⚠️ Legal Disclaimer: This framework is developed strictly for Educational Research and Authorized Stress Testing. Unauthorized use against third-party infrastructure is illegal. The author assumes no liability for misuse.
This repository is a sophisticated technical suite designed to simulate high-concurrency traffic patterns and adversarial machine learning vectors. It explores the intersection of Layer 4 Transport exhaustion, Layer 7 Application bypass, and Stochastic Gradient Descent (A-SGD) poisoning.
A DDoS attack aims to render a service unavailable by overwhelming the target with a flood of orchestrated traffic.
The Mechanism: Exploits the TCP Three-Way Handshake.
- The attacker sends a
SYNpacket. - The server responds with
SYN-ACKand reserves resources (TCB). - The attacker never sends the final
ACK. Result: The server’s connection table stays "Half-Open" until it exhausts all RAM/CPU, refusing legitimate users.
The Mechanism: Mimics real human behavior by sending GET or POST requests.
- Uses Asynchronous I/O (
asyncio) to manage 10,000+ concurrent connections from a single node. - Implements Header Rotation (User-Agent, Referer) to bypass Web Application Firewalls (WAF). Result: Overwhelms the backend processing logic and database query pools.
The Mechanism: A trial-and-error method used to decode encrypted data or hidden directories.
- Dictionary Attack: Systematically testing millions of common passwords from a wordlist.
- Credential Stuffing: Using leaked data to attempt unauthorized access.
- Mechanism: The script iterates through a
wordlist.txtat high speed, analyzing HTTP response codes (e.g.,200 OKvs401 Unauthorized) to identify successful breaches.
As an LLM Engineer, this module explores the frontier of Adversarial Machine Learning. The Mechanism: In distributed AI training, nodes share "Gradients" to update a global model.
- The Attack: This script injects malicious mathematical noise (poisoned gradients) into the update stream.
- Result: The AI model becomes "poisoned," leading to intentional misclassification or the creation of a model "backdoor."
Malware rarely arrives as a raw .py file. Instead, it is "compiled" or "packed." The Dropper: Usually a small Batch or PowerShell script. Its only job is to download the main payload and a "portable" Python interpreter (since most victims don't have Python installed). Obfuscation: The code is often "Base64 encoded" or "AES encrypted" within the dropper to hide from basic Anti-Virus (AV) string scanning.
A RAT is useless if it disappears when the user restarts their computer. AsyncRAT uses several Windows-specific tricks: Registry Injection: It adds a path to itself in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Scheduled Tasks: It creates a task that triggers every time the user logs in or every 10 minutes if the process is killed. Process Ghosting: It might try to inject its code into a legitimate process like svchost.exe or explorer.exe so that when you look at Task Manager, everything looks normal.
Using the pynput library you mentioned, the RAT sets up a Hook. The Hook: It listens to the Operating System's keyboard buffer. Every time a key is pressed, the OS sends a message; the RAT intercepts this message, records the character, and stores it in a hidden local log file or a memory variable. Stealth: Professional RATs wait for the user to open specific windows (like "PayPal" or "Gmail") before they start logging, to save space and remain undetected.
This is the "Async" part of AsyncRAT. Traditional "Bind Shells" are easy to find because they leave a port open. AsyncRAT uses a Reverse Connection.
The Beacon: The infected machine (Client) initiates the connection to the attacker (Server).
The "Heartbeat": Instead of staying connected 24/7, it sends a small encrypted packet every 60 seconds. This "asynchronous" behavior mimics normal web browsing, making it very hard for firewalls to distinguish from a person checking their email.
The Payload: If the attacker has a command waiting (e.g., "Take Screenshot"), the server sends it back in the response to the beacon.
The malware operates by embedding itself via phishing emails, malicious attachments, or drive-by downloads, then establishing encrypted communication with a Command-and-Control (C2) server. It employs advanced stealth techniques such as obfuscation, fileless execution, and anti-sandbox detection to evade security measures, with recent campaigns utilizing Python scripts, TryCloudflare tunnels, and HTML smuggling to bypass antivirus detection.
Key characteristics and capabilities include:
Functions: Keylogging, remote desktop control, screen recording, audio/video capture, and file exfiltration. Persistence: Achieved through registry key modifications, scheduled tasks, and process injection into legitimate applications (e.g., notepad.exe, RegSvcs.exe). Distribution: Often delivered via spear phishing with ISO files, HTML Application (HTA) files, or disguised batch scripts that download stages from services like AWS S3 or Dropbox. Targets: Frequently affects healthcare, finance, hospitality, and government sectors, with a notable surge in activity targeting US infrastructure and Chinese cybercriminal groups. Detection: Identified by MITRE ATT&CK Technique T1105 (Ingress Tool Transfer) and requires Endpoint Detection and Response (EDR) tools or manual removal of malicious processes and registry keys.
A botnet attack is a coordinated cyberattack launched from a network of hijacked internet-connected devices (computers, smartphones, IoT) infected with malware. Controlled remotely by a "bot herder," these devices, or "bots," act in unison to perform large-scale actions such as DDoS attacks, phishing, spam campaigns, data theft, and credential stuffing.
Kaspersky
Kaspersky
+3
How a Botnet Attack Works
Infection: Attackers (botmasters) infect vulnerable devices using malware via phishing emails, exploited vulnerabilities, or brute-forcing weak passwords, particularly on IoT devices.
Command & Control (C&C): The infected devices connect back to a server controlled by the attacker, awaiting commands.
Attack Execution: The botmaster triggers the bots to simultaneously attack a target, hiding the origin of the attack because the traffic comes from legitimate, distributed IP addresses.
| Module | Protocol | Core Logic |
|---|---|---|
| L4 Engine | TCP/UDP | Raw Sockets & Scapy Packet Crafting |
| L7 Engine | HTTP/HTTPS | Aiohttp Non-blocking Concurrency |
| Brute Engine | Auth/API | Multi-threaded Wordlist Iteration |
| AI Engine | A-SGD | Gradient Noise Injection & Model Poisoning |
| Asynchronous malware | AsyncRAT malware | concurrent malware attacks |
├── modules/
│ ├── l4_transport/ # SYN/UDP/ICMP flood scripts
│ ├── l7_app/ # HTTPS & HTTP Get/Post bypass scripts
| |__C DDos files # TCP Get/Post bypass scripts
│ └── ml_adversary/ # A-SGD Poisoning & Gradient tools
├── utils/ # Proxy rotators & Wordlist handlers
├── .gitignore # Environment & VENV protection
└── README.md # Technical Documentation