dheatattack/dheater

GitLabRepository PoC

PoC files

48 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitLab

Docker lab environments

1
GitLab

Repository root

Created Vuln labCVE-2002-20001Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single Dockerfile that builds a Python 3.13-slim image containing the D(HE)ater tool, a proof-of-concept for the D(HE)at denial-of-service attack (CVE-2002-20001). The image runs as 'nobody' and executes the 'dheat' command by default.

Dockerfile:1-14

Lab assessment

Vulnerability lab

The Dockerfile packages a tool explicitly described as a proof-of-concept for CVE-2002-20001, a denial-of-service attack. The README, CHANGELOG, and other documentation consistently frame the project as a vulnerability research and testing tool.

Dockerfile:1-14README.md:1-10CHANGELOG.md:1-5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

D(HE)ater tool

vulnerability PoCDoS attack toolcommand-line application

A Python command-line tool that enforces Diffie-Hellman ephemeral (DHE) or elliptic-curve Diffie-Hellman ephemeral (ECDHE) key exchange against TLS and SSH services to saturate server CPU. It uses CryptoLyzer for protocol analysis and traffic generation.

README.md:1-10dheater/__main__.py:1-759

DH parameter private key size setter

utilityDH parameter modifier

A helper tool that reads a DH parameter file and sets or removes the suggested private key size, outputting the modified PEM.

dheater/dh_param_priv_key_size_setter.py:1-55

Fail2Ban filters

defensive configurationlog parsing

Fail2Ban filter configuration files for Apache and Dovecot SSL/TLS handshake interruptions, likely intended to help detect or mitigate the D(HE)at attack.

fail2ban/apache-ssl.conf:1-13fail2ban/dovecot-ssl.conf:1-16
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2002-20001

Supported by supplied evidence

The project is explicitly described as the proof-of-concept implementation of the D(HE)at attack (CVE-2002-20001) in multiple files, including README, CHANGELOG, CITATION.cff, and the CI configuration.

README.md:1-10CHANGELOG.md:1-5CITATION.cff:1-10.gitlab-ci.yml:1-63
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Python 3.9 or newer is required to run the tool.README.md:1-10pyproject.toml:1-65
  • A target TLS or SSH service that supports DHE or ECDHE key exchange must be accessible.README.md:1-10dheater/__main__.py:1-759

Evidence-described exercise path

  1. Build the Docker image from the Dockerfile.Dockerfile:1-14
  2. Run the container with the 'dheat' command, specifying the target protocol and URI (e.g., 'dheat --protocol tls example.com:443').README.md:1-10dheater/__main__.py:1-759
  3. Observe the tool's output indicating the target's key exchange parameters and the attack threads running.dheater/__main__.py:1-759
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile builds a known vulnerability PoC tool and runs it as a non-root user. The tool's behavior is directed at a user-specified target service, which is the intended lab exercise. There is no evidence of hidden host compromise, credential theft, data destruction, or external backdoor behavior.

Dockerfile:1-14dheater/__main__.py:1-759
Review boundaries

What the analysis did not establish

  • The packet contains no Compose file; the environment is a single Dockerfile without orchestration.
  • The Dockerfile does not expose ports or mount host directories, so the attack surface is limited to outbound connections.
  • The tool's actual network behavior depends on runtime arguments; the static evidence only shows the code and documentation.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1