Web Panel

Web Panel

Warning

The panel can start processes. Keep it on 127.0.0.1 unless you have added a reverse proxy, TLS, and real authentication.

The repository includes two panels:

• Node panel — the default, started by python3 start.py WEB or web/scripts/start.*.
• Flask panel — an optional Python panel in web/app.py.

Both expose the same basic flow: choose a method, enter an authorized target, set threads and duration, start the task, watch the log.

flowchart LR
    U[Browser] --> P[Panel]
    P --> V[Validate target]
    V --> S[start.py]
    S --> L[Stream logs]

Loading

On this page

• Install
• Start
• Configuration
• What the panel can do
• Node panel layout
• Flask panel
• Security notes
• Troubleshooting

Install

# Linux / macOS
bash web/scripts/install.sh

# Windows
web\scripts\install.bat

The installer creates .venv in the repository root, installs the Python requirements plus web/requirements.txt, and runs npm install inside web/.

Start

python3 start.py WEB

The panel listens on http://127.0.0.1:5000 by default.

You can also run the launcher directly:

# Linux / macOS
bash web/scripts/start.sh

# Windows
web\scripts\start.bat

Configuration

Both panels read normal environment variables. web/.env.example is a reference; it is not loaded automatically.

Linux / macOS:

export WEB_HOST=127.0.0.1
export WEB_PORT=5000
export JWT_SECRET="$(python3 -c 'import secrets; print(secrets.token_hex(64))')"
python3 start.py WEB

Windows PowerShell:

$env:WEB_HOST = "127.0.0.1"
$env:WEB_PORT = "5000"
$env:JWT_SECRET = "replace-with-64-bytes-or-more"
python start.py WEB

Variable	Default	Meaning
WEB_HOST	127.0.0.1	Bind address
WEB_PORT	5000	Bind port
JWT_SECRET	random per start	Token signing key

Set JWT_SECRET to a fixed 64+ byte value if tokens should survive a restart. Generate one with:

node -e "console.log(require('crypto').randomBytes(64).toString('hex'))"

Do not bind the panel to 0.0.0.0 without a reverse proxy, TLS, and a real authentication layer.

What the panel can do

• list Layer 4, Layer 7, and amplification methods;
• validate a public target;
• start and stop attack processes;
• stream logs over Server-Sent Events;
• show CPU, RAM, and network counters;
• list proxy files and wordlist counts;
• run DNS, WHOIS-style, ping, and HTTP checks.

The panel does not run the tools console. Use python3 start.py TOOLS for that.

Node panel layout

web/
├── src/server.ts        Express server
├── public/              static UI
├── package.json
├── tsconfig.json
└── scripts/
    ├── install.sh
    ├── install.bat
    ├── start.sh
    └── start.bat

Build and serve:

cd web
npm ci
npm run build
npm run serve

npm start runs the TypeScript server through tsx; npm run serve runs the compiled output.

Flask panel

python3 web/app.py --host 127.0.0.1 --port 5000

It needs Flask from web/requirements.txt. The Flask panel starts start.py with a fixed @web-attack command and sends the task over stdin. The Node panel builds normal CLI arguments and spawns the same script.

Security notes

• Both panels authenticate API calls with JWT tokens. The default secret is random per start; set JWT_SECRET if you need stable sessions.
• Targets are validated before they reach the child process. Private and loopback URLs are rejected for Layer 7.
• The Flask panel starts start.py with a fixed command and sends the task over stdin; request data is not placed in argv.
• Keep the panel on localhost unless you add a reverse proxy and TLS.

Troubleshooting

Problem	Fix
Web panel dependencies are missing	Run the installer, then start again
node_modules exists but start fails	Run npm ci in web/
Panel starts but API returns 401	Set a stable JWT_SECRET and reload
Port 5000 is busy	Set WEB_PORT or pass --port
python not found on Linux	Activate .venv or install the venv build tools