The most powerful open-source Layer 7 stress tester with real CVE-based attack methods, auto-proxy fetching, and a beautiful UI.
If Miku Miku Beam helps your pentesting workflow, please give it a star — it helps others discover this tool and keeps development active.
Most stress testing tools are either:
- ❌ Outdated (no HTTP/2 support, no modern CVE methods)
- ❌ CLI-only (no visual feedback)
- ❌ Broken (crash on edge cases, memory leaks)
- ❌ Require manual proxy setup
Miku Miku Beam solves all of these:
✅ 8 attack methods including CVE-2023-44487 & CVE-2024-27983
✅ Beautiful real-time UI with PPS counter and live logs
✅ One-click free proxy fetching (500+ proxies instantly)
✅ Zero crashes — battle-tested error handling
✅ No dependencies hell — just npm install && npm run dev
The original MikuMikuBeam by Sammwy has been abandoned and rewritten in Go. This is the only actively maintained Node.js version with critical fixes:
| Feature | Original (Sammwy) | This Fork (Vanszs) |
|---|---|---|
| "Use My IP" mode | ❌ Crashes on 3/4 methods | ✅ Works on ALL 8 methods |
| TCP Flood | ❌ Memory leak (freezes PC) | ✅ Connection pool, zero leaks |
| Proxy handling | ❌ Crash on bad format | ✅ Auto-skip, never crashes |
| Attack methods | 4 basic methods | 8 methods (incl. HTTP/2 CVEs) |
| Proxy sourcing | ❌ Manual only | ✅ Auto-fetch 500+ free proxies |
| Concurrency | 1 request/tick | 1000+ parallel connections |
| Multi-language | ❌ English only | ✅ EN / ID / 中文 |
| Status | ✅ Actively maintained |
| Method | Description | CVE | Concurrency |
|---|---|---|---|
| HTTP Flood | High-volume request spam | — | 1000 parallel |
| HTTP Slowloris | Exhausts connection pool with slow drip | — | 500 persistent |
| HTTP/2 Rapid Reset | Stream open + instant RST_STREAM cancel | CVE-2023-44487 | 50 sessions × 100 streams |
| HTTP/2 CONTINUATION | Endless header frames → OOM crash | CVE-2024-27983 | 30 sessions × 500 frames |
| HTTP Bypass | Browser-mimic bot (fetches resources, follows links) | — | 50 bots |
| WebSocket Flood | Persistent WS connections + message spam | — | 200 conns × 50 msg/s |
| TCP Flood | Raw TCP packet flood | — | 200 connections |
| Minecraft Ping | MC protocol handshake spam | — | 100 concurrent |
All methods support Proxy Mode and Direct Mode (Use My IP).
git clone https://github.com/Vanszs/MikuMikuBeamDDOS.git
cd MikuMikuBeamDDOS
npm install
npm run devOpen http://localhost:5173 → Enter target → Click Start Beam ⚡
No need to hunt for proxy lists manually. Click "Auto-Fetch Free Proxies" in the config editor to instantly load 500+ working proxies (HTTP, SOCKS4, SOCKS5) from proxifly/free-proxy-list.
Copy .env.example to .env:
PORT=3000
CORS_ORIGIN=http://localhost:5173http://host:port
socks5://host:port
socks4://user:pass@host:port
Enable "Attack with my current IP" for maximum speed (your full bandwidth, no proxy overhead).
┌─────────────────┐ Socket.IO ┌──────────────────┐
│ React UI │ ◄────────────────► │ Express Server │
│ (Vite) │ │ (Port 3000) │
└─────────────────┘ └────────┬─────────┘
│
┌────────────┼────────────┐
▼ ▼ ▼
┌──────────┐ ┌──────────┐ ┌──────────┐
│ Worker 1 │ │ Worker 2 │ │ Worker N │
│ (Thread) │ │ (Thread) │ │ (Thread) │
└──────────┘ └──────────┘ └──────────┘
- Worker Threads for CPU isolation (attack doesn't freeze UI)
- Batched stats (1 report/sec, not per-request)
- Connection pooling with automatic reconnection
- Pre-generated payloads (Buffer-based, O(n) not O(n²))
- ⚡ All 8 workers rewritten with connection pooling & batched stats
- 🧹 Auto-remove dead proxies from list after attack
- 🌐 Auto-fetch free proxies (one-click, 500+ proxies)
- 🔧 Slowloris rewritten as real slowloris (500 conn pool + slow drip)
- 🔧 TCP Flood: 200 connections × continuous write, pre-gen Buffer payload
- 🔧 MC Ping: 100 concurrent pings
- 📈
randomStringoptimized from O(n²) to O(n) with Buffer - 🔄 Proxy/UA list auto-reloads after config save (no restart)
- 🖥️ Frontend uses
VITE_SERVER_URLenv var (deployable anywhere)
- 🚀 4 new attack methods (HTTP/2 Rapid Reset, CONTINUATION, Bypass, WebSocket)
- 🔧 Fixed ALL 6 crash bugs from original (useMyIP, memory leak, CORS, race condition)
- ⚡ HTTP Flood: 1000 concurrent connections with agent caching
- 🌏 Multi-language UI (EN/ID/CN)
- 📝
.envconfiguration support
- Basic HTTP Flood, Slowloris, TCP, MC Ping
- Single-threaded, 1 request per interval tick
- Multiple crash bugs, abandoned for Go rewrite
ddos tool network stress test http flood layer 7 ddos slowloris attack http2 rapid reset CVE-2023-44487 CVE-2024-27983 websocket flood tcp flood minecraft stress test ddos panel free proxy list socks5 proxy penetration testing red team tool load testing stress testing tool 2026 ddos attack tool network stresser http2 continuation flood cloudflare bypass waf bypass dos attack pentest tool
PRs welcome! Fork, improve, submit. Areas that need help:
- More attack methods (QUIC, gRPC)
- Proxy health checker
- TLS fingerprint randomization
- Docker support
For authorized penetration testing and educational purposes only. Only use against systems you own or have explicit written permission to test. The authors are not responsible for misuse.
MIT — Use freely, contribute back.
If this tool saved you time, drop a ⭐ — it takes 1 second and helps a lot!