MatrixTM / MatrixTM/MHDDoS

[BUG Report]: Is `REQUESTS` a valid HTTP method or intentional design?

Open
#718 1 comment 1 reaction 1 assignee View on GitHub

@MHProDev is already working on this.

Since May 25, 2026.

bug
Dominant language
Python
Stars
16.7k
Forks
3.6k
Avg merge
1d 16h
Merged PRs (30d)
5

Description

Version

2.4 (Default)

Which section is the problem?

L7 (DDoS Attack Layer 7)

Please complete the following information
- OS: Ubuntu 24.04
- Installed Requirements Version [e.g. PyRoxy1.0b5]
- Python Version 3.12.12
What happened (Describe the bug) ?

I'm new to MHDDoS and trying to make captures of attacking an Nginx server to learn different attacks. Now I'm trying downloader attack and seeing MHDDoS sending the following requests to Nginx:

REQUESTS /stream/20 HTTP/1.2
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cache-Control: max-age=0
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Sec-Gpc: 1
Pragma: no-cache
Upgrade-Insecure-Requests: 1
Host: 10.0.0.238:8080
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101209 Firefox/3.6.13
Referrer: http://www.netacad.lviv.ua/plugins/system/plugin_googlemap3/plugin_googlemap3_proxy.php?url=http%3A//10.0.0.238%3A8080/stream/20
X-Forwarded-Proto: Http
X-Forwarded-Host: 10.0.0.238, 1.1.1.1
Via: 192.181.67.119
Client-IP: 192.181.67.119
X-Forwarded-For: 192.181.67.119
Real-IP: 192.181.67.119
Image

AFAIK, there is no REQUESTS method in HTTP's RFC:

And I found that REQUESTS is the fallback method in https://github.com/MatrixTM/MHDDoS/blob/main/start.py#L960-L966

    def getMethodType(method: str) -> str:
        return "GET" if {method.upper()} & {"CFB", "CFBUAM", "GET", "TOR", "COOKIE", "OVH", "EVEN",
                                            "DYN", "SLOW", "PPS", "APACHE",
                                            "BOT", "RHEX", "STOMP"} \
            else "POST" if {method.upper()} & {"POST", "XMLRPC", "STRESS"} \
            else "HEAD" if {method.upper()} & {"GSB", "HEAD"} \
            else "REQUESTS"

In my environment, Nginx and other HTTP servers all reject such request with 405 Not allowed or 400 Bad Request instead of 404 Not found. I wonder whether this is an intentional design.

Screenshots

https://github.com/user-attachments/assets/0c0c052e-3a7d-4aed-a139-cf055fd18f97

Please provide a link to a minimal reproduction of the bug

No response

Relevant log output

Additional context

No response

Your code

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.