Layer 7 Methods

Layer 7 Methods

Tip

Start with GET, POST, or HEAD on an authorized host. Add a bypass method only after you know the target's WAF is in the way.

On this page

• Requirements
• How requests are built
• Method reference
• Proxies
• Tuning
• Worker behaviour

Requirements

flowchart LR
    W[Worker] --> P{Proxy?}
    P -->|yes| C[Proxy socket]
    P -->|no| D[Direct socket]
    C --> T{HTTPS?}
    D --> T
    T -->|yes| S[TLS 1.2+]
    T -->|no| R[Send request]
    S --> R

Loading

• A URL or hostname.
• A proxy type and proxy file. Use 0 and an empty file to run without proxies.
• A thread count, RPC, and duration.

python3 start.py GET https://example.com 0 100 http.txt 10 60

How requests are built

Each thread builds one base request with:

• the selected HTTP method;
• the target path and query string;
• Host;
• a random user agent from files/useragent.txt;
• a random referer from files/referers.txt;
• forwarded-for style headers with a random IP;
• HTTP/1.0 or HTTP/1.1.

POST-style methods add a body and the matching Content-Length. The connection is reused for rpc requests, then closed.

For HTTPS targets the tool uses TLS 1.2 or newer. Certificate and hostname verification are disabled by design, because the target may be any authorized test host. The default port is 443 for HTTPS and 80 for HTTP.

Method reference

Basic HTTP

Method	Behaviour
GET	Random headers, GET request
POST	JSON body with a random value
HEAD	HEAD request
NULL	Null user agent and null referer
PPS	Minimal request with no extra headers
EVEN	GET, then reads one byte of the response
COOKIE	Adds random cookies
APACHE	Sends a large Range header
XMLRPC	WordPress pingback XML body
STRESS	Large JSON POST body
BOT	robots.txt and sitemap.xml with bot user agents

These methods work without any bypass logic and are the best starting point for a new test.

Bypass-style methods

Method	What it tries
CFB	Cloudflare challenge handling through cloudscraper
CFBUAM	Cloudflare Under Attack Mode: send, wait 5 seconds, continue
BYPASS	Requests session, plain GET
DGB	DDoS-Guard challenge flow
GSB	Google Project Shield style request
AVB	ArvanCloud style request with a delay
OVH	OVH-oriented request pattern, capped at 5 requests per connection
DYN	Random subdomain in the Host header
RHEX	Random hex path and Host
STOMP	/cdn-cgi/l/chk_captcha attempt
SLOW	Slowloris-style keep-alive headers
DOWNLOADER	Reads the response one byte at a time
TOR	Rewrites an .onion host to a tor2web gateway
KILLER	Spawns nested GET workers every loop

Bypass methods depend on the provider's current challenge. They are best-effort and can stop working when the provider changes its page or cookie flow.

KILLER warning

KILLER starts a new thread on every loop with a 10 ms delay. A long run can create thousands of threads and sockets. Use a short duration and watch the local process count.

TOR

TOR takes an .onion host, picks a tor2web gateway, and sends the normal request to the gateway. It does not start or manage a Tor client.

Proxies

All Layer 7 methods accept proxies.

python3 start.py GET https://example.com 5 100 socks5.txt 10 60

Proxy types:

Value	Type
0	All providers in config.json
1	HTTP
4	SOCKS4
5	SOCKS5
6	Random

If the proxy file does not exist, MHDDoS downloads the configured providers, checks them, and writes the working proxies to the file. See Proxies.

Tuning

Setting	Effect
threads	Parallel workers. Start low and raise it gradually
rpc	Requests per connection. Higher values reuse sockets more
duration	Seconds to run
debug	Per-second PPS/BPS and worker errors

Very high thread counts can exhaust file descriptors, ephemeral ports, or memory. The tool does not clamp them; start_workers only reacts when the OS refuses to create a thread.

Worker behaviour

Each HTTP worker waits for the shared start event, then sends requests until the duration ends. Proxy, DNS, TLS, and socket errors are logged and retried with a short backoff. A failed request does not kill the process.

When a run finishes, the main thread clears the event, waits for the duration loop to end, and exits with status 0.