#

    UFONet F.A.Q. v2.0 [Revision: 05/2026]Full Version online: https://ufonet.03c8.net/FAQ.html
    What is UFONet?
    It is a toolkit designed to launch DDoS and DoS attacks.

    What is a DDoS attack?
    A Distributed Denial of Service (DDoS) attack is an attempt to make an online service
    unavailable by overwhelming it (for example, with traffic...) from multiple sources.

    What is a DoS attack?
    A Denial of Service (DoS) attack is an attempt to make an online service
    unavailable by overwhelming it (for example, with traffic...) from a single source.

    What is a Botnet?
    A Botnet is a collection of computers often referred to as "zombies" that allows an attacker
    to control them. It is commonly used to make DDoS attacks.

    What is the philosophy behind UFONet?
    "On a samurai sword or even any tool, what matters is who goes to use it and for what,
    not who builds it and when..."

    Why can UFONet be more special, than for example, other botnets previously built?
    Because UFONet tries not living traces (IPs, etc...) from the origin of the attack. And
    of course, because it is free/libre. ;-)

    How does UFONet work technically?
    UFONet is a tool designed to launch Layer 7 (APP/HTTP) DDoS attacks, using 'Open Redirect'
    vectors, generally located on third-party web applications (a botnet) and other
    powerful DoS attacks, some including different OSI model layers, as for example
    the TCP/SYN flood attack, which is performed on Layer 3 (Network).

    This schema shows you how the architecture of the requests are made when performing
    a simple HTTP/WebAbuse DDoS attack.

    Is UFONet a "strong" botnet?
    Well!. It depends on how you understand a botnet as "strong". If you understand it as;

     *  'privacy'; UFONet is the best -ninja- DDoS/DoS tool...
     *  'traffic volume'; it depends on; 'zombies', bandwidth, target's conf, etc...

    With UFONet it's not about having a lot of 'zombies', it's more about those you have
    work properly. If they are nice, you can 'defeat' a 'small' webserver just with
    a 'couple of dozens'.

    Or for example, in a scenario in which a target is using a VPS service with some limited
    bandwidth rate (ex: 1GB/month) for the attacker is just a matter of time to run the tool
    and wait until traffic (noise) reaches the maximum limit that closes the service.

    Commonly people understand a botnet as an individual tool but UFONet is also a P2P/darknet,
    that can be used to connect others machines and to run complex schemas involving other people
    working cooperatively: sharing 'zombies', reporting statistics (with rankings, clans)...

    Therefore, UFONet can also be defined fundamentally, as: a botnet of botnets, which is
    obviously a harder and effective way to overwhelm an objective, than when a single person
    tries it individually.

    What's the difference between: 'zombies', 'aliens', 'droids', 'ucavs'...?
     * Zombie: HTTP GET 'Open Redirect' bot

     ex: https://ZOMBIE.com/check?uri=$TARGET

     * Droid: HTTP GET 'Open Redirect' bot with params

     ex: https://ZOMBIE.COM/css-validator/validator?uri=$TARGET&profile=css3

     * Alien: HTTP POST 'Open Redirect' bot

     ex: https://ZOMBIE.com/analyze.html;$POST;url=$TARGET

     * Drone: HTTP 'Web Abuse' bot

     ex: https://www.isup.me/$TARGET

     * X-RPC: XML-RPC Vulnerability

     ex: https://ZOMBIE.COM/xmlrpc.php

    Is it possible to stress target's database using UFONet?
    Yes, it is. For example, you can order to your 'zombies' to submit random valid requests
    on a target's search input form. This floods database with queries.

    Can I directly attack an IP address?
    Yes, you can.

    What kind of extra attacks does the tool have?
    [DDoS] amplification / reflection:
     - FRAGGLE:    https://en.wikipedia.org/wiki/Fraggle_attack
     - TACHYON:    https://en.wikipedia.org/wiki/DNS_amplification_attack
     - MONLIST:    https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse
     - SMURF:      https://en.wikipedia.org/wiki/Smurf_attack
     - SNIPER:     https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
     - MEMCACHED:  https://en.wikipedia.org/wiki/Memcached
     - CHARGEN:    https://en.wikipedia.org/wiki/Character_Generator_Protocol
     - CLDAP:      https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol
     - SSDP:       https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol
     - QOTD:       https://en.wikipedia.org/wiki/QOTD
     - TFTP:       https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol
     - WSDISCO:    https://en.wikipedia.org/wiki/WS-Discovery
     - COAP:       https://en.wikipedia.org/wiki/Constrained_Application_Protocol
     - MSSQL:      https://en.wikipedia.org/wiki/Microsoft_SQL_Server
     - ARMS:       https://en.wikipedia.org/wiki/Apple_Remote_Desktop
     - PLEX:       https://en.wikipedia.org/wiki/Plex_(software)
     - NETBIOS:    https://en.wikipedia.org/wiki/NetBIOS
     - RIPV1:      https://en.wikipedia.org/wiki/Routing_Information_Protocol
     - SPRAY:      https://en.wikipedia.org/wiki/Denial-of-service_attack#Reflected_attack
     - MIDDLEBOX:  https://en.wikipedia.org/wiki/Network_middlebox
     - DBSTRESS:   https://en.wikipedia.org/wiki/SQL_injection

    [ DoS] direct floods:
     - LOIC:       https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon
     - LORIS:      https://en.wikipedia.org/wiki/Slowloris_(software)
     - SLOWREAD:   https://en.wikipedia.org/wiki/Slowloris_(software)
     - GOLDENEYE:  https://en.wikipedia.org/wiki/Denial-of-service_attack#Application-layer_attacks
     - RAPIDRESET: https://en.wikipedia.org/wiki/HTTP/2
     - UFOSYN:     https://en.wikipedia.org/wiki/SYN_flood
     - XMAS:       https://en.wikipedia.org/wiki/Christmas_tree_packet
     - NUKE:       https://en.wikipedia.org/wiki/Sockstress
     - UFOACK:     https://en.wikipedia.org/wiki/Denial-of-service_attack
     - UFORST:     https://en.wikipedia.org/wiki/TCP_reset_attack
     - FINFLOOD:   https://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_termination
     - DROPER:     https://en.wikipedia.org/wiki/IP_fragmentation_attack
     - OVERLAP:    https://en.wikipedia.org/wiki/IP_fragmentation_attack#Overlapping_fragment_attack
     - PINGER:     https://en.wikipedia.org/wiki/Ping_flood
     - UFOUDP:     https://en.wikipedia.org/wiki/UDP_flood_attack

    Can I launch Extra Attacks without zombies?
    Yes. Any Extra Attack can be launched standalone against a target via -m TARGET,
    and multiple mods can be concatenated in a single command:
      sudo ./ufonet -m http://target.com --ssdp 50 --chargen 50 --loic 50
    If a mod has no resources (placeholder reflectors), UFONet informs you, skips it, and
    continues with the next mod in the chain.

    What is a 'wormhole'?
    It is an IRC gateway to Freenode where UFONet 'masters' can meet.

    What is a 'blackhole'?
    It is a P2P daemon to share 'zombies' with other UFONet 'masters'.

    Where can I report a bug?
    You can report errors on: Github issues.

    Also you can stay in touch reporting on my "mothership" (using BOARD provided by default).

    If nobody gets back to you, then drop me an e-mail.