Finshir - A Coroutines-Driven Low And Slow Traffic Sender, Written In Rust

Advantages

• Coroutines-driven. Finshir uses coroutines (also called lightweight threads) instead of ordinary threads, which lets you open many more connections with fewer system resources.
  
• Generic. Unlike other Low & Slow utilities, Finshir lets you transmit arbitrary data sets over the TCP protocol. It may be partial HTTP headers, empty spaces, and so on.
  
• Written in Rust. How you can see, all the logic is written completely in Rust, which means that it leverages bare-metal performance and high-level safety (no SIGSEGV, SIGILL, and other "funny" stuff).
  

Disadvantages

• Platform-dependent. Like most of pentesting utilities, this project is developed for only UNIX-based systems. If you are a Windows user, you probably need a virtual machine or another computer with UNIX.

Installation

Building from crates.io

Building from sources

Pre-compiled binaries

Usage

Flags

Name	Explanation
-h, --help	Prints help information
--use-tls	Use a TLS connection instead of the ordinary TCP protocol. It might be used to test HTTPS-based services.
-V, --version	Prints version information

Options

Name	Value	Default	Explanation
--connect-periodicity	Time span	7secs	This option will be applied if a socket connection error occurs (the next connection will be performed after this periodicity)
--connect-timeout	Time span	10secs	Try connect a socket within a specified timeout. If a timeout is reached and a socket wasn't connected, the program will retry the operation later
--connections	Positive integer	1000	A number of connections the program will handle simultaneously. This option also equals to a number of coroutines
--date-time-format	String	%X	A format for displaying local date and time in log messages. Type man strftime to see the format specification
--failed-count	Positive integer	5	A number of failed data transmissions used to reconnect a socket to a remote web server
--ip-ttl	Unsigned integer	None	Specifies the IP_TTL value for all future sockets. Usually this value equals a number of routers that a packet can go through
--json-report	Filename	None	A file to which a JSON report (also called a "total summary") will be generated before exiting
-f, --portions-file	Filename	None	A file which consists of a custom JSON array of data portions, specified as strings. When a coroutine finished sending all portions, it reconnects its socket and starts sending them again.
-r, --receiver	Socket address	None	A receiver of generator traffic, specified as an IP address (or a domain name) and a port number, separated by a colon
-d, --test-duration	Time span	64years 64hours 64secs	A whole test duration, after which all spawned coroutines will stop their work
--text-report	Filename	None	A file to which the program will generate a human-readable report (also called a "total summary") before exiting
-v, --verbosity	From 0 to 5	3	Enable one of the possible verbosity levels. The zero level doesn't print anything, and the last level prints everything. Note that specifying the 4 and 5 verbosity levels might decrease performance, do it only for debugging.
-w, --wait	Time span	5secs	A waiting time span before test execution used to prevent a launch of an erroneous (unwanted) test
--write-periodicity	Time span	30secs	A time interval between writing data portions. This option can be used to modify test intensity
--write-timeout	Time span	10secs	If a timeout is reached and a data portion wasn't sent, the program will retry the operation later
--xml-report	Filename	None	A file to which an XML report (also called a "total summary") will be generated before exiting

Overview

Minimal command
The following command spawns 1000 coroutines, each trying to establish a new TCP connection. When connections are established, it sends empty spaces every 30 seconds, thereby order a server to wait as long as it can:

Test intensity
Low & Slow techniques assume to be VERY SLOW, which means that you typically send a couple of bytes every N seconds. For instance, Finshir uses the 30 seconds interval by default, but it's modifiable as well:

Connections count
The default number of parallel connections is 1000. However, you can modify this limit using the --connections option, but be sure that you system is able to handle such amount of file descriptors:

Logging options
Consider specifying a custom verbosity level from 0 to 5 (inclusively), which is done by the --verbosity option. There is also the --date-time-format option which tells Finshir to use your custom date-time format.
Different verbosity levels print different logging types. As you can see in the table below, the zero verbosity level prints nothing, and the last one prints everything. The levels in the middle print logs selectively:

	Errors	Warnings	Notifications	Debugs	Traces
Zero (0)	❌	❌	❌	❌	❌
First (1)	✔	❌	❌	❌	❌
Second (2)	✔	✔	❌	❌	❌
Third (3)	✔	✔	✔	❌	❌
Fourth (4)	✔	✔	✔	✔	❌
Fifth (5)	✔	✔	✔	✔	✔

TLS support
Most of web servers today use the HTTPS protocol instead of HTTP, which is based on TLS. Since v0.2.0, Finshir has functionality to connect through TLS using the --use-tls flag.

Custom data portions
By default, Finshir generates 100 empty spaces as data portions to send. You can override this behaviour by specifying your custom messages as a file, consisting of a single JSON array. This example is focused on Google:
The command above sends a partial HTTPS request (first introduced by Slowloris) through TLS (which is achieved by specifying the --use-tls flag). You can access this partial request inside files/google.json.
(files/google.json)

Generate a report
Report is a set of statistics variables like a total number of connections established, a total number of failed transmissions and so on. There is three options for this: --xml-report, --json-report, and --text-report:
What means "at the end"? Well, Finshir will generate a report for you either if allotted time expires or if you cancel the process by Ctrl-C. You can look at the report examples in the files/reports folder:
(files/reports/report.json)
(files/reports/report.xml)
(files/reports/report.txt)

*********************** FINSHIR REPORT ***********************
Receiver:                 google.com:80
Total bytes sent:         535
Total errors:             0

Test start:               Wed, 29 May 2019 22:04:55 -0000
Test duration:            7s 385ms 765us 179ns

Successful connections:   535
Failed connections:       0
Total connections:        535

Successful transmissions: 535
Failed transmissions:     0
Total transmissions:      535
**************************************************************

If none of the options above has been specified, Finshir prints a report right to your terminal. That is, you can just run a test, cancel it later, and see the results which you can easily save. Perfect!

Contributing
You are always welcome for any contribution to this project! But before you start, you should read the appropriate document to know about the preferred development process and the basic communication rules.

Legal disclaimer
Finshir was developed as a means of testing stress resistance of web servers, and not for hacking, that is, the author of the project IS NOT RESPONSIBLE for any damage caused by your use of his program.

Project references

• https://www.reddit.com/r/rust/comments/bm6ttn/finshir_a_coroutinesdriven_low_slow_ddos_attack/
• https://www.producthunt.com/posts/finshir
• https://www.reddit.com/r/hacking/comments/bpg0by/ive_written_a_customizable_optimized_alternative/
• https://news.ycombinator.com/item?id=19931443
• https://www.reddit.com/r/rust/comments/bpor6b/finshir_a_coroutinesdriven_and_fully_customizable/
• https://news.ycombinator.com/item?id=19962333
• https://www.reddit.com/r/rust/comments/bqyaok/finshir_v022_was_released_any_suggestions_to_low
• https://www.reddit.com/r/rust/comments/btdu1a/finshir_v030_was_released_now_with_report/

Contacts
Temirkhan Myrzamadi<gymmasssorla@gmail.com> (the author)