379 GitHub stars and counting — valyala/goloris is a Go project TopGit is tracking across repositories on the platform. Slowloris for nginx DoS. Written in go
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
Automatically and silently eats all the available TCP connections
to the server.
Supports https.
Easily hackable thanks to clear and concise Go syntax
and powerful Golang features.
Limitations
Can eat up to 64K TCP connections from a single IP due to TCP limitations.
Just use proxies if you want overcoming this limitation :)
How it works?
It tries occupying and keeping busy as much tcp connections
to the victim as possible by using as low network bandwidth as possible.
If goloris is lucky enough, then eventually it should eat all the available
connections to the victim, so no other client could connect to it.
See the source code for more insights.
How quickly it can take down unprotected nginx with default settings?
In a few minutes with default config options.
Which versions of nginx are vulnerable?
All up to 1.5.9 if unprotected as described below (i.e. with default config).
How to protect nginx against goloris?
I know the following options:
Limit the number of simultaneous TCP connections from the same
source ip. See, for example, connlimit in iptables
or http://nginx.org/en/docs/http/ngx_http_limit_conn_module.html
Deny POST requests.
Patch nginx, so it drops connection if the client sends POST
body at very slow rate.
How to use it?
go get -u -a github.com/valyala/goloris
go build github.com/valyala/goloris
./goloris -help
P.S. Don't forget adjusting ulimit -n before experimenting.
And remember - goloris is published for educational purposes only.
Yes — valyala/goloris ships under the MIT license, which makes its source code freely readable (and, depending on license terms, forkable and reusable). Source: github.com/valyala/goloris.
What is valyala/goloris?
valyala/goloris (valyala/goloris) is a Go project on GitHub. From the project's own README: Slowloris for nginx DoS. Written in go
Where do I read more about valyala/goloris?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/valyala/goloris is the definitive source.
Read full README in the tab above.
Is goloris worth your time?
ChatGPT, Claude and Perplexity can all read this page. Ask one of them what it makes of goloris.
