Methods

Methods

MHDDoS has 46 attack methods — 21 on Layer 4 and 25 on Layer 7. The full command-line total is 60 when the 9 tools and 5 commands are included.

Use this page as an index. The layer pages explain the behaviour and requirements.

Layer 7

Method	Focus
GET	Basic GET flood
POST	POST with a JSON body
HEAD	HTTP HEAD requests
NULL	Null user agent and related headers
PPS	Minimal GET / HTTP/1.1 request
EVEN	GET with extra headers
COOKIE	Random cookie headers
APACHE	Large Range header
XMLRPC	WordPress XML-RPC pingback
STRESS	Large JSON POST
BOT	Search-engine bot user agents
CFB	Cloudflare challenge handling
CFBUAM	Cloudflare Under Attack Mode attempt
BYPASS	Generic anti-DDoS bypass
DGB	DDoS-Guard challenge handling
GSB	Google Project Shield bypass
AVB	ArvanCloud bypass
OVH	OVH-specific request pattern
DYN	Random subdomain in the Host header
RHEX	Random hex path
STOMP	Cloudflare captcha path attempt
SLOW	Slowloris-style keep-alive
DOWNLOADER	Slow response reading
TOR	Route through a tor2web gateway
KILLER	Spawn nested GET workers

See Layer 7 Methods.

Layer 4

Method	Focus	Raw socket
TCP	TCP connect flood	no
UDP	UDP datagrams	no
SYN	Raw TCP SYN packets	yes
ICMP	Raw ICMP echo	yes
OVH-UDP	Raw UDP with generated headers	yes
CPS	Connections per second	no
CONNECTION	Keep connections open	no
MINECRAFT	Minecraft status ping	no
MCBOT	Minecraft login/chat bot	no
MCPE	Minecraft Bedrock ping	no
FIVEM	FiveM getinfo	no
FIVEM-TOKEN	FiveM token payload	no
TS3	TeamSpeak 3 status ping	no
VSE	Valve Source Engine query	no
MEM	Memcached amplification	yes
NTP	NTP amplification	yes
DNS	DNS amplification	yes
ARD	Apple Remote Desktop amplification	yes
CLDAP	CLDAP amplification	yes
CHAR	Chargen amplification	yes
RDP	RDP amplification	yes

See Layer 4 Methods.

Quick examples

python3 start.py GET https://example.com 0 100 http.txt 10 60
python3 start.py POST https://example.com 0 50 http.txt 5 30
python3 start.py UDP 192.0.2.10:80 100 60
python3 start.py MINECRAFT 192.0.2.10:25565 100 60 5 socks5.txt
python3 start.py DNS 192.0.2.10:80 100 60 dns.txt

Notes

• Layer 7 methods work with proxies. Layer 4 methods only accept proxies for MINECRAFT, MCBOT, TCP, CPS, and CONNECTION.
• Amplification methods need a reflector file and a spoofable source address. See Amplification.
• Bypass methods depend on the target's current defences. They are not guaranteed to work and may break when a provider changes its challenge.
• KILLER creates extra threads on every loop and can exhaust the local machine. Use a short duration.