KRAKEN

The last DDoS tool was built in 2012. Not any more. 55 techniques. AI-native. NEMESIS-orchestrated.
55
Techniques
5
Categories
12
AI-Native Attacks
62
Tests Passing
pip install red-specter-kraken
GoldenEye last updated 2017 / SlowLoris defeated by any modern server / LOIC can't out-bandwidth Cloudflare / Zero AI-native availability tools exist / LLM inference costs are unbounded / Context window exhaustion is untested / RAG retrieval is a flood vector / Multi-agent fan-out is a real threat / Nobody built for the AI era GoldenEye last updated 2017 / SlowLoris defeated by any modern server / LOIC can't out-bandwidth Cloudflare / Zero AI-native availability tools exist / LLM inference costs are unbounded / Context window exhaustion is untested / RAG retrieval is a flood vector / Multi-agent fan-out is a real threat / Nobody built for the AI era

Every DDoS Tool Is Dead

GoldenEye. SlowLoris. LOIC. hping3. All built before 2015. All designed for a world where the target was a web server. The target is no longer a web server. It is an LLM inference endpoint, a RAG pipeline, an AI agent orchestrator, or a multi-model cascade — and every existing tool is blind to it.

GoldenEye

Last updated 2017. HTTP GET/POST flood only. No API awareness. No AI awareness. Blocked by every CDN on the market.

SlowLoris

Written in 2009. Slow header exhaustion. Defeated by any modern web server with connection timeouts configured.

LOIC / HOIC

Peak era: 2010. Volumetric flooding. You cannot out-bandwidth Cloudflare with a Python script on a single machine.

The Gap

Zero new availability testing tools in over a decade. Meanwhile: LLMs, RAG systems, AI agents, inference compute, token budgets. An entirely new attack surface. Nobody built for it.

Three Layers. Five Categories. Everything.

KRAKEN covers traditional network flooding through to AI-native compute exhaustion. Every technique built from scratch in pure Python. Zero external tool dependencies. Zero subprocess calls. NEMESIS reasoning selects and sequences attacks autonomously.

Category 01

Network Exhaustion

10 TECHNIQUES — L3/L4

UDP Flood, TCP SYN/ACK, ICMP, IP Fragmentation, DNS/NTP/SSDP/Memcached Amplification, BGP Hijack Simulation. Layer 3 and Layer 4 exhaustion at scale.

Category 02

Application Exhaustion

15 TECHNIQUES — L7

HTTP GET/POST Flood, HTTP/2 Rapid Reset (CVE-2023-44487), HTTP/3 QUIC, Slowloris, Slow POST, Slow Read, Cache Bypass/Poisoning, SSL/TLS Flood, WebSocket Flood. Full Layer 7 coverage.

Category 03

API Exhaustion

13 TECHNIQUES — API LAYER

REST API Flood, GraphQL Depth/Alias/Introspection Abuse, XML Bomb, JSON Bomb, Regex DoS, OAuth Token Flood, Webhook Flood, gRPC Stream Flood. Every API attack surface covered.

Category 04

AI Infrastructure Exhaustion

12 TECHNIQUES — AI-NATIVE

LLM Inference Cost Attack. Context Window Maximiser. RAG Retrieval Flood. Multi-Agent Fan-Out. Token Budget Exhaustion. Agentic Loop Induction. Model Cascade Attack. Nobody else has built these.

Category 05

Adaptive Techniques

5 TECHNIQUES — NEMESIS-ORCHESTRATED

Rotating Vector Attack. Threshold Probing. Timing Attack. Geographic Distribution. Protocol Confusion. Never presents the same attack pattern twice. Adapts to defensive responses in real time.

ARMORY

NIGHTFALL ARMORY Integration

970 PAYLOADS — CENTRALISED LIBRARY

Connected to the NIGHTFALL ARMORY payload intelligence library. Pulls extraction accelerator, delegation bomb, and AI-native payloads on demand. Auto-mutation engine generates evasion variants. Successful payloads feed back for continuous improvement.

NEMESIS Reasoning Engine

KRAKEN does not run scripted attacks. It thinks. NEMESIS plans the engagement based on recon output — selects techniques, calculates sequencing, adapts in real time, escalates when defences respond. Three phases. One command.

Run recon, plan the engagement, then execute — NEMESIS selects optimal techniques automatically:

$ kraken recon https://target.example.com
$ kraken plan https://target.example.com --duration 60
$ kraken execute https://target.example.com --override --confirm-destroy
[RECON] Fingerprinting target...
  CDN detected: Cloudflare | WAF: active | AI endpoints: 3 discovered
[PLAN] NEMESIS selecting techniques from 55 available...
  Selected: HTTP/2 Rapid Reset, AI Inference Cost, Context Window, API GraphQL Depth
  Sequence: 4 vectors, 3 phases, adaptive escalation enabled
[EXECUTE] PHANTOM swarm deploying — 60s engagement...
  Phase 1: HTTP/2 Rapid Reset — 98% success rate
  Phase 2: AI Inference exhaustion — token budget depleted
  Phase 3: Context window flood — inference latency +4,200ms

ENGAGEMENT COMPLETE | Availability score: 23/100 | Report signed ✓
  RESTRICTED: reports/kraken-2026-04-28.json
55
Techniques
5
Categories
12
AI-Native Attacks
62
Tests Passing
0
Failures

UNLEASHED Clearance

Every destructive operation is Ed25519 signed, scope-locked to an allowed targets file, and auto-locks after 30 minutes. Three tiers of operation. Authorised penetration testing only.

Detection

Default mode. Reconnaissance only. Fingerprint target. Map attack surface. Discover AI endpoints. Zero attack traffic sent.

Dry Run

--override flag. Ed25519 signature required. Plans the full attack. Shows projected impact. No execution. NEMESIS selects techniques.

Live Execution

--override --confirm-destroy. Full autonomous attack against authorised targets only. 30-minute auto-lock. RESTRICTED signed report.

THIS TOOL IS FOR AUTHORISED SECURITY TESTING ONLY. EVERY EXECUTION IS SIGNED AND LOGGED.

Ed25519 Cryptographic Override
KRAKEN UNLEASHED

Cryptographic override. Private key controlled. One operator. Founder's machine only.

Security Distros & Package Managers

Kali Linux
.deb package
Parrot OS
.deb package
BlackArch
PKGBUILD
REMnux
.deb package
PyPI
pip install
macOS
pip install
Windows
pip install
Docker
docker pull

Authorised Use Only

Red Specter KRAKEN is intended for authorised security testing only. Conducting availability attacks against systems you do not own or have explicit written permission to test may violate the Computer Misuse Act 1990 (UK), Computer Fraud and Abuse Act (US), and equivalent legislation in other jurisdictions. Always obtain written authorisation before conducting any security assessments. Apache License 2.0.