Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/srini-raman/cb_queue_bench
Fast cross-platform HTTP benchmarking tool with COUCHBASE Eveneing Queues ACK testing code
bombardier is a HTTP(S) benchmarking tool. It is written in Go programming language and uses excellent fasthttp instead of Go's default http library, because of its lightning fast performance.
With bombardier v1.1
and higher you can now use net/http
client if you need to test HTTP/2.x services or want to use a more RFC-compliant HTTP client.
Tested on go1.8 and higher.
You can grab binaries in the [releases] TBD section. Alternatively, to get latest and greatest run:
go get -u github.com/jon-strabala/cb_queue_bench
cb_queue_bench [<flags>] <url>
Flags in cb_queue_bench addded to bombardier
-u, --basicauth=user:pass COUCHBASE: Basic Auth
-A, --customAck COUCHBASE: Couchbase custom /recv and /recv/bulk ack
-V, --debugCustomAck COUCHBASE: Vebose debug of Couchbase custom /recv and /recv/bulk ack
For a more detailed information about bombardier flags consult GoDoc.
AFAIK, it's impossible to pass Host header correctly with fasthttp
, you can use net/http
(--http1
/--http2
flags) to workaround this issue.
Sending one item of data on the command line you can actually use bombardier or even ab for this)
> ./cb_queue_bench -u Administrator:password -t 15s -n 1 -c 1 -m POST \
-b '{ "userid": "noequal", "first_name": "couch", "last_name": "base" }' \
-H 'Content-Type: application/json' \
http://127.0.0.1:8096/queues/api/v1/queues/cc-added/send
Bombarding http://127.0.0.1:8096/queues/api/v1/queues/cc-added/send with 1 request(s) using 1 connection(s)
1 / 1 [============================================] 100.00% 4/s 0s
Done!
Statistics Avg Stdev Max
Reqs/sec 365.88 0.00 365.88
Latency 2.28ms 0.00us 2.28ms
HTTP codes:
1xx - 0, 2xx - 1, 3xx - 0, 4xx - 0, 5xx - 0
others - 0
Throughput: 174.96KB/s
Receiving and acknowleging one item of data, note -A for custom ACK functionality and -V for verbose ACK debug
.
> ./cb_queue_bench -u Administrator:password -t 15s -n 1 -c 1 -m POST -A -V \
-H 'Content-Type: application/json' \
http://127.0.0.1:8096/queues/api/v1/queues/cc-added/recv
COUCHBASE (customAck) normal client URL: http://127.0.0.1:8096/queues/api/v1/queues/cc-added/recv
COUCHBASE (customAck) then ack send URL: http://127.0.0.1:8096/queues/api/v1/queues/cc-added/ack
Bombarding http://127.0.0.1:8096/queues/api/v1/queues/cc-added/recv with 1 request(s) using 1 connection(s)
0 / 1 [============================================] 0.00%
COUCHBASE (customAck) sending a customAck based on prior HTTP couchbase /recv or /recv/bulk
COUCHBASE (customAck) with body
{"msg_id": "mid:cc-added:08dbed2b-e53b-46e8-9ddd-ecc1d4446f07:1:16"}
COUCHBASE (customAck) success in send of customAck based on prior HTTP couchbase /recv or /recv/bulk 200
1 / 1 [============================================] 100.00% 4/s 0s
Done!
Statistics Avg Stdev Max
Reqs/sec 223.73 0.00 223.73
Latency 3.31ms 0.00us 3.31ms
HTTP codes:
1xx - 0, 2xx - 1, 3xx - 0, 4xx - 0, 5xx - 0
others - 0
Throughput: 211.03KB/s
Sending 4000 items of data on the command line you can actually use bombardier or even ab for this)
Here we set -n 4000
for the number of requests and -c 64
for the number of concurrent request threads.
> ./cb_queue_bench -u Administrator:password -t 15s -n 4000 -c 64 -m POST \
-b '{ "userid": "noequal", "first_name": "couch", "last_name": "base" }' \
-H 'Content-Type: application/json' \
http://127.0.0.1:8096/queues/api/v1/queues/cc-added/send
Bombarding http://127.0.0.1:8096/queues/api/v1/queues/cc-added/send with 4000 request(s) using 64 connection(s)
4000 / 4000 [============================================] 100.00% 19908/s 0s
Done!
Statistics Avg Stdev Max
Reqs/sec 35441.20 8264.44 46084.38
Latency 1.77ms 1.68ms 40.33ms
HTTP codes:
1xx - 0, 2xx - 4000, 3xx - 0, 4xx - 0, 5xx - 0
others - 0
Throughput: 16.07MB/s
Receiving and acknowleging 4000 items of data, note -A for custom ACK functionality and we dropped -V for verbose ACK debug
.
Here we set -n 4000
for the number of requests and -c 64
for the number of concurrent request threads.
> ./cb_queue_bench -u Administrator:password -t 15s -n 4000 -c 64 -m POST -A \
-H 'Content-Type: application/json' \
http://127.0.0.1:8096/queues/api/v1/queues/cc-added/recv
Bombarding http://127.0.0.1:8096/queues/api/v1/queues/cc-added/recv with 4000 request(s) using 64 connection(s)
4000 / 4000 [============================================] 100.00% 19827/s 0s
Done!
Statistics Avg Stdev Max
Reqs/sec 26439.21 11532.92 38222.24
Latency 2.23ms 3.34ms 42.88ms
HTTP codes:
1xx - 0, 2xx - 4000, 3xx - 0, 4xx - 0, 5xx - 0
others - 0
Throughput: 21.49MB/s
Data to send in a file
> cat ./a4.post.data.json
[
{
"arypos": 1,
"userid": "noequal",
"first_name": "couch",
"last_name": "base"
},
{
"arypos": 2,
"userid": "noequal",
"first_name": "couch",
"last_name": "base"
},
{
"arypos": 3,
"userid": "noequal",
"first_name": "couch",
"last_name": "base"
},
{
"arypos": 4,
"userid": "noequal",
"first_name": "couch",
"last_name": "base"
}
]
Sending one data batch size of 4 as above (you can actually use bombardier or even ab for this)
> ./cb_queue_bench -u Administrator:password -t 15s -n 1 -c 1 -m POST \
-f ./a4.post.data.json -H 'Content-Type: application/json' \
http://127.0.0.1:8096/queues/api/v1/queues/cc-added/send/bulk
Bombarding http://127.0.0.1:8096/queues/api/v1/queues/cc-added/send/bulk with 1 request(s) using 1 connection(s)
1 / 1 [============================================] 100.00% 4/s 0s
Done!
Statistics Avg Stdev Max
Reqs/sec 297.56 0.00 297.56
Latency 2.87ms 0.00us 2.87ms
HTTP codes:
1xx - 0, 2xx - 1, 3xx - 0, 4xx - 0, 5xx - 0
others - 0
Throughput: 372.37KB/s
Receiving one batch and acknowleging the data batch size of 4 as above, note -A for custom ACK functionality and -V for verbose ACK debug
.
> ./cb_queue_bench -u Administrator:password -t 15s -n 1 -c 1 -m POST -A -V \
-H 'Content-Type: application/json' \
http://127.0.0.1:8096/queues/api/v1/queues/cc-added/recv/bulk?maxmsgs=4
Bombarding http://127.0.0.1:8096/queues/api/v1/queues/cc-added/recv/bulk?maxmsgs=4 with 1 request(s) using 1 connection(s)
0 / 1 [============================================] 0.00%
COUCHBASE (customAck) sending a customAck based on prior HTTP couchbase /recv or /recv/bulk
COUCHBASE (customAck) with body
[
{"msg_id": "mid:cc-added:08dbed2b-e53b-46e8-9ddd-ecc1d4446f07:1:10"},
{"msg_id": "mid:cc-added:08dbed2b-e53b-46e8-9ddd-ecc1d4446f07:1:f"},
{"msg_id": "mid:cc-added:08dbed2b-e53b-46e8-9ddd-ecc1d4446f07:1:d"},
{"msg_id": "mid:cc-added:08dbed2b-e53b-46e8-9ddd-ecc1d4446f07:1:e"}
]
COUCHBASE (customAck) success in send of customAck based on prior HTTP couchbase /recv or /recv/bulk 200
1 / 1 [============================================] 100.00% 4/s 0s
Done!
Statistics Avg Stdev Max
Reqs/sec 195.93 0.00 195.93
Latency 3.77ms 0.00us 3.77ms
HTTP codes:
1xx - 0, 2xx - 1, 3xx - 0, 4xx - 0, 5xx - 0
others - 0
Throughput: 437.52KB/s
Sending 4000 batches of data batch with size 4 as above (you can actually use bombardier or even ab for this)
Here we set -n 4000
for the number of requests and -c 64
for the number of concurrent request threads.
> ./cb_queue_bench -u Administrator:password -t 15s -n 4000 -c 64 -m POST \
-f ./a4.post.data.json -H 'Content-Type: application/json' \
http://127.0.0.1:8096/queues/api/v1/queues/cc-added/send/bulk
Bombarding http://127.0.0.1:8096/queues/api/v1/queues/cc-added/send/bulk with 4000 request(s) using 64 connection(s)
4000 / 4000 [=================================================================================] 100.00% 9946/s 0s
Done!
Statistics Avg Stdev Max
Reqs/sec 11084.17 1584.51 13808.84
Latency 5.75ms 1.81ms 45.31ms
HTTP codes:
1xx - 0, 2xx - 4000, 3xx - 0, 4xx - 0, 5xx - 0
others - 0
Throughput: 13.35MB/s
Receiving and acknowleging the 4000 data batches of size 4 as above, note -A for custom ACK functionality and we dropped -V for verbose ACK debug
.
Here we set -n 4000
for the number of requests and -c 64
for the number of concurrent request threads.
> ./cb_queue_bench -u Administrator:password -t 15s -n 4000 -c 64 -m POST -A \
-H 'Content-Type: application/json' \
http://127.0.0.1:8096/queues/api/v1/queues/cc-added/recv/bulk?maxmsgs=4
Bombarding http://127.0.0.1:8096/queues/api/v1/queues/cc-added/recv/bulk?maxmsgs=4 with 4000 request(s) using 64 connection(s)
4000 / 4000 [=================================================================================] 100.00% 9957/s 0s
Done!
Statistics Avg Stdev Max
Reqs/sec 12194.46 3899.90 17910.07
Latency 5.11ms 4.59ms 50.32ms
HTTP codes:
1xx - 0, 2xx - 4000, 3xx - 0, 4xx - 0, 5xx - 0
others - 0
Throughput: 24.56MB/s
Example of running cb_queue_bench
against this server:
> ./cb_queue_bench -c 125 -n 10000000 http://localhost:8080
Bombarding http://localhost:8080 with 10000000 requests using 125 connections
10000000 / 10000000 [============================================] 100.00% 37s Done!
Statistics Avg Stdev Max
Reqs/sec 264560.00 10733.06 268434
Latency 471.00us 522.34us 51.00ms
HTTP codes:
1xx - 0, 2xx - 10000000, 3xx - 0, 4xx - 0, 5xx - 0
others - 0
Throughput: 292.92MB/s
Or, against a realworld server(with latency distribution):
> ./cb_queue_bench -c 200 -d 10s -l http://ya.ru
Bombarding http://ya.ru for 10s using 200 connections
[============================================] 10s Done!
Statistics Avg Stdev Max
Reqs/sec 6607.00 524.56 7109
Latency 29.86ms 5.36ms 305.02ms
Latency Distribution
50% 28.00ms
75% 32.00ms
90% 34.00ms
99% 48.00ms
HTTP codes:
1xx - 0, 2xx - 0, 3xx - 66561, 4xx - 0, 5xx - 0
others - 5
Errors:
dialing to the given TCP address timed out - 5
Throughput: 3.06MB/s
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.