Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Artillery based performance testing that runs on the serverless framework, supporting high-order functions like Stress, Soak, Load, Spike and DDOS attacks
Whirlwind is a performance testing library that allows you to run the following higher order functions:
Whirlwind uses the AWESOME Artillery.io toolkit and runs on Serverless Framework and on Amazon Lambda, allowing you to generate an insane amount of load. You can even simulate a DDOS attack by distributing the load across the globe!
For an example of how to use this, please see the whirlwind-example repository.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"cloudformation:ListStacks",
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:CreateChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:ExecuteChangeSet",
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResource",
"s3:createBucket",
"lambda:InvokeFunction",
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket",
"cloudformation:ValidateTemplate",
"iam:GetRole",
"logs:DescribeLogGroups",
"iam:CreateRole",
"logs:CreateLogGroup",
"iam:DeleteRole",
"iam:PutRolePolicy",
"lambda:GetFunction",
"lambda:CreateFunction",
"iam:PassRole",
"lambda:ListVersionsByFunction",
"lambda:PublishVersion",
"lambda:UpdateFunctionCode",
"lambda:UpdateFunctionConfiguration",
"iam:AttachRolePolicy",
"cloudformation:DeleteStack",
"lambda:DeleteFunction",
"logs:DescribeLogStreams",
"logs:DeleteLogGroup",
"s3:DeleteBucket"
],
"Resource": "*"
}
]
}
~/.aws/credentials
file with:[default]
aws_access_key_id=KEY
aws_secret_access_key=KEY
Make sure you have Node installed (tested with Node v8.9.3
and may work with higher).
Export these ENV variables:
export INFLUX_HOST=<your ip>
export INFLUX_PASSWORD=<your password>
export INFLUX_USER=<your user>
export INFLUX_DB=<the database>
export TARGET_HOST=<target host>
You may want to send all requests from 1 IP address, for example to test a server may still be in development and not accessible from Internet. With AWS VPC and NAT gateway it's possible to run all Lambda functions in a private subnet and route all the traffic through a leased IP address.
Here is a video how to configure this on AWS side:
and a tutorial: How to setup a VPC for Lambdas
You also need to setup securityGroupIds
and subnetIds
in your serverless.yml
file. You can see a commented example in the file in this repo. A securityGroup
is defined in VPC Dashboard -> Security -> Security Groups, you can use a default security group with open internet access.
You can install InfluxDB on a t2.micro
(or higher) instance with Ubuntu 16.04. First run apt-get update
and apt-get upgrade
then follow official installation tutorial Installing influxDB
You then need to setup access to influxDB over the internet by following this tutorial.
Finally you need to open port 5001
(this is a default port for influxDB, you can choose a different port) on your EC2 instance. Here is how.
Graphana is a log watcher which can directly connect to influxDB and show your test logs in real-time. It's really easy to use and generates great looking graphs.
We used Graphana hosted on their servers. This is the "We Host It" option that you can see on this page.
Also this blog shows some usage and installation of influxDB and Graphana hosted on your server.
This project has been forked from the awesome serverless-artillery project. A huge thank you goes to the Nordstorm team for making this OSS and allowing us to build Whirlwind on top of their hard work.
FAQs
Artillery based performance testing that runs on the serverless framework, supporting high-order functions like Stress, Soak, Load, Spike and DDOS attacks
The npm package whirlwind receives a total of 3 weekly downloads. As such, whirlwind popularity was classified as not popular.
We found that whirlwind demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.