PHP: Opening URLs concurrently to simulate a DOS attack?

Question

I have configured my server with various anti-DOS modules (mod_qos, mod_evasive etc). What I want to do now is run a simple PHP scrip that calls URLs on my site multiple times, in order to reach the various limits on the site. Ideally a script that can somehow open various URLs concurrently would be ideal.

Is this possible? And if not, what is the easiest way to simulate multiple requests from one IP?

I would prefer a tool that works in Windows 7?

Update: Remember, i want to be able to see if my server is actually blocking some of the requests. I've only played with AB for a little bit, but so far it hasn't shown me that requests were blocked?

[ab](http://httpd.apache.org/docs/2.2/programs/ab.html)? – Joachim Isaksson Apr 08 '13 at 08:45 — Joachim Isaksson, Apr 08 '13 at 08:45

score 3 · Answer 1 · edited Apr 08 '13 at 09:03

3

i thinks you should try this tools,

Apache ab

Siege by Joe Dog Software

Apache JMeter

Apache Bench is easy and straightforward

you should also try tsung

here is something on github in ruby

but if you still want to simulate ddos in php, then i think in php you need to make use of socket and in loop send request to your server, and disconnect without waiting for response from your server, this way you can simulate it. like "Connect - Dispatch Request- Disconnect" and repeat this as many times possible.

edited Apr 08 '13 at 09:03

vbence

20,084
9
69
118

answered Apr 08 '13 at 08:49

dev.meghraj

8,542
5
38
76

Although watch out about `ab`, there have been some problems in the past that result in results that are worse than they should be. – Alfo Apr 08 '13 at 08:52
My problem is, I set my mod_qos rules to block an IP if there are more than 50 requests per second. I then ran "ab -k -c 500 -n 500 http://mysite.com" and it doesn't show any failures, or anything about 403 blocks. How can I see information on this? – rockstardev Apr 08 '13 at 09:01
then you should need to implement you own php script to handle anything what you want, and you can try with this https://code.google.com/p/php-dos-attacker/ – dev.meghraj Apr 08 '13 at 09:21

rockstardev · Accepted Answer · 2013-04-08T10:10:51.320

This was very useful under Windows: OpenLoad

I executed it using:

openload.exe http://www.mysite.com 250

And then I could easily see the result in my Apache Error Log:

tail -f /usr/local/apache/logs/error_log

I could see:

[Mon Apr 08 12:09:05 2013] [error] mod_qos(031): access denied, QS_SrvMaxConnPerIP rule: max=50, concurrent connections=59, c=XX.XXX.XX.XXX
[Mon Apr 08 12:09:05 2013] [error] mod_qos(031): access denied, QS_SrvMaxConnPerIP rule: max=50, concurrent connections=60, c=XX.XXX.XX.XXX
etc

score 1 · Answer 3 · answered Apr 07 '17 at 08:14

The simplest simulation would be by using an async xmlhttp request iterator function over an array various pages of the given domain at which the onload event initiates another page url call and cycle indefinitely, or for a certain large amount of times. And to make it a little bit more overwhelming, you'd open multiple instances of that same plain JS + HTML App, (say 9, or even 12) in parallel and see if anything happens or what will happen with the server after they've been running for a considerable amount of time and probably reached more than 1 million requests in about an hour of time.

PHP: Opening URLs concurrently to simulate a DOS attack?

3 Answers3

Linked