Get a Pentest and security assessment of your IT network.

Cyber Security

HTTP Flood Test Tool

TL;DR

We’ll use hey, a simple command-line tool to simulate an HTTP flood on your website. It’s easy to install and use, even if you don’t have much technical experience.

Steps

  1. Install hey
  2. hey is available for Linux, macOS, and Windows. Here’s how to install it:

    • Linux (Debian/Ubuntu):
    • sudo apt update && sudo apt install hey
    • macOS (Homebrew):
    • brew install hey
    • Windows (Chocolatey):
    • choco install hey
    • Download Binaries: If you can’t use a package manager, download the appropriate binary from the GitHub releases page and add it to your system’s PATH.
  3. Basic Usage – Single Request
  4. To send a single GET request to your website, use:

    hey 

    Replace with the actual URL of your site (e.g., https://www.example.com).

  5. Simulating an HTTP Flood
  6. To simulate a flood, you need to send multiple requests concurrently. The -n flag specifies the total number of requests and -c sets the concurrency (number of parallel requests). Start with a small number of concurrent requests.

    hey -n 100 -c 10 

    This sends 100 requests with 10 concurrent connections. Monitor your website’s performance while running this command.

  7. Increasing the Load (Carefully!)
  8. Gradually increase the concurrency (-c) to see how your server handles more load. Be cautious, as excessive traffic can overload your server and potentially cause downtime. Start with small increments (e.g., 20, 50, 100).

    hey -n 1000 -c 50 
  9. Customising Requests
    • POST requests: Use the -m flag to specify a POST request body.
    • hey -n 10 -c 2 -m 'data=some_post_data' 
    • Headers: Add custom headers with the -H flag. You can specify multiple headers.
      hey -n 10 -c 2 -H "Content-Type: application/json" -H "X-Custom-Header: value" 
  10. Interpreting the Results
  11. hey provides useful statistics, including:

    • Requests per second (RPS): Shows how many requests your server can handle.
    • Average response time: Indicates how long it takes for your server to respond.
    • Error rate: Highlights any errors encountered during the test.
  12. Important Considerations
    • Test on a staging environment first: Never run load tests directly on your production website without testing it thoroughly in a staging or development environment.
    • Respect rate limits: Be mindful of any rate limiting policies implemented by your hosting provider or CDN.
    • Monitor server resources: Keep an eye on CPU usage, memory consumption, and network bandwidth during the test to identify potential bottlenecks.
Related posts
Cyber Security

Zip Codes & PII: Are They Personal Data?

Cyber Security

Zero-Day Vulnerabilities: User Defence Guide

Cyber Security

Zero Knowledge Voting with Trusted Server

Cyber Security

ZeroNet: 51% Attack Risks & Mitigation