🐍 oura

No system is really safe.

CLI tool for stress-testing web targets using k6. Internal security research tool. Only use against targets you have authorization to test.

Install

npm i -g @lazuardytech/oura

Prerequisites

• Node.js >= 20
• k6 installed and available in $PATH

After linking, the oura command is available globally.

Usage

Attack

Launch a stress test against a target:

# Basic bombard with 100 VUs for 30 seconds
oura attack -t https://example.com

# Custom VUs, duration, and scenario
oura attack -t https://example.com -u 500 -d 1m -s ramping

# POST request with JSON payload and custom headers
oura attack -t https://api.example.com/endpoint \
  -m POST \
  -u 200 \
  -d 45s \
  -w '{"key":"value"}' \
  -H '{"Content-Type":"application/json"}'

# Ramping scenario with custom stages
oura attack -t https://example.com -s ramping \
  -r "0:10s,50:30s,100:60s,50:30s,0:10s"

# Soak test (long duration) and save report
oura attack -t https://example.com -s soak -u 200 -d 10m -o result.json

# Stealth mode with rotating headers and random delays
oura attack -t https://example.com -s stealth -u 50 -d 1m

# Stealth flag on any scenario
oura attack -t https://example.com -s bombard --stealth

# Form flood — auto-detect and fill form fields
oura attack -t https://example.com/submit -s form-flood -u 100 -d 30s

# Form flood with separate scan URL
oura attack -t https://example.com/submit -s form-flood \
  --scan-url https://example.com/form-page

# Proxy support
oura attack -t https://example.com --proxy http://proxy:8080
oura attack -t https://example.com --proxy-file proxies.txt

# CDN bypass via origin IP
oura attack -t https://example.com --origin 1.2.3.4

# Custom thresholds
oura attack -t https://example.com \
  --threshold 'http_req_duration:p(95)<500' \
  --threshold 'http_req_failed:rate<0.1'

# Fixed iterations instead of duration
oura attack -t https://example.com --iterations 1000

# Rate limiting per VU
oura attack -t https://example.com --rps 50

Attack Options

| Flag | Description | Default | | --- | --- | --- | | -t, --target | Target URL (required) | — | | -m, --method | HTTP method (GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS) | GET | | -u, --vus | Number of virtual users | 100 | | -d, --duration | Test duration (30s, 1m, 5m) | 30s | | -r, --ramp-up | Custom ramp-up stages | — | | -w, --payload | Request body (JSON string) | — | | -H, --headers | Custom headers (JSON string) | — | | -s, --scenario | Attack scenario | bombard | | -o, --output | Output path for k6 summary JSON | — | | --threshold | Pass/fail thresholds (repeatable) | — | | --iterations | Iterations per VU (overrides duration for bombard) | — | | --no-check | Disable default response checks | false | | --stealth | Enable stealth mode (rotating headers, random delays) | false | | --proxy | Proxy URL (HTTP/HTTPS/SOCKS5) | — | | --proxy-file | Path to proxy list file (one per line) | — | | --origin | Origin server IP to bypass CDN | — | | --rps | Requests per second per VU | 1000 | | --scan-url | URL to scan for form fields (form-flood scenario) | — |

Scenarios

• bombard — Constant load with fixed VUs for the entire duration
• ramping — Gradually increases and decreases load (default stages if --ramp-up not provided)
• soak — Prolonged test with progressive load increase to find breaking points
• stealth — Rotating User-Agents, headers, spoofed IPs, and random delays to mimic real traffic
• form-flood — Auto-detect HTML form fields and flood with realistic data

Scan

Scan a frontend URL for API endpoints, WebSockets, webhooks, SSE, and GraphQL:

oura scan -t https://example.com
oura scan -t https://example.com -k    # skip SSL verification

| Flag | Description | Default | | --- | --- | --- | | -t, --target | Target URL (required) | — | | -k, --insecure | Skip SSL certificate validation | false |

Report

View results from a previous test run:

oura report -f result.json
oura report -f result.json --detail

| Flag | Description | | --- | --- | | -f, --file | Path to k6 summary JSON (required) | | --detail | Show detailed metrics per endpoint |

Config

Manage oura configuration:

oura config show
oura config set defaultVus 200
oura config set defaultDuration 1m
oura config set defaultScenario stealth
oura config set defaultRpsPerVu 50
oura config reset

| Key | Type | Default | | --- | --- | --- | | k6Path | string | "k6" | | defaultVus | number | 100 | | defaultDuration | string | "30s" | | defaultScenario | string | "bombard" | | defaultRpsPerVu | number | 1000 | | lastTarget | string | "" |

Architecture

src/
├── index.ts              # CLI entry point
├── commands/
│   ├── attack.ts         # Attack command
│   ├── report.ts         # Report command
│   ├── config.ts         # Config management
│   └── scan.ts           # Frontend API scanner
├── k6/
│   ├── runner.ts         # k6 script compilation & execution
│   └── templates/
│       ├── bombard.ts     # Constant-load template
│       ├── ramping.ts     # Progressive-ramp template
│       ├── soak.ts        # Long-duration soak template
│       ├── stealth.ts     # Stealth mode template
│       ├── form-flood.ts  # Form auto-detection & flood template
│       └── utils/
│           ├── stealth.ts     # Stealth helpers (User-Agents, headers, IP spoofing)
│           └── form-scanner.ts # Form field detection from HTML
└── utils/
    ├── logger.ts          # Colored console output
    ├── validator.ts       # Input validation
    ├── sanitizer.ts       # Script injection sanitization
    └── fetcher.ts         # Node.js HTTP/HTTPS fetcher

Development

npm install
npm run build
npm link
npm run dev       # Watch mode build
npm run typecheck # Type checking
npm run lint      # Lint
npm run format    # Format

License

MIT