT botnet variants. Supported SYN flood, UDP flood, and ICMP flood attack modes. Each maps independently to taxonomy entries.

Taxonomy classification

SlowHTTPTest / Slow Read

Testing tool that simulates multiple slow HTTP attack variants including Slowloris-style header attacks, RUDY-style slow POST, and slow read attacks (advertising a very small TCP receive window to force the server to send data slowly). All variants implement AT10 methodology: valid session, very low packet rate, very long session duration.

Taxonomy classification

Slowloris

Opens many partial HTTP connections and keeps them alive by sending partial HTTP headers slowly, never completing the request. Holds server threads open indefinitely with minimal bandwidth and very few bots required.

Taxonomy classification

Smurf

Sends spoofed ICMP echo requests to a broadcast address, causing all hosts on the subnet to reply to the victim. At the network edge, the victim receives a flood of ICMP packets from a large source IP range. Largely retired due to broadcast amplification being disabled on modern routers.

Taxonomy classification

Sockbot / HTTP Proxy botnets

A class of proxy-based HTTP flood botnets that route high-volume GET and POST requests through compromised or rented SOCKS proxy pools, randomizing source IPs to mimic distributed legitimate traffic. Maps to AT11 for request volume; AT14 when URL walking behavior is employed.

Taxonomy classification

SSDP / UPnP reflection

Exploits SSDP/UPnP responses to direct amplified UDP traffic at the victim. At the network edge, presents as AT17. Amplification is a generation technique only.

Taxonomy classification

SSL DoS / THC-SSL-DOS

Exploits the asymmetric computational cost of TLS/SSL renegotiation. A single attacker machine can initiate many renegotiation requests per second, each requiring significant server-side CPU. Establishes valid sessions then repeatedly triggers renegotiation to exhaust server CPU. Maps to AT8: valid session establishment followed by resource exhaustion through sustained session manipulation.

Taxonomy classification

Stacheldraht

Early DDoS botnet framework combining features of Trinoo and TFN with encrypted communications between attacker and handlers. Supported UDP flood, ICMP flood, SYN flood, and Ping flood modes. Largely retired.

Taxonomy classification

Steam Query amplification

Abuses Valve Steam server query protocol to generate amplified UDP responses. At the network edge, presents as AT17.

Taxonomy classification

SYN Reflection

Spoofed SYN packets are sent to third-party servers with the victim's IP as the source, causing those servers to direct SYN-ACK replies at the victim. At the network edge, the victim receives a SYN-ACK flood. The reflection mechanism is a traffic generation technique but the methodology arriving at the edge is AT2.

Taxonomy classification

TFN / TFN2K

Tribe Flood Network and its successor TFN2K. Early DDoS frameworks supporting multiple attack vectors: UDP flood, ICMP flood, SYN flood, and Ping flood. Each mode maps to a distinct taxonomy entry. Largely retired. Historically significant as an early multi-vector DDoS toolkit.

Taxonomy classification

TLS/SSL Renegotiation flood

Exploits the TLS renegotiation handshake, which is computationally expensive on the server side. Attacker repeatedly initiates renegotiation within established sessions, exhausting CPU resources. Valid session establishment maps to AT8; the prolonged session exhaustion mechanic maps to AT10.

Taxonomy classification

Tor's Hammer

Slow POST attack tool that operates over the Tor network. Primary methodology is slow HTTP POST delivery consistent with AT10. Can also generate high-volume HTTP requests consistent with AT11. Tor routing obscures source IPs but does not change the methodology at the network edge.

Taxonomy classification

Trinoo

One of the earliest organized DDoS botnet frameworks (late 1990s). Primarily launched UDP floods against target IPs. Largely retired. Historically significant as an early example of coordinated botnet-driven AT17 methodology.

Taxonomy classification

Tsunami / Amnesia

IRC-based Linux DDoS botnet (also known as Kaiten variant in some contexts; Amnesia is a separate Mirai-derived variant). Supports UDP flood, SYN flood, and TCP connection flooding. Tsunami variant associated with the Keksec threat group alongside Gafgyt. Each attack mode maps independently.

Taxonomy classification

VoIP INVITE flood

Sends high volumes of spoofed SIP INVITE messages to a VoIP server, overwhelming its ability to process connection requests. Direct implementation of AT20 methodology.

Taxonomy classification

VPNFilter

State-sponsored modular botnet attributed to Sandworm (Russian GRU). Infected 500,000+ SOHO routers globally. Third-stage modules included traffic manipulation and network attack capabilities consistent with UDP and SYN flood methodologies. Largely disrupted in 2018 by FBI/DOJ action; succeeded by Cyclops Blink.

Taxonomy classification

Xerxes

Slow HTTP attack tool similar to Slowloris. Establishes large numbers of HTTP connections and keeps them open by sending partial data slowly. Implements AT10 methodology.

Taxonomy classification

XOIC

GUI-based multi-protocol attack tool supporting UDP, ICMP, HTTP, and TCP attack modes. Claimed by its developers to exceed LOIC in effectiveness. Each protocol mode maps independently to its respective taxonomy entry and would be detected and mitigated as distinct attack types.

Taxonomy classification

XorDDoS

Linux trojan and botnet malware using XOR encryption for C2 communications. Targets Linux systems and IoT devices via SSH brute force. Attack capabilities include SYN flood, UDP flood, and DNS flood. Each maps independently. Active as of 2024-2025 with observed targeting of cloud-native environments.

Taxonomy classification

XorDDoS / Kaiji

Kaiji is a separate Golang-based IoT botnet with targeting and attack methods similar to XorDDoS. Attack methods include SYN flood and UDP flood. Both have been observed targeting exposed Docker servers in addition to traditional SSH/Telnet brute force infection vectors.

Taxonomy classification