ufonet/docs/FAQ.html

<center>
<table cellpadding="24" cellspacing="25" border="1">
<tr><td><pre><table><tr><td><center><pre><h1><u>UFONet F.A.Q. v2.0 [Revision: 05/2026]</u></h1>Full Version online: <a href="https://ufonet.03c8.net/FAQ.html">https://ufonet.03c8.net/FAQ.html</a><a href="/"></center></td></tr><tr><td><pre><ul><hr>
<li><b>What is UFONet?</b></li>
It is a toolkit designed to launch <a href="https://en.wikipedia.org/wiki/Distributed_denial-of-service" target="_blank">DDoS</a> and <a href="https://en.wikipedia.org/wiki/Denial-of-service_attack" target="_blank">DoS</a> attacks.

<hr>
<li><b>What is a DDoS attack?</b></li>
A Distributed Denial of Service (<a href="https://en.wikipedia.org/wiki/Distributed_denial-of-service" target="_blank">DDoS</a>) <u>attack</u> is an attempt to make an online service 
unavailable by overwhelming it (for example, with traffic...) <u>from multiple sources</u>.

<hr> 
<li><b>What is a DoS attack?</b></li>
A Denial of Service (<a href="https://en.wikipedia.org/wiki/Denial-of-service_attack" target="_blank">DoS</a>) <u>attack</u> is an attempt to make an online service 
unavailable by overwhelming it (for example, with traffic...) <u>from a single source</u>.

<hr>
<li><b>What is a Botnet?</b></li>
A <a href="https://en.wikipedia.org/wiki/Botnet" target="_blank">Botnet</a> is a collection of computers often referred to as "zombies" that allows an attacker
to control them. It is commonly used to make DDoS attacks.

<hr>
<li><b>What is the philosophy behind UFONet?</b></li>
<i>"On a samurai sword or even any tool, what matters is who goes to use it and for what, 
not who builds it and when..."</i>

<hr>
<li><b>Why can UFONet be more special, than for example, other botnets previously built?</b></li>
Because UFONet tries not living traces (IPs, etc...) from the origin of the attack. And
of course, because <b><u>it is free/libre</u></b>. ;-)

<hr>
<li><b>How does UFONet work technically?</b></li>
<a href="http://ufonet.03c8.net" target="_blank">UFONet</a> is a tool designed to launch <a href="https://en.wikipedia.org/wiki/OSI_model#Layer_7:_Application_Layer" target="_blank">Layer 7</a> (APP/HTTP) DDoS attacks, using '<a href="http://cwe.mitre.org/data/definitions/601.html" target="_blank">Open Redirect</a>'
vectors, generally located on third-party web applications (a botnet) and other
powerful DoS attacks, some including different <a href="https://en.wikipedia.org/wiki/OSI_model" target="_blank">OSI model</a> layers, as for example
the <i>TCP/SYN flood attack</i>, which is performed on <a href="https://en.wikipedia.org/wiki/OSI_model#Layer_3:_Network_Layer" target="_blank">Layer 3</a> (Network).

This <a href="https://ufonet.03c8.net/ufonet/ufonet-schema.png" target="_blank">schema</a> shows you how the architecture of the requests are made when performing
a simple HTTP/WebAbuse DDoS attack.

<hr>
<li><b>Is UFONet a "strong" botnet?</b></li>
Well!. It depends on how you understand a botnet as "strong". If you understand it as;

 *  '<u>privacy</u>'; UFONet is the best -ninja- DDoS/DoS tool...
 *  '<u>traffic volume</u>'; it depends on; 'zombies', bandwidth, target's conf, etc...

With UFONet it's not about having a lot of 'zombies', it's more about those you have
work properly. If they are nice, you can 'defeat' a 'small' webserver just with
a 'couple of dozens'.

Or for example, in a scenario in which a target is using a VPS service with some limited
bandwidth rate (ex: 1GB/month) for the attacker is just a matter of time to run the tool
and wait until traffic (noise) reaches the maximum limit that closes the service.

Commonly people understand a botnet as an individual tool but UFONet is also a <a href="https://en.wikipedia.org/wiki/Peer-to-peer" target="_blank">P2P</a>/<a href="https://en.wikipedia.org/wiki/Darknet" target="_blank">darknet</a>,
that can be used to connect others machines and to run complex schemas involving other people 
working cooperatively: sharing 'zombies', reporting statistics (with rankings, clans)...

Therefore, UFONet can also be defined fundamentally, as: <b>a botnet of botnets</b>, which is 
obviously a harder and effective way to overwhelm an objective, than when a single person 
tries it individually.

<hr>
<li><b>What's the difference between: 'zombies', 'aliens', 'droids', 'ucavs'...?</b></li>
 * <u>Zombie</u>: HTTP GET 'Open Redirect' bot

 ex: https://ZOMBIE.com/check?uri=$TARGET

 * <u>Droid</u>: HTTP GET 'Open Redirect' bot with params

 ex: https://ZOMBIE.COM/css-validator/validator?uri=$TARGET&profile=css3

 * <u>Alien</u>: HTTP POST 'Open Redirect' bot

 ex: https://ZOMBIE.com/analyze.html;$POST;url=$TARGET

 * <u>Drone</u>: HTTP 'Web Abuse' bot

 ex: https://www.isup.me/$TARGET

 * <u>X-RPC</u>: XML-RPC Vulnerability

 ex: https://ZOMBIE.COM/xmlrpc.php

<hr> 
<li><b>Is it possible to stress target's database using UFONet?</b></li>
Yes, it is. For example, you can order to your 'zombies' to submit random valid requests 
on a target's search input form. This floods database with queries.

<hr>
<li><b>Can I directly attack an IP address?</b></li>
Yes, you can.

<hr>
<li><b>What kind of extra attacks does the tool have?</b></li><pre>
[DDoS] amplification / reflection:
 - FRAGGLE:    <a href="https://en.wikipedia.org/wiki/Fraggle_attack" target="_blank">https://en.wikipedia.org/wiki/Fraggle_attack</a>
 - TACHYON:    <a href="https://en.wikipedia.org/wiki/DNS_amplification_attack" target="_blank">https://en.wikipedia.org/wiki/DNS_amplification_attack</a>
 - MONLIST:    <a href="https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse" target="_blank">https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse</a>
 - SMURF:      <a href="https://en.wikipedia.org/wiki/Smurf_attack" target="_blank">https://en.wikipedia.org/wiki/Smurf_attack</a>
 - SNIPER:     <a href="https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol" target="_blank">https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol</a>
 - MEMCACHED:  <a href="https://en.wikipedia.org/wiki/Memcached" target="_blank">https://en.wikipedia.org/wiki/Memcached</a>
 - CHARGEN:    <a href="https://en.wikipedia.org/wiki/Character_Generator_Protocol" target="_blank">https://en.wikipedia.org/wiki/Character_Generator_Protocol</a>
 - CLDAP:      <a href="https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol" target="_blank">https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol</a>
 - SSDP:       <a href="https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol" target="_blank">https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol</a>
 - QOTD:       <a href="https://en.wikipedia.org/wiki/QOTD" target="_blank">https://en.wikipedia.org/wiki/QOTD</a>
 - TFTP:       <a href="https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol" target="_blank">https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol</a>
 - WSDISCO:    <a href="https://en.wikipedia.org/wiki/WS-Discovery" target="_blank">https://en.wikipedia.org/wiki/WS-Discovery</a>
 - COAP:       <a href="https://en.wikipedia.org/wiki/Constrained_Application_Protocol" target="_blank">https://en.wikipedia.org/wiki/Constrained_Application_Protocol</a>
 - MSSQL:      <a href="https://en.wikipedia.org/wiki/Microsoft_SQL_Server" target="_blank">https://en.wikipedia.org/wiki/Microsoft_SQL_Server</a>
 - ARMS:       <a href="https://en.wikipedia.org/wiki/Apple_Remote_Desktop" target="_blank">https://en.wikipedia.org/wiki/Apple_Remote_Desktop</a>
 - PLEX:       <a href="https://en.wikipedia.org/wiki/Plex_(software)" target="_blank">https://en.wikipedia.org/wiki/Plex_(software)</a>
 - NETBIOS:    <a href="https://en.wikipedia.org/wiki/NetBIOS" target="_blank">https://en.wikipedia.org/wiki/NetBIOS</a>
 - RIPV1:      <a href="https://en.wikipedia.org/wiki/Routing_Information_Protocol" target="_blank">https://en.wikipedia.org/wiki/Routing_Information_Protocol</a>
 - SPRAY:      <a href="https://en.wikipedia.org/wiki/Denial-of-service_attack#Reflected_attack" target="_blank">https://en.wikipedia.org/wiki/Denial-of-service_attack#Reflected_attack</a>
 - MIDDLEBOX:  <a href="https://en.wikipedia.org/wiki/Network_middlebox" target="_blank">https://en.wikipedia.org/wiki/Network_middlebox</a>
 - DBSTRESS:   <a href="https://en.wikipedia.org/wiki/SQL_injection" target="_blank">https://en.wikipedia.org/wiki/SQL_injection</a>

[ DoS] direct floods:
 - LOIC:       <a href="https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon" target="_blank">https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon</a>
 - LORIS:      <a href="https://en.wikipedia.org/wiki/Slowloris_(software)" target="_blank">https://en.wikipedia.org/wiki/Slowloris_(software)</a>
 - SLOWREAD:   <a href="https://en.wikipedia.org/wiki/Slowloris_(software)" target="_blank">https://en.wikipedia.org/wiki/Slowloris_(software)</a>
 - GOLDENEYE:  <a href="https://en.wikipedia.org/wiki/Denial-of-service_attack#Application-layer_attacks" target="_blank">https://en.wikipedia.org/wiki/Denial-of-service_attack#Application-layer_attacks</a>
 - RAPIDRESET: <a href="https://en.wikipedia.org/wiki/HTTP/2" target="_blank">https://en.wikipedia.org/wiki/HTTP/2</a>
 - UFOSYN:     <a href="https://en.wikipedia.org/wiki/SYN_flood" target="_blank">https://en.wikipedia.org/wiki/SYN_flood</a>
 - XMAS:       <a href="https://en.wikipedia.org/wiki/Christmas_tree_packet" target="_blank">https://en.wikipedia.org/wiki/Christmas_tree_packet</a>
 - NUKE:       <a href="https://en.wikipedia.org/wiki/Sockstress" target="_blank">https://en.wikipedia.org/wiki/Sockstress</a>
 - UFOACK:     <a href="https://en.wikipedia.org/wiki/Denial-of-service_attack" target="_blank">https://en.wikipedia.org/wiki/Denial-of-service_attack</a>
 - UFORST:     <a href="https://en.wikipedia.org/wiki/TCP_reset_attack" target="_blank">https://en.wikipedia.org/wiki/TCP_reset_attack</a>
 - FINFLOOD:   <a href="https://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_termination" target="_blank">https://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_termination</a>
 - DROPER:     <a href="https://en.wikipedia.org/wiki/IP_fragmentation_attack" target="_blank">https://en.wikipedia.org/wiki/IP_fragmentation_attack</a>
 - OVERLAP:    <a href="https://en.wikipedia.org/wiki/IP_fragmentation_attack#Overlapping_fragment_attack" target="_blank">https://en.wikipedia.org/wiki/IP_fragmentation_attack#Overlapping_fragment_attack</a>
 - PINGER:     <a href="https://en.wikipedia.org/wiki/Ping_flood" target="_blank">https://en.wikipedia.org/wiki/Ping_flood</a>
 - UFOUDP:     <a href="https://en.wikipedia.org/wiki/UDP_flood_attack" target="_blank">https://en.wikipedia.org/wiki/UDP_flood_attack</a></pre>

<hr>
<li><b>Can I launch Extra Attacks without zombies?</b></li>
Yes. Any Extra Attack can be launched standalone against a target via <code>-m TARGET</code>,
and multiple mods can be concatenated in a single command:
<pre>  sudo ./ufonet -m http://target.com --ssdp 50 --chargen 50 --loic 50</pre>
If a mod has no resources (placeholder reflectors), UFONet informs you, skips it, and
continues with the next mod in the chain.

<hr>
<li><b>What is a 'wormhole'?</b></li>
It is an <a href="https://en.wikipedia.org/wiki/Internet_Relay_Chat" target="_blank">IRC</a> gateway to <a href="https://en.wikipedia.org/wiki/Freenode" target="_blank">Freenode</a> where UFONet 'masters' can meet.

<hr>
<li><b>What is a 'blackhole'?</b></li>
It is a <a href="https://en.wikipedia.org/wiki/Peer-to-peer" target="_blank">P2P</a> daemon to share 'zombies' with other UFONet 'masters'.

<hr>
<li><b>Where can I report a bug?</b></li>
You can report errors on: <a href="https://github.com/epsylon/ufonet/issues" target="_blank">Github issues</a>.

Also you can stay in touch reporting on my "mothership" (using BOARD provided by default).
  
If nobody gets back to you, then drop me an <a href="mailto: epsylon@riseup.net">e-mail</a>.</ul></pre></td></tr></table></pre></td></tr></table></center>