PAGES
← all tools
◆ Web Application Security

slowhttptest

v1.10.0 open-source

SlowHTTPTest is a highly configurable tool that simulates Application Layer Denial of Service attacks by prolonging HTTP connections in different ways.

source ↗ rss ↗ What is a cyber toolchain? last repo push Aug 28, 2026

Summary

slowhttptest is an open-source command-line tool that simulates application-layer denial-of-service attacks by prolonging HTTP connections, letting you see how a web server behaves under slow, low-bandwidth request patterns like slow headers or slow body transmission. It runs as a single binary on Linux, OS X and Cygwin, or via a published Docker image, which suits anyone testing their own infrastructure without building from source. The intended user is a web-app security tester or administrator checking DoS resilience and concurrent-connection limits before an attacker does, rather than a SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analyst monitoring live traffic. It sits in the application-layer DoS testing category alongside general load and stress tools, but is purpose-built for slow-connection attack patterns like Slowloris rather than raw throughput.

SlowHTTPTest is a highly configurable tool that simulates Application Layer Denial of Service attacks by prolonging HTTP connections in different ways.

How slowhttptest helps

How many concurrent slow connections can my web server absorb before it stops responding?

opens a configurable number of connections that trickle data slowly and reports, in periodic status snapshots, how many stay connected, how many close, and whether the service still answers at each interval

At what point does my server start dropping slow connections instead of holding them open?

tracks connected versus closed counts at each snapshot, and an early exit with no open connections left marks the moment the target gave up before the configured test duration finished

Is my server still serving real requests while it's under a pile of slow connections?

checks service availability at every snapshot interval, so a run showing available at every check confirms the target kept responding despite the held-open load

Can my server hold up against connections that trickle both requests and bodies slowly?

prolongs HTTP connections in different ways, letting the same server be tested against slow headers and slow message bodies rather than a single attack shape

Will my server tolerate slow clients that also require mutual TLS?

supports client certificates during the test, so servers that mandate mutual TLS authentication can be put under slow-connection load without the handshake itself blocking the test

Does my server treat one slow endpoint differently if requests carry specific headers?

lets custom headers be injected into the slow request payloads, so behavior under load can be checked for endpoints that only engage certain logic when a given header is present

all 4 features, with the evidence for each →

Languages

Not documented

Features

4 capabilities · 1 backed by code, an API document or a real run

Built from slowhttptest's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date.

Compare with peers →

  • slowhttptest covers 1 of the 8 vulnerability assessment methods capabilities we track.
All capabilities 4 capabilities
Sustained connection load testing verified Opens a configurable number of parallel connections to a target and holds them open over a timed duration, reporting connection state, error count, and service availability at regular intervals. 1 release · 8 other sources · first seen Aug 2026

release

  • Adds custom request header injection, allowing arbitrary headers to be sent with slow HTTP test payloads. v1.10.0 · Aug 2026 · source · release history

we ran it 8 total

  • Status snapshots every 5 seconds up to the 20th second. All 50 connections reached the connected state by second 5 with zero errors or closed connections, and the service reported as available at… Aug 2026 · the full run
  • At second 5 and second 10 all 50 connections were held open with the service still reporting available. Aug 2026 · the full run
  • Status snapshots every 5 seconds; by the 5th second all 50 connections were established and held, with 0 errors and 0 closed connections throughout the visible portion. Aug 2026 · the full run
  • Status snapshots every 5 seconds up to the 20-second mark. All 50 connections were established by the 5th second and held steady with zero errors or closed connections through the 20th second, with… Aug 2026 · the full run
  • Status snapshots every 5 seconds up to the 20th second; all 50 connections reached connected state by second 5 with zero errors or closed connections, and the target reported 'service available:… Aug 2026 · the full run
  • The output is truncated, showing status snapshots every 5 seconds up to the 20th second. Aug 2026 · the full run
mTLS testing shipped Enables client certificate authentication when testing targets that require mutual TLS. 1 release · first seen Aug 2026

release

  • Adds mTLS support, enabling client certificates when testing targets that require mutual TLS authentication. v1.10.0 · Aug 2026 · source · release history
OpenSSL configuration flexibility shipped Supports custom OpenSSL installation paths via configure flags for non-standard environments. 1 release · first seen Aug 2026

release

  • Adds --with-openssl=DIR configure flag for builds where OpenSSL is installed in a non-standard path. v1.10.0 · Aug 2026 · source · release history
HTTP/2 slow headers testing shipped Executes slow HTTP headers tests specifically against HTTP/2 targets via Docker. 1 other source

Shared capability: Web vulnerability scanning

example

  • Run HTTP/2 slow headers test via Docker docker run --rm --entrypoint slowhttptest-ng shekyan/slowhttptest:ng -u https://target/ -c 1000 -H

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for slowhttptest, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail slowhttptest puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

1 entry

  1. August 20261

    1 entry

    1. v1.10.0 Aug 28, 2026 · issue 058

      slowhttptest v1.10.0 adds mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. client certificate support and custom request headers for authenticated targets.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.10.0 https://github.com/shekyan/slowhttptest.git
# already have the repo? check out this version:
$ git checkout v1.10.0
      • Adds --with-openssl=DIR configure flag for builds where OpenSSL is installed in a non-standard path.
      • Adds mTLS support, enabling client certificates when testing targets that require mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. authentication.
      • Adds custom request header injection, allowing arbitrary headers to be sent with slow HTTP test payloads.

      3 details in Everything

    Project health

    Issue, contributor and maintainer activity in shekyan/slowhttptest, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 −1 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 4.5 years first maintainer reply 25 hours
    6. Open backlog 3 of 66 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 3
    3. Contributors / month 1
    4. Commits / month 46
    5. Stars 1,651
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback