🐢 Turtle is a toolkit for simulating and validating application layer denial-of-service attacks in both live and unit testing environments.

Important: The use of this program for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to comply with all applicable local, state, and federal laws. The developers assume no liability and are not responsible for any misuse or damage caused by this program.

Exposing an application to the public internet is fraught with risks due to various types of denial-of-service attacks, such as:

• slowloris
• low and slow attack
• R.U.D.Y
• ... and many more

While some applications may have well-configured settings that render them invulnerable to these attacks, others, such as those built with popular languages like Golang, might be vulnerable by default. Turtle provides an easy way to validate your application against these common threats to identify risks.

Furthermore, an application that is secure today may become vulnerable due to future changes. Therefore, integrating these attack simulations into your regular validation process is crucial.

Turtle provides:

• A Command-Line Interface (CLI) for validating real endpoints
• A Golang library for easy integration into unit/integration tests

Turtle current supports the following scenarios:

• slowloris
• slow body read

You can install the CLI tool via:

go install github.com/b4fun/turtle/cmd/turtle@latest

Or download a release binary from the GitHub Release page.

The turtle CLI embeds supported scenarios as sub-commands. A common way to invoke a scenario test:

$ turtle <scenario-name> <target-url>

Further details can be obtained by viewing the command's help message:

$ turtle -h
# Scenario specified help
$ turtle slowloris -h

To learn more, please checkout one of the following guides:

• Is my server Slowloris-proofed?

For the Golang library, documentation can be found on GoDoc.

Turtle is distributed under the MIT license