dheatattack/dheaterD(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through which denial-of-service can be performed by enforcing the Diffie-Hellman key exchange. For more information visit https://dheatattack.com
D(HE)ater is the proof-of-concept implementation of the D(HE)at attack (CVE-2002-20001). It saturates a server's CPU by enforcing Diffie-Hellman ephemeral (DHE) or elliptic-curve Diffie-Hellman ephemeral (ECDHE) key exchange over both TLS and SSH. For further information about the attack visit the project page or read the full technical paper on IEEE Access.
D(HE)ater is a proof-of-concept denial-of-service tool intended only for defensive security testing, mitigation verification, and research. Run it exclusively against systems you own or for which you have explicit, written authorization. Using it against systems without permission may be illegal and is likely to disrupt the targeted service. The authors provide the code as-is, without warranty, and accept no liability for any misuse or damage.
D(HE)ater is a command-line tool. The --protocol option and the target uri are mandatory:
# enforce DHE key exchange against a TLS service
dheat --protocol tls example.com:443
# enforce DHE key exchange against an SSH service
dheat --protocol ssh example.com:22
Optional arguments:
| Option | Default | Description |
|---|---|---|
--key-exchange | DHE | key exchange to enforce: DHE or ECDHE |
--timeout | 5 | socket timeout in seconds |
--thread-num | 1 | number of threads to run |
--key-size | none | key size to enforce |
# enforce elliptic-curve (ECDHE) key exchange instead of finite-field (DHE)
dheat --protocol tls --key-exchange ECDHE example.com:443
# 16 threads, 10 second timeout
dheat --protocol tls --thread-num 16 --timeout 10 example.com:443
Guidance on detecting and mitigating the D(HE)at attack is maintained on the official project site: dheatattack.com.
D(HE)ater requires Python 3.9 or newer and depends on CryptoLyzer to check DHE/ECDHE support and generate the necessary traffic. The dependency is installed automatically with the methods described below.
Install the latest release from PyPI:
pip install dheater
To install the current development version directly from the source repository:
pip install git+https://gitlab.com/dheatattack/dheater.git
The code is available under the terms of Apache License Version 2.0. A non-comprehensive, but straightforward description and also the full license text can be found at Choose an open source license website.
D(HE)ater uses CryptoLyzer to check DHE/ECDHE support of TLS/SSH services and also to generate the traffic necessary to perform D(HE)at attack.