DDOS your own website?
Hey folks,
I'm going to create an L7 layer web stressing service. The requirements will be very basic;
1- You need to validate that you are the owner of the targeted website. This will be very easy, DNS validation probably.
2- You will start the stress test which means that the service will send your website incremental requests from different machines until your website down (or not until down, you will able to select the maximum request count).
3- After the test, you will receive a report which includes your server's response time across the request count.
Actually, I'm doing this for my own needs and wondering anybody else also needs this kind of service or not?
I would use such a service to find out what the visitor limits of my server are. Might be useful before launching on HN e.g..
That fantastic. What would you want to see in the result report, your server's response time graph over visitor count, etc? Also, what price do you think you can monthly give a service like this?
Would be great if such a service had some insights on typical websites related to indie hackers that could cause a spike.
It could then send requests to the server, measure its response time and give me a number when the response time decreases or when it starts to not respond at all any more.
I think it is important to send requests from multiple countries.
I would not pay for such a service, because I would not use it regularly. If you would offer a lifetime deal with a couple of tests per year I would be interested.
Otherwise buying credits to run a couple of tests prior to a launch could be good as well. There might be people who use it often enough to pay monthly, but I think typically you would only use it a couple of times per year.
I've noted your requirements. Thank you for sharing with me.
Sounds interesting. What I envision in your service is that you will ask your client if they know about the architecture of their website and tailor your service to their needs.
If their web server is apache 2.x, Flask, dhttp and few other architectures, no need to attempt an entire DDoS. Just do a slowloris. Read more in this web archive: https://web.archive.org/web/20090822001255/http://ha.ckers.org/slowloris/
Slowloris look cool, I've found the repository. I'm not planning to fully use it but reading the article and source code gave me some inspiration. Thanks for that!
There are other services that do this so the idea is viable.
One problem you may encounter is that due to a surge in DDoS attacks in recent years, a lot of hosting companies have developed and implemented improved DDoS detection and defense systems.
That means even if a client requests it, the hosting company may treat your service as hostile and not only defend against it but also report it to relevant authorities or they may file a complaint with your own hosting solution if they can identify them.
Good point. I was thinking of using rotating proxy servers instead of dedicated machines.
By the way, do you know similar services like this? Can you share with me?
I think it's relatively rare, most people that care outsource the issue to CDNs or specific DDoS prevention services and small sites won't pay for testing something they won't fix..
Like I think it's super niche, but you can make a business module out of serving only a few if you really put yourself on to it
Thanks for sharing your ideas.
In my case, I want to know the concurrent user limits of my server. With the help of this test, I'll measure my performance updates. Of course, nobody can exactly protect their system from aggressive DDOS attacks but testing may give them insights about their future actions. WDYT about this?
apachebench is a simple concurrency test that one can run, while it's not a wrapped service, it gives a lot of control...
I do admit that load stressing doesn't have nice easy simple cheap services, but some of it might be related to common case complexities....
One constraint for such services is that often one wants to do these tests in a closed off server and not a main public one and this might often be a blocker.
There are some ent. level services in that area, but it's not my expertise, these are usually marketed to either security or testing dept.
Also if you run a complex service you'd really just care about someone putting a load, and on the other side you'd look at APM or similar deep performance tracking of all system components. These would be the places to find where your concurrency constraint is...
I used to work in digital publishing (quite a while ago) And during the last stages of releasing each new major version of our tech platform we'd stress test it. Not so much with DDoS in mind, but because we'd occasionally have to deal with spikes in traffic.
We'd get a day from a freelancer who specialises in this, has their own tooling, could tweak their scripts to make some custom actions (login, comment etc.) on our platform.
As other commenters said, a company/site is gonna have to be of a certain size before they really care to take this seriously, and then they have some money to spend.
If you could offer as much coverage as a 300-500 USD per day contractor can with your off the shelf product, I'm sure you could persuade a few people to try the cost saving. But really I think the few human tweaks made by a contractor who had a 20 minute chat with you about the goals of the testing could be hard to replicate.
I'm not sure what you prefer to do with your time. But I'm wondering if you could offer some sort of DDoS testing 'lite' to get some eyeballs and SEO, and then sell bespoke services to those who are really serious. With your own toolkit that you regularly use, selling a days work at full price, when really you're having a short kick off call, getting server info from them (you can make a standardised form for clients) and running the scripts in a hour or so.
Just a few thoughts, maybe not what you're looking for :)
Your requirements need some customization, it is very hard to implement such a generic service that meets all of these requests. I'll start with only load testing, nothing more than that. But after that, we'll probably accept custom requests from our clients to solve their specific problems. Because I've received similar needs from other folks too.
Thank you for sharing your thoughts!