Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to test our DOS prevention system against http requests that are not have header and agent information. Is there any tool I can do that. I tried siege with this command

siege -c 3 -b -H "Host: " -A ""

This command sends requests with empty host and agent values. What I want is to send requests without defining host and agent values.

Thanks for any advice...

share|improve this question
up vote 4 down vote accepted

Worst case, you could use netcat.

nc 80 << http_message_file

where is the host to which you want to connect, 80 is the port to which you want to connect (I chose 80 since that's typical HTTP server port) and http_message_file contains the exact HTTP request you want to send, such as

GET /path/to/resource HTTP/1.1
share|improve this answer
Nice answer. Don't forget to put "\r\n\r\n" at the end of header ;) – ibrahim Jan 8 '14 at 7:47
@atk Thanks you've helped me answer:… nc 80 << http_message_file Did not load the request in the file, rather let me type it using a here DOC. cat http_message_file | nc 80 Did the trick – user2514583 Dec 29 '14 at 2:18

I'm surprised nobody mentioned the easiest way of doing this, with curl :

curl -H "User-Agent:" -H "Host:"

The -H argument can be used to set custom headers or to remove them by setting no value on them.

Example of what that command does on my site, with -v added for verbosity :

andre@network ~ % curl -H "User-Agent:" -H "Host:" -v
* Rebuilt URL to:
* Hostname was NOT found in DNS cache
*   Trying 2a01:7e00::f03c:91ff:fe89:63c8...
* connect to 2a01:7e00::f03c:91ff:fe89:63c8 port 80 failed: Connection refused
*   Trying
* Connected to ( port 80 (#0)
> GET / HTTP/1.1
> Accept: */*
< HTTP/1.1 400 Bad Request
< Server: nginx/1.6.2
< Date: Mon, 29 Dec 2014 13:09:44 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 172
< Connection: close
[page contents truncated]

As you can see, both the host and user-agent headers are missing and the web server doesn't like that very much because I use virtual hosts and the host header is essential in that case.

share|improve this answer

I don't know if this will work for you, but why not. You can easely use python to send requests as you whish like so:

import urllib
import urllib2

url = ''
user_agent = 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)'
values = {'name' : 'Michael Foord',
          'location' : 'Northampton',
          'language' : 'Python' }
headers = { 'User-Agent' : user_agent }

data = urllib.urlencode(values)
req = urllib2.Request(url, data, headers)
response = urllib2.urlopen(req)
the_page =

From python doc :

Try doing the same thing but with empty user_agent and Headers, it worked in my smal test.

Here is the snippet I tested:

import urllib
import urllib2

url = ''
user_agent = ''
values = ''
headers = { '' : '' }

data = urllib.urlencode(values)
req = urllib2.Request(url, data, headers)
response = urllib2.urlopen(req)
the_page =
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.