Safety

Safety

MHDDoS generates real network traffic. Treat every run as a production change.

Caution

Running a flood against a system without permission is illegal in most jurisdictions. "It was only a test" is not a defence.

Before you start

• I own the target, or I have written permission that names the target and the time window.
• I know who to contact if the target degrades.
• The target is not shared infrastructure, a third-party API, or a provider's edge network.
• I have a stop condition: duration, error threshold, or an operator watching the run.
• I am not testing from a network that forbids spoofed or high-volume traffic.

Scope

Good target	Bad target
A lab VM you control	A public website
A staging environment with permission	A production API you do not own
A dedicated test host	Shared hosting or a provider's edge
A local container	A third party's DNS resolver

A written scope should include:

• the exact hostnames and IPs;
• the allowed methods;
• the allowed source addresses;
• the start and end time;
• the maximum rate;
• an emergency contact.

Operational limits

• Start with a short duration and a low thread count.
• Watch the target's CPU, error rate, and latency, not just MHDDoS output.
• Stop if the target becomes unreachable for reasons unrelated to the test.
• Do not run amplification methods without a spoofable source and reflectors you are allowed to use.
• Do not leave KILLER or CONNECTION running unattended; they create threads continuously.

Data handling

• Treat proxy lists and reflector files as sensitive operational data.
• Do not commit real proxy credentials, API keys, or private keys.
• The web panel uses a random JWT secret per start. Set JWT_SECRET if sessions must survive a restart, and keep it out of version control.

Web panel

The panel can start processes. Keep it local:

WEB_HOST=127.0.0.1

Do not expose it to the internet without a reverse proxy, TLS, and real authentication. The built-in JWT layer is not a replacement for an access-control review.

Reporting a problem

If you find a vulnerability in MHDDoS itself, open a private security advisory on GitHub rather than a public issue. Include the version, a minimal reproduction, and the impact.