UFONet F.A.Q. v2.0 [Revision: 05/2026]
Full Version online: https://ufonet.03c8.net/FAQ.html

What is UFONet?
It is a toolkit designed to launch DDoS and DoS attacks.


What is a DDoS attack?
A Distributed Denial of Service (DDoS) attack is an attempt to make an online service 
unavailable by overwhelming it (for example, with traffic...) from multiple sources.

 
What is a DoS attack?
A Denial of Service (DoS) attack is an attempt to make an online service 
unavailable by overwhelming it (for example, with traffic...) from a single source.


What is a Botnet?
A Botnet is a collection of computers often referred to as "zombies" that allows an attacker
to control them. It is commonly used to make DDoS attacks.


What is the philosophy behind UFONet?
"On a samurai sword or even any tool, what matters is who goes to use it and for what, 
not who builds it and when..."


Why can UFONet be more special, than for example, other botnets previously built?
Because UFONet tries not living traces (IPs, etc...) from the origin of the attack. And
of course, because it is free/libre. ;-)


How does UFONet work technically?
UFONet is a tool designed to launch Layer 7 (APP/HTTP) DDoS attacks, using 'Open Redirect'
vectors, generally located on third-party web applications (a botnet) and other
powerful DoS attacks, some including different OSI model layers, as for example
the TCP/SYN flood attack, which is performed on Layer 3 (Network).

This schema shows you how the architecture of the requests are made when performing
a simple HTTP/WebAbuse DDoS attack.


Is UFONet a "strong" botnet?
Well!. It depends on how you understand a botnet as "strong". If you understand it as;

 *  'privacy'; UFONet is the best -ninja- DDoS/DoS tool...
 *  'traffic volume'; it depends on; 'zombies', bandwidth, target's conf, etc...

With UFONet it's not about having a lot of 'zombies', it's more about those you have
work properly. If they are nice, you can 'defeat' a 'small' webserver just with
a 'couple of dozens'.

Or for example, in a scenario in which a target is using a VPS service with some limited
bandwidth rate (ex: 1GB/month) for the attacker is just a matter of time to run the tool
and wait until traffic (noise) reaches the maximum limit that closes the service.

Commonly people understand a botnet as an individual tool but UFONet is also a P2P/darknet,
that can be used to connect others machines and to run complex schemas involving other people 
working cooperatively: sharing 'zombies', reporting statistics (with rankings, clans)...

Therefore, UFONet can also be defined fundamentally, as: a botnet of botnets, which is 
obviously a harder and effective way to overwhelm an objective, than when a single person 
tries it individually.


What's the difference between: 'zombies', 'aliens', 'droids', 'ucavs'...?
 * Zombie: HTTP GET 'Open Redirect' bot

 ex: https://ZOMBIE.com/check?uri=$TARGET

 * Droid: HTTP GET 'Open Redirect' bot with params

 ex: https://ZOMBIE.COM/css-validator/validator?uri=$TARGET&profile=css3

 * Alien: HTTP POST 'Open Redirect' bot

 ex: https://ZOMBIE.com/analyze.html;$POST;url=$TARGET

 * Drone: HTTP 'Web Abuse' bot

 ex: https://www.isup.me/$TARGET

 * X-RPC: XML-RPC Vulnerability

 ex: https://ZOMBIE.COM/xmlrpc.php

 
Is it possible to stress target's database using UFONet?
Yes, it is. For example, you can order to your 'zombies' to submit random valid requests 
on a target's search input form. This floods database with queries.


Can I directly attack an IP address?
Yes, you can.


What kind of extra attacks does the tool have?
[DDoS] amplification / reflection:
 - FRAGGLE:    https://en.wikipedia.org/wiki/Fraggle_attack
 - TACHYON:    https://en.wikipedia.org/wiki/DNS_amplification_attack
 - MONLIST:    https://en.wikipedia.org/wiki/NTP_server_misuse_and_abuse
 - SMURF:      https://en.wikipedia.org/wiki/Smurf_attack
 - SNIPER:     https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
 - MEMCACHED:  https://en.wikipedia.org/wiki/Memcached
 - CHARGEN:    https://en.wikipedia.org/wiki/Character_Generator_Protocol
 - CLDAP:      https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol
 - SSDP:       https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol
 - QOTD:       https://en.wikipedia.org/wiki/QOTD
 - TFTP:       https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol
 - WSDISCO:    https://en.wikipedia.org/wiki/WS-Discovery
 - COAP:       https://en.wikipedia.org/wiki/Constrained_Application_Protocol
 - MSSQL:      https://en.wikipedia.org/wiki/Microsoft_SQL_Server
 - ARMS:       https://en.wikipedia.org/wiki/Apple_Remote_Desktop
 - PLEX:       https://en.wikipedia.org/wiki/Plex_(software)
 - NETBIOS:    https://en.wikipedia.org/wiki/NetBIOS
 - RIPV1:      https://en.wikipedia.org/wiki/Routing_Information_Protocol
 - SPRAY:      https://en.wikipedia.org/wiki/Denial-of-service_attack#Reflected_attack
 - MIDDLEBOX:  https://en.wikipedia.org/wiki/Network_middlebox
 - DBSTRESS:   https://en.wikipedia.org/wiki/SQL_injection

[ DoS] direct floods:
 - LOIC:       https://en.wikipedia.org/wiki/Low_Orbit_Ion_Cannon
 - LORIS:      https://en.wikipedia.org/wiki/Slowloris_(software)
 - SLOWREAD:   https://en.wikipedia.org/wiki/Slowloris_(software)
 - GOLDENEYE:  https://en.wikipedia.org/wiki/Denial-of-service_attack#Application-layer_attacks
 - RAPIDRESET: https://en.wikipedia.org/wiki/HTTP/2
 - UFOSYN:     https://en.wikipedia.org/wiki/SYN_flood
 - XMAS:       https://en.wikipedia.org/wiki/Christmas_tree_packet
 - NUKE:       https://en.wikipedia.org/wiki/Sockstress
 - UFOACK:     https://en.wikipedia.org/wiki/Denial-of-service_attack
 - UFORST:     https://en.wikipedia.org/wiki/TCP_reset_attack
 - FINFLOOD:   https://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_termination
 - DROPER:     https://en.wikipedia.org/wiki/IP_fragmentation_attack
 - OVERLAP:    https://en.wikipedia.org/wiki/IP_fragmentation_attack#Overlapping_fragment_attack
 - PINGER:     https://en.wikipedia.org/wiki/Ping_flood
 - UFOUDP:     https://en.wikipedia.org/wiki/UDP_flood_attack


Can I launch Extra Attacks without zombies?
Yes. Any Extra Attack can be launched standalone against a target via -m TARGET,
and multiple mods can be concatenated in a single command:
  sudo ./ufonet -m http://target.com --ssdp 50 --chargen 50 --loic 50
If a mod has no resources (placeholder reflectors), UFONet informs you, skips it, and
continues with the next mod in the chain.


What is a 'wormhole'?
It is an IRC gateway to Freenode where UFONet 'masters' can meet.


What is a 'blackhole'?
It is a P2P daemon to share 'zombies' with other UFONet 'masters'.


Where can I report a bug?
You can report errors on: Github issues.

Also you can stay in touch reporting on my "mothership" (using BOARD provided by default).
  
If nobody gets back to you, then drop me an e-mail.