All DDoS Definitions
DDoS Testing Definition

Booter / Stresser

A booter (or stresser) is usually described as the bottom of the threat range: small floods bought by amateurs, the kind a serious defense absorbs without anyone noticing. That holds only if your capacity and your mitigation's reaction time both sit above what a cheap subscription buys, and a DDoS test exists to find out which case you are in.

The service itself is commercialized attack infrastructure, a website that sells attack traffic on demand. Marketed euphemistically as "stress testing", it gives a paying customer a dashboard to point pre-built botnets and reflection servers at any address, which takes the skill and cost of launching an attack to almost nothing.

Booter / stresser: rented attack traffic on demand Booter / stresser dashboard rented, paid by subscription pick target, vector, rate Pre-built botnets + reflectors globally sourced, multi-vector no skill required Authorized DDoS test contracted and bounded reproduces the same vectors Authorization + scope gate owner sign-off, rate caps abort conditions Target service sees the same attack vectors and shapes either way same vectors The traffic is real, multi-vector, and globally sourced, so even modest targets need a validated floor of resilience. Same vectors, different control: a test adds caps, aborts and measurement, and borrows no third-party servers. BlackNeuron™
Diagram of a booter or stresser: a rented dashboard driving pre-built botnets and reflectors into a real flood; an authorized DDoS test can use the same vectors but differs in authorization, control and whose infrastructure carries the traffic

How a booter works

The customer sees a web panel and a price list. Plans are sold on two dimensions: boot time, the longest single attack allowed, in seconds, and concurrents, how many attacks can run at once. Pick a target, a method and a duration, press the button.

Behind the panel sit back-end servers on hosting that does not check, or does not care, whether outgoing packets carry spoofed source addresses. The Layer 3 and 4 "methods" are mostly reflection: the back end sends small spoofed queries to open DNS, NTP, CLDAP and similar servers, which answer the victim with far larger replies. That mechanism belongs to the amplification attack page. What the booter adds is the rental: it maintains the reflector lists and the spoofing-capable hosts, so the customer never has to find either. The Layer 7 methods push HTTP requests through proxy lists or headless browsers.

Booter: a paid button becomes a reflected flood Booter panel sold by the minute Rented reflectors open DNS, NTP, CLDAP spoofing-capable back end Target for the boot time spoofed queries, sent for the customer reflected flood, no skill required The customer picks target, method and duration; the service supplies every piece of infrastructure. BlackNeuron™
Animation of a booter: a paid panel sold by the minute sends spoofed queries through rented reflector lists of open DNS, NTP and CLDAP servers, which return a reflected flood at the target for the length of the purchased boot time

The size of the market is on the record. When Europol's Operation Power Off took down webstresser.org in April 2018, the service had more than 136,000 registered users and had been used for around four million attacks, with plans from roughly 15 euros a month. In December 2022 the FBI seized 48 booter domains in a single action, and further takedowns have followed. Each one thins the market for a while; the services come back under new names.

Why it matters under attack

Booters set the realistic floor, not the ceiling. Most organisations will never meet a state-level adversary, but any of them can meet a disgruntled customer, a former employee or a gaming rival with a monthly plan. The traffic that arrives is real and globally sourced, and it is often multi-vector, because a customer with two concurrents can run a reflection flood and an HTTP flood at the same time.

Two properties of booter traffic shape the defense. First, attacks are short. A boot time is usually counted in minutes, so a mitigation that needs ten minutes to engage protects nothing: the attack is over and the outage already happened. Second, the vectors are commodity. The same handful of reflection protocols and HTTP methods appear across services, which makes them easy to filter in principle and embarrassing to miss in practice.

What a DDoS test measures about it

A test reproduces the booter repertoire under authorization, with owner sign-off, rate caps and abort conditions. The vectors and traffic shapes can match; the rest does not.

A test runs under control, with a cap it cannot exceed, an abort someone can press and measurement on both ends, and it sends from its own infrastructure. A booter's reflection methods borrow open DNS, NTP and CLDAP servers that belong to third parties, and its back ends are often compromised hosts.

The useful questions are concrete:

  • Reaction time against boot time. Does time to mitigation beat the length of a typical paid attack, or does the defense engage after the damage is done?
  • Commodity reflection at the edge. Are the common reflection vectors dropped upstream, or do they reach a link or firewall that saturates first?
  • Concurrent vectors. Does a reflection flood plus an HTTP flood behave like the two tested separately, or does one hide the other?
  • Repeat visits. Booter attacks are cheap enough to rerun every day. Does the defense hold on the fifth attack the way it did on the first, and does anyone get paged?

A target that clears this floor has not proven it can survive a determined adversary. One that fails it is exposed to anyone with a few euros.

Why a booter cannot stand in for a testing tool, even when it is pointed at your own assets, is worked through in DDoS Testing Tools.