attack_effectiveness_matrix.json

{
  "_version": "3.1",
  "_generated": "2026-04-03",
  "_published_under_license": "CC-BY-4.0 (data) + MIT (scripts)",
  "_published_at": "2026-04-26",
  "_sanitization": "Public release of an internal research matrix. Vendor names in notes have been generalized to architecture categories. Internal tool flags, tool roadmap, and proprietary execution metadata have been removed. See PRIVATE_OMITTED.md in the source repo for the audit log.",
  "_description": "Attack effectiveness matrix: maps each vector against protection architectures and config levels. Effectiveness levels: deadly (service failure expected), degraded (partial impact, user-visible), mitigated (absorbed with minor impact), blocked (no impact). Config levels: default (vendor defaults, no tuning), tuned (basic policies configured), hardened (expert-level config, behavioral baselines trained).",
  "_notes": [
    "This matrix captures effectiveness AGAINST the protection layer, not the origin behind it.",
    "For hybrid architectures, effectiveness = min(CDN effectiveness, on-prem effectiveness) for each vector.",
    "Cloud CDN/WAF 'typical' and 'max' refer to aggregate provider capacity, not per-customer limits.",
    "Protocol-specific vectors (SIP, SMTP, SSH, etc.) only apply to assets running those services.",
    "Amplification vectors use bots as reflectors - the amp factor multiplies bot bandwidth.",
    "Prerequisites field lists conditions that must be true for the attack to work at stated effectiveness."
  ],
  "architectures": {
    "exposed": "No CDN, WAF, or DDoS mitigation. Traffic hits origin directly.",
    "cloud_cdn": "Cloud CDN/WAF (Cloudflare, Akamai, Radware Cloud, Imperva, CloudFront). Elastic, distributed.",
    "security_waf": "On-prem security WAF (F5 BIG-IP, Check Point, Palo Alto, FortiGate). DPI shares CPU with IPS/AV/SSL.",
    "ddos_appliance": "Dedicated DDoS appliance (Radware DefensePro, Arbor, A10 Thunder TPS). Hardware-accelerated, behavioral.",
    "hybrid": "Cloud CDN + on-prem appliance. Two layers, CDN absorbs volumetric, appliance handles L7.",
    "perimeter_filtered": "Firewall/ACL filtering. Blocks unsolicited traffic but no DDoS-specific mitigation."
  },
  "config_levels": {
    "default": "Vendor defaults. No custom policies, no rate limits configured, no behavioral baselines trained.",
    "tuned": "Basic policies: rate limits set, geo-blocking enabled, bot signatures updated, WAF rules active but not customized.",
    "hardened": "Expert config: behavioral baselines trained (2+ weeks), custom rate limits per endpoint, challenge pages for suspicious patterns, origin lockdown, header stripping, TLS 1.3 only."
  },
  "vectors": {
    "l3_icmp_flood": {
      "name": "ICMP Flood",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Volumetric pipe saturation with ICMP echo packets. Targets ISP uplink bandwidth.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Origin pipe saturates. Hardened: kernel ICMP rate limiting helps but pipe still fills."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy ICMP. Only works if attacker knows origin IP and bypasses CDN."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF drops ICMP but shares pipe with legitimate traffic. High volume still saturates uplink."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware ICMP drop at line rate. Only deadly if volume exceeds appliance rated capacity."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs at edge. ICMP never reaches on-prem."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops ICMP. Pipe saturation still possible with extreme volume."
        }
      },
      "taxonomy_id": "L3-01",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_blacknurse": {
      "name": "BlackNurse (ICMP Type 3)",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "ICMP Type 3 Code 3 (port unreachable) at moderate rate causes CPU spike on firewalls. Only ~40Kpps needed.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Kernel processes each packet. Hardened: iptables rate limit on ICMP type 3."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't forward ICMP. Requires origin IP."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall CPU processes ICMP unreachable. BlackNurse specifically targets firewall CPUs."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops anomalous ICMP patterns."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs. Never reaches appliance."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall processes ICMP - this is the exact target of BlackNurse."
        }
      },
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_icmp_tunnel": {
      "name": "ICMP Tunneling",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Encapsulate data in ICMP payloads. Used for C2 exfil, not volumetric DDoS.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Low volume, not a DDoS vector per se. Resource drain from processing oversized ICMP."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy ICMP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "DPI inspects ICMP payloads - CPU cost. Tuned: drop oversized ICMP."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Anomalous ICMP payload detection."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN blocks ICMP."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops ICMP or limits payload size."
        }
      },
      "taxonomy_id": "L3-04",
      "type": "technique",
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_ip_fragment": {
      "name": "IP Fragmentation Flood",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Flood with fragmented IP packets. Target must reassemble, consuming CPU and memory. Overlapping fragments cause additional processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Kernel fragment reassembly exhausts memory. Hardened: sysctl fragment limits."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN edge drops fragments or reassembles with massive capacity."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF reassembly consumes CPU. Tuned: fragment reassembly limits."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware fragment reassembly at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles at edge."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall reassembly. Tuned: drop fragmented packets."
        }
      },
      "taxonomy_id": "L3-05",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_ip_null": {
      "name": "IP Null (Protocol 0)",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "IP packets with protocol field 0 (HOPOPT). Confuses stateful inspection, may bypass ACLs.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Kernel processes unknown protocol. Tuned: iptables drop non-TCP/UDP/ICMP."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "DPI attempts to classify. Tuned: explicit protocol whitelist."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops unknown protocols."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN blocks at edge."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops non-standard protocols."
        }
      },
      "taxonomy_id": "L3-07",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_gre_flood": {
      "name": "GRE Tunnel Flood",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Flood with GRE (protocol 47) packets. Targets tunnel endpoints and pipe bandwidth.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturation. Hardened: drop GRE if not used."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy GRE."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "WAF processes GRE decap. Tuned: drop if no GRE tunnels configured."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware GRE rate limiting."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops GRE unless explicitly allowed."
        }
      },
      "taxonomy_id": "L3-09",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_esp_flood": {
      "name": "ESP Flood (IPSec)",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Flood with ESP (protocol 50) packets. Targets IPSec VPN endpoints.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "If VPN endpoint: crypto processing exhaustion. If not: kernel drops but pipe fills."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy ESP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall processes ESP for VPN. Tuned: rate limit ESP, drop if no VPN."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops non-VPN ESP."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops ESP unless VPN configured."
        }
      },
      "taxonomy_id": "L3-10",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_ah_flood": {
      "name": "AH Flood (IPSec)",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Flood with AH (protocol 51) packets. Similar to ESP but targets authentication header processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Same as ESP flood."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy AH."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Same as ESP."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops."
        }
      },
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_ipip_flood": {
      "name": "IP-in-IP Tunnel Flood",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Flood with IP-in-IP (protocol 4) encapsulated packets. Targets tunnel decapsulation.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Kernel decap processing. Hardened: drop protocol 4 if unused."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "DPI on encapsulated packets. Tuned: drop if unused."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops."
        }
      },
      "taxonomy_id": "L3-11",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_ipv6ip_flood": {
      "name": "IPv6-in-IPv4 Flood",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "IPv6 packets tunneled in IPv4 (protocol 41). Targets 6-to-4 gateways.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Gateway processing. Hardened: drop protocol 41 if no 6to4."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall may not inspect inner IPv6. Tuned: drop."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops."
        }
      },
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_mpls_flood": {
      "name": "MPLS Flood",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Flood with MPLS-labeled packets targeting label switch routers.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Only effective against MPLS-enabled routers. Most servers drop silently."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't forward MPLS."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "WAF drops non-IP."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops non-IP."
        }
      },
      "taxonomy_id": "L3-12",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l4_syn_flood": {
      "name": "SYN Flood",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "Spoofed SYN packets exhaust TCP connection table (SYN backlog). Classic volumetric + state exhaustion.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Connection table fills. Hardened: SYN cookies, increased backlog, but pipe still saturates."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates TCP. SYN flood never reaches origin."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "SYN proxy/cookies on WAF. But WAF connection table is finite and shared."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware SYN proxy at line rate. Designed for this exact attack."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates TCP at edge."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Firewall SYN proxy. Limited connection table."
        }
      },
      "taxonomy_id": "L4-01",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_synack_flood": {
      "name": "SYN-ACK Flood (Reflection)",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "Spoofed SYN to reflectors causes SYN-ACK flood to victim. Bypasses ingress SYN filtering.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Victim receives SYN-ACK for connections it never initiated. Confuses stateful firewalls."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops unsolicited SYN-ACK."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Stateful firewall confused by unsolicited SYN-ACK. Tuned: strict TCP state tracking."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Behavioral detection of SYN-ACK without matching SYN."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates at edge."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Stateful firewall should drop. May still consume CPU on state lookup."
        }
      },
      "taxonomy_id": "L4-02",
      "type": "technique",
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_ack_flood": {
      "name": "ACK Flood",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "Spoofed ACK packets bypass SYN proxy (already 'established'). Target wastes CPU on state lookup for non-existent connections.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Kernel searches connection table for each ACK. High PPS = CPU exhaustion."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops ACK without matching connection."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF state table lookup for each ACK. Tuned: strict state tracking drops faster."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware state tracking at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops at edge."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall state lookup. Tuned: drop ACK without SYN."
        }
      },
      "taxonomy_id": "L4-03",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_fin_flood": {
      "name": "FIN Flood",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "Spoofed FIN packets. Similar to ACK flood - forces state table lookup.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Same as ACK flood mechanism."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Same as ACK."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall state lookup."
        }
      },
      "taxonomy_id": "L4-04",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_rst_flood": {
      "name": "RST Flood",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "Spoofed RST packets to tear down legitimate connections (if sequence number guessed) or exhaust state table processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "RST with valid seq# kills connections. Random RST still causes state lookup. Hardened: RST window validation."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops RST without matching state."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF processes RST for state cleanup. CPU cost."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware RST validation."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall state processing."
        }
      },
      "taxonomy_id": "L4-05",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_pshack_flood": {
      "name": "PSH+ACK Flood",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "PSH+ACK with payload forces application layer processing. Bypasses SYN proxy since it looks like established connection data.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application processes each payload. Higher CPU cost than pure ACK flood."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops without matching connection state."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DPI engine processes payload of each packet. Very expensive for security WAFs."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware state validation drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Firewall drops. May process payload for IPS matching first."
        }
      },
      "taxonomy_id": "L4-06",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_tsunami_tcp": {
      "name": "Tsunami TCP (SYN+Timestamp)",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "SYN flood with timestamp options. Bypasses basic SYN cookies that don't encode timestamps.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Same as SYN flood but bypasses naive SYN cookie implementations."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates TCP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF SYN proxy may not handle timestamp options correctly."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware SYN proxy handles timestamps."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Firewall SYN proxy may not handle."
        }
      },
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_tcp_fragment": {
      "name": "TCP Fragment Flood",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "TCP segments fragmented at IP layer. Forces reassembly before TCP processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "IP reassembly + TCP processing double cost. Hardened: drop fragments."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles reassembly at massive scale."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF must reassemble to inspect. Expensive. Tuned: fragment limits."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware reassembly at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall reassembly. Tuned: drop fragments."
        }
      },
      "taxonomy_id": "L4-07",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_tcp_connection": {
      "name": "TCP Connection Flood (Empty)",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "Complete TCP handshake then hold connection open without sending data. Exhausts connection table with real connections (not spoofable).",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Server connection limit hit. Apache default: 256 workers. Hardened: aggressive timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN has massive connection capacity. But connection to origin may be limited."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with all functions. Exhausts faster than rated."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Large connection tables (40M+) but still finite. Behavioral detection of idle connections."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates and pools connections to origin."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Firewall connection table. Tuned: idle timeout."
        }
      },
      "prerequisites": [
        "Cannot use spoofed IPs - requires real TCP handshake from bot IPs"
      ],
      "taxonomy_id": "L4-09",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_sockstress": {
      "name": "Sockstress",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "Complete handshake, set window to 0, force server to hold buffered data indefinitely. Memory exhaustion.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Server buffers data for zero-window peers. Memory exhaustion. Hardened: socket buffer limits."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates TCP. May still affect origin if CDN forwards idle connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF buffers for zero-window clients. Shared memory with DPI engine."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects persistent zero-window. Tuned: timeout zero-window connections."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles at edge."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Firewall may not inspect window size."
        }
      },
      "prerequisites": [
        "Requires real TCP connections from bot IPs"
      ],
      "taxonomy_id": "L4-08",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_custom_flags": {
      "name": "Custom TCP Flags (XMAS/NULL)",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "Packets with unusual flag combinations (all flags=XMAS, no flags=NULL). Confuses stateful inspection.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Kernel drops invalid flags quickly. Main use is scanning/evasion, not DDoS."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops invalid TCP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "DPI engine processes each packet to classify. Tuned: drop invalid flags immediately."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops invalid TCP at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops invalid flags."
        }
      },
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (TCP mode)",
          "MHDDoS",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "Mirai variants"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_udp_flood": {
      "name": "UDP Flood",
      "layer": "l4",
      "category": "L4 UDP",
      "mechanism": "Volumetric UDP flood. Spoofed source IPs. Targets pipe bandwidth and ICMP unreachable generation.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturation. Kernel generates ICMP unreachable per packet (CPU). Hardened: iptables rate limit."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. UDP dropped at edge. Only works if origin IP known."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF drops UDP to HTTP ports but shares pipe with legitimate traffic."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware UDP rate limiting and behavioral detection."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs at edge."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall drops UDP. Pipe may still saturate."
        }
      },
      "taxonomy_id": "L4-10",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (UDP mode)",
          "MHDDoS",
          "PyFlooder"
        ],
        "intermediate": [
          "hping3 --udp",
          "nping --udp",
          "Scapy UDP()"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_udp_fragment": {
      "name": "UDP Fragmentation Flood",
      "layer": "l4",
      "category": "L4 UDP",
      "mechanism": "Fragmented UDP packets. Combines IP reassembly cost with UDP flood volume.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Same as IP fragment + UDP flood combined."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Reassembly + inspection CPU. Very expensive for DPI."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware reassembly."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall reassembly."
        }
      },
      "taxonomy_id": "L4-11",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (UDP mode)",
          "MHDDoS",
          "PyFlooder"
        ],
        "intermediate": [
          "hping3 --udp",
          "nping --udp",
          "Scapy UDP()"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_dns_torture": {
      "name": "DNS Water Torture",
      "layer": "l4",
      "category": "L4 UDP",
      "mechanism": "Random subdomain queries (rnd123.target.com) that cache cannot answer. Forces recursive resolver and authoritative DNS to process each query.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Authoritative DNS exhausted. NXDOMAIN for each random query. Hardened: DNS rate limiting, response rate limiting (RRL)."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "If DNS managed by CDN: rate limiting helps. If authoritative is separate: CDN doesn't protect DNS."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF typically doesn't inspect DNS. DNS server behind WAF still processes all queries."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Some appliances have DNS-aware mitigation. DDoS appliance can detect water torture patterns."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN may protect DNS if managed. Otherwise DNS is separate attack surface."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes DNS through. No DNS-specific mitigation."
        }
      },
      "prerequisites": [
        "Target must have authoritative DNS servers",
        "Effective against recursive resolvers too"
      ],
      "taxonomy_id": "L4-29",
      "type": "technique",
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (DNS methods)"
        ],
        "intermediate": [
          "dnsperf",
          "dnsbomb",
          "custom Scapy DNS"
        ],
        "advanced": [
          "dns_stress (DDactic planned)"
        ]
      }
    },
    "l4_isakmp_flood": {
      "name": "ISAKMP Flood (IKE)",
      "layer": "l4",
      "category": "L4 UDP",
      "mechanism": "Flood IKE/ISAKMP (UDP/500) to exhaust VPN gateway crypto processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "VPN gateway processes each IKE init. Crypto CPU exhaustion. Only if VPN exposed."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy UDP/500."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall with VPN: crypto processing on same CPU. Non-VPN: drops."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limiting IKE init."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall rate limits IKE."
        }
      },
      "prerequisites": [
        "Target must expose VPN endpoint on UDP/500"
      ],
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (UDP mode)",
          "MHDDoS",
          "PyFlooder"
        ],
        "intermediate": [
          "hping3 --udp",
          "nping --udp",
          "Scapy UDP()"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "l4_quic_flood": {
      "name": "QUIC Flood (UDP/443)",
      "layer": "l4",
      "category": "L4 UDP",
      "mechanism": "Flood QUIC Initial packets (UDP/443). Server must perform crypto handshake for each. High CPU cost.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "QUIC server processes crypto for each Initial. Hardened: retry token, connection migration limits."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN has massive QUIC capacity. Rate limiting QUIC handshakes."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF may not inspect QUIC (encrypted). Passes through to server."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Newer appliances have QUIC awareness. Older ones pass through."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes UDP/443 if QUIC enabled. No QUIC-specific mitigation."
        }
      },
      "prerequisites": [
        "Target must support QUIC/HTTP3"
      ],
      "taxonomy_id": "L4-12",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "LOIC (UDP mode)",
          "MHDDoS",
          "PyFlooder"
        ],
        "intermediate": [
          "hping3 --udp",
          "nping --udp",
          "Scapy UDP()"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C with raw sockets"
        ]
      }
    },
    "amp_ntp": {
      "name": "NTP Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "Bot sends monlist query to open NTP servers with spoofed source=victim. Amplification factor ~556x.",
      "amp_factor": 556,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Massive volume. Even small bot fleet generates Tbps-level floods."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only accepts HTTP/HTTPS. NTP UDP reflected to origin IP only works if origin exposed."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates before WAF can process. WAF is irrelevant at this volume."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Appliance drops NTP at line rate but pipe upstream may saturate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs. Origin not directly hit."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall drowns. Pipe saturates."
        }
      },
      "prerequisites": [
        "Uses bot fleet as reflectors (spoofed source IP)",
        "Requires open NTP servers with monlist enabled"
      ],
      "taxonomy_id": "L4-14",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_dns": {
      "name": "DNS Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "Bot sends ANY query to open DNS resolvers with spoofed source=victim. Amplification ~28-54x.",
      "amp_factor": 54,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Volume overwhelms pipe. Hardened: upstream ISP scrubbing helps."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only accepts HTTP. DNS reflection hits origin IP."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates. WAF irrelevant."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Hardware drops DNS responses on non-DNS ports. Pipe may still saturate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates."
        }
      },
      "prerequisites": [
        "Spoofed source IP",
        "Open DNS resolvers"
      ],
      "taxonomy_id": "L4-13",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_sip": {
      "name": "SIP Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "SIP OPTIONS to open SIP servers. Amplification ~10x.",
      "amp_factor": 10,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Lower amp factor but still effective for pipe saturation."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only accepts HTTP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Lower volume than NTP/DNS amp. WAF may handle."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Lower volume. Firewall handles."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Open SIP servers"
      ],
      "taxonomy_id": "L7-89",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_ssdp": {
      "name": "SSDP Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "M-SEARCH to UPnP devices. Amplification ~30x.",
      "amp_factor": 30,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "High volume. SSDP responses are large XML."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Pipe saturation risk."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall drops."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Open UPnP devices"
      ],
      "taxonomy_id": "L4-16",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_snmp": {
      "name": "SNMP Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "GetBulk queries to SNMP agents. Amplification ~6x.",
      "amp_factor": 6,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Volume from many reflectors."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Lower amp factor."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall drops."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "SNMP agents with public community string"
      ],
      "taxonomy_id": "L4-18",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_cldap": {
      "name": "CLDAP Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "Connectionless LDAP queries. Amplification ~56-70x.",
      "amp_factor": 70,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "High amp factor. Massive volume."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Hardware drops. Pipe may saturate upstream."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Open LDAP servers"
      ],
      "taxonomy_id": "L4-21",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_rdp": {
      "name": "RDP Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "RDP UDP transport amplification. Amplification ~85x.",
      "amp_factor": 85,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "High amp. Volume floods pipe."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Hardware drops RDP UDP."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Pipe saturates."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Exposed RDP servers with UDP transport enabled"
      ],
      "taxonomy_id": "L4-22",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_memcached": {
      "name": "Memcached Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "Memcached GET on pre-seeded keys. Amplification ~51000x. The most powerful known amplification vector.",
      "amp_factor": 51000,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "deadly",
          "notes": "51000x amplification. Single bot can generate multi-Tbps. No defense except upstream scrubbing."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only. Origin must be hidden."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "deadly",
          "notes": "Pipe dies. No on-prem device survives this volume."
        },
        "ddos_appliance": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Even 400Gbps appliances saturate. Only ISP-level scrubbing helps."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs. If origin IP known, deadly."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "deadly",
          "notes": "Pipe dies."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Open memcached servers (increasingly rare)"
      ],
      "taxonomy_id": "L4-15",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_middlebox": {
      "name": "Middlebox Reflection",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "TCP packets to censorship middleboxes that inject HTML block pages. Amplification varies.",
      "amp_factor": 100,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Variable amp. Block pages can be large."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Lower volume than DNS/NTP amp."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall drops."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Nation-state middleboxes in path"
      ],
      "taxonomy_id": "L4-28",
      "type": "technique",
      "tool_category": "middlebox-research",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_chargen": {
      "name": "CharGen Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "CharGen (port 19) reflection. Amplification ~358x.",
      "amp_factor": 358,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "High amp. Rare reflectors now."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Open CharGen servers (very rare)"
      ],
      "taxonomy_id": "L4-17",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_wsd": {
      "name": "WS-Discovery Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "WSD Probe to IoT devices. Amplification ~153x.",
      "amp_factor": 153,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "IoT reflectors abundant. High volume."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Pipe saturation risk."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Pipe saturates."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "WSD-enabled IoT devices"
      ],
      "taxonomy_id": "L4-23",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_mdns": {
      "name": "mDNS Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "mDNS queries to .local resolvers. Amplification ~2-10x.",
      "amp_factor": 10,
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Low amp factor. Need many reflectors."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Low volume. WAF handles."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Trivial for hardware."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Low volume."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Exposed mDNS responders (usually LAN only)"
      ],
      "taxonomy_id": "L4-24",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_coap": {
      "name": "CoAP Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "CoAP GET to IoT devices. Amplification ~32x.",
      "amp_factor": 32,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "IoT reflectors growing. Moderate volume."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Moderate volume."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Moderate volume."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Exposed CoAP devices"
      ],
      "taxonomy_id": "L4-25",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "amp_arms": {
      "name": "ARMS Amplification",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "Apple Remote Management Service (UDP/3283). Amplification ~35x.",
      "amp_factor": 35,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Moderate volume. Apple devices as reflectors."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN HTTP only."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Moderate volume."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Moderate volume."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Exposed Apple ARMS services"
      ],
      "taxonomy_id": "L4-26",
      "type": "technique",
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "l7_http_get": {
      "name": "HTTP GET Flood",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "High-rate HTTP GET requests with valid browser fingerprints. Each request requires full application processing (DB queries, template rendering, etc.).",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Origin processes every request. Hardened: connection limits, worker timeouts, caching."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN caches static. Dynamic requests pass through. Tuned: rate limiting, bot detection. Hardened: challenge pages, behavioral analysis."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DPI processes each GET. CPU collapses under volume. Tuned: rate limit rules. Hardened: DoS profiles."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection identifies GET flood patterns. Default: may pass if pattern matches legitimate. Hardened: trained baseline."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN absorbs cache hits. Cache misses hit appliance. Rate limiting at both layers."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Rate limiting helps."
        }
      },
      "taxonomy_id": "L7-01",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http_post": {
      "name": "HTTP POST Flood",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "HTTP POST with valid payloads. Not cacheable - every request hits origin. Targets auth endpoints, forms, APIs.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "POSTs always hit origin (uncacheable). DB writes, auth checks per request."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes POST to origin. Default: no rate limit on POSTs. Tuned: per-endpoint rate limits."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DPI inspects POST body (SQL injection, XSS check). Massive CPU per request."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects POST flood patterns. Hardened: baseline for normal POST rate per endpoint."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN forwards POST. Appliance behavioral detection."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP POST. Rate limiting helps."
        }
      },
      "taxonomy_id": "L7-02",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http_head": {
      "name": "HTTP HEAD Flood",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "HTTP HEAD requests. Server processes request but sends no body. Lower bandwidth but same server-side processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Server processes full request logic for HEAD."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN can cache HEAD responses. Rate limiting."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DPI processes each HEAD."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN + appliance layers."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Same as GET flood."
        }
      },
      "taxonomy_id": "L7-03",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http_options": {
      "name": "HTTP OPTIONS Flood",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "HTTP OPTIONS flood. Often returns allowed methods. Some WAFs don't filter OPTIONS.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Server processes OPTIONS."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN may cache or rate limit OPTIONS."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Some WAFs ignore OPTIONS (CORS preflight). May bypass rate limits."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "taxonomy_id": "L7-04",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_large_download": {
      "name": "Large File Download",
      "layer": "l7",
      "category": "L7 Resource",
      "mechanism": "Repeatedly download large files (PDFs, images, ZIPs). Forces server to read from disk, hold memory, and transmit. With uncompressed + cache bust, bypasses CDN and forces raw transfer.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Disk I/O + bandwidth exhaustion. Each connection holds server memory for file buffer."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN caches files at edge. With cache bust: deadly (origin pull for each request). Without: CDN serves from cache."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "DPI buffers entire file in memory for inspection. on-prem WAF especially vulnerable. Tuned: skip DPI for known file types."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Hardware handles bandwidth. But with cache bust, still hits origin backend."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN caches. Cache bust bypasses. Appliance sees origin load."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. Bandwidth exhaustion."
        }
      },
      "prerequisites": [
        "Large files must exist on target (discovered by recon)",
        "Cache bust techniques needed to bypass CDN"
      ],
      "taxonomy_id": "L7-21",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_search_flood": {
      "name": "Search Query Flood",
      "layer": "l7",
      "category": "L7 Resource",
      "mechanism": "Flood search endpoints with complex/random queries. Each query hits database with full-text search, regex, or LIKE operations.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "DB CPU exhaustion from complex queries. Hardened: query timeout, result limit."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Search not cacheable (random queries). CDN passes to origin. Tuned: rate limit search endpoint."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI + origin DB both exhausted. Double CPU hit."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects high search rate from distributed IPs. Hardened: per-URL rate limits."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN can't cache search. Appliance behavioral detection."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes. DB exhaustion."
        }
      },
      "prerequisites": [
        "Search endpoint must exist (discovered by recon)"
      ],
      "taxonomy_id": "L7-37",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_api_flood": {
      "name": "API Rate Abuse",
      "layer": "l7",
      "category": "L7 Resource",
      "mechanism": "High-rate API calls. APIs typically uncacheable, each hit triggers business logic, DB queries, external service calls.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "API backend overwhelmed. Hardened: API gateway rate limiting."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes API calls through. Default: no API-specific rate limits. Tuned: per-API key rate limits."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF inspects API payload (JSON/XML). CPU intensive. Tuned: API-aware rate limits."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects API flood. Hardened: per-endpoint baselines."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes API. Appliance detects."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes API."
        }
      },
      "prerequisites": [
        "API endpoint must exist (discovered by recon)"
      ],
      "taxonomy_id": "L7-118",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_login_flood": {
      "name": "Login/Auth Flood",
      "layer": "l7",
      "category": "L7 Resource",
      "mechanism": "Flood login endpoints. Each attempt triggers auth backend (LDAP/AD query, password hash comparison, MFA check).",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Auth backend (LDAP, DB) overwhelmed. Hardened: account lockout, CAPTCHA."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Login POST uncacheable. Default: no login rate limit. Tuned: rate limit + CAPTCHA after N failures."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF DPI on each login POST + auth backend load. Tuned: brute force protection."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects login flood pattern."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes. Appliance detects."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes. Auth backend floods."
        }
      },
      "prerequisites": [
        "Login endpoint must exist (discovered by recon)"
      ],
      "taxonomy_id": "L7-36",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_ato_credential_stuff": {
      "name": "ATO Credential Stuffing",
      "alias_of": "l7_login_flood",
      "layer": "l7",
      "category": "L7 ATO",
      "mechanism": "Replay breach-sourced username/password pairs against login endpoints, rotating source IPs (residential proxy pool) and timing to evade velocity caps. Builds on login-flood plumbing but trades volume for validity: each request attempts a REAL credential pair against a real account.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "No velocity controls = full compromise. Hardened: account lockout + MFA."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN bot-management sees suspicious login pattern. Hardened: behavioural scoring + device fingerprint + per-user velocity."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF can flag repeated failed logins per source, but residential rotation defeats per-IP rules."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "DDoS appliances focus on volume, not credential correlation. Most pass through."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Only the CDN layer has bot-management context; appliance does not help."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall has no credential-abuse visibility."
        }
      },
      "prerequisites": [
        "Login endpoint discovered (HAR/mobile capture)",
        "Breach credentials available for this domain (HIBP/DeHashed/LeakCheck)",
        "Sanctioned test accounts for tier 2+ execution"
      ],
      "taxonomy_id": "L7-120",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "OpenBullet",
          "SentryMBA",
          "SNIPR"
        ],
        "intermediate": [
          "Hydra",
          "patator",
          "Turbo Intruder"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "Playwright fleet + anti-bot plugins"
        ]
      }
    },
    "l7_ato_password_spray": {
      "name": "ATO Password Spray",
      "alias_of": "l7_login_flood",
      "layer": "l7",
      "category": "L7 ATO",
      "mechanism": "Low-rate spray: ONE common password (e.g. Winter2026!) across MANY usernames, slow enough to stay below per-account velocity thresholds. Opposite of credential stuffing: volume of users, not volume of passwords.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "No per-user or per-IP rate limit = compromise a % of accounts with weak passwords."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Bot-management may flag the pattern; spray typically below per-IP thresholds. Hardened: behavioural correlation across source IPs."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF typically measures per-IP, not per-password-across-users."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Out of scope - spray is not volumetric."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Only cloud bot-management has cross-IP correlation context."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall has no user-account correlation."
        }
      },
      "prerequisites": [
        "Login endpoint discovered",
        "Username enumeration feasible (directory harvest, breach dumps, LinkedIn scrape)",
        "Sanctioned test accounts for validation"
      ],
      "taxonomy_id": "L7-121",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "Manual curl loops"
        ],
        "intermediate": [
          "MSOLSpray",
          "Spray365",
          "kerbrute"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "Playwright fleet per-account sessions"
        ]
      }
    },
    "l7_graphql_complex": {
      "name": "GraphQL Complexity",
      "layer": "l7",
      "category": "L7 Resource",
      "mechanism": "Deeply nested GraphQL queries that cause exponential server-side processing. Single request can trigger millions of DB joins.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Exponential complexity. Single query can down a server. Hardened: query depth/cost limits."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes GraphQL POST. Default: no query analysis. Tuned: depth limits at CDN WAF level."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI on GraphQL body + origin processes complex query. Few WAFs understand GraphQL nesting."
        },
        "ddos_appliance": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand GraphQL. Passes through. Hardened: response time anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands GraphQL complexity by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Firewall passes. Server processes."
        }
      },
      "prerequisites": [
        "GraphQL endpoint must exist (discovered by recon)"
      ],
      "taxonomy_id": "L7-79",
      "type": "technique",
      "tool_category": "graphql-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "graphql-cop",
          "InQL (Burp)"
        ],
        "advanced": [
          "GraphQL stress toolkit",
          "custom batching/nesting scripts"
        ]
      }
    },
    "l7_http_bomb": {
      "name": "HTTP Decompression Bomb",
      "layer": "l7",
      "category": "L7 Resource",
      "mechanism": "Send gzip-compressed POST payload that expands to enormous size. Server decompresses in memory.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Server decompresses gzip. Memory exhaustion. Hardened: decompress limit."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN may decompress or pass through. Tuned: body size limits."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF decompresses for DPI. Memory bomb hits WAF before origin. Very effective against DPI."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Appliance may not decompress. Passes through."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN body size limits."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "prerequisites": [
        "Target must accept gzip Content-Encoding on POST"
      ],
      "taxonomy_id": "L7-24",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_random_path": {
      "name": "Random Path Flood",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "GET requests to random paths (/abc123, /xyz789). Forces application routing, 404 processing, logging. Uncacheable.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application processes each path. 404 handlers often expensive (DB lookup, template render)."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN can cache 404s (default: often not). Tuned: cache 404, rate limit high-404-rate IPs."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DPI processes each request. Random paths avoid URL-specific rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects high 404 rate."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN + appliance layers."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "taxonomy_id": "L7-05",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_cache_bust": {
      "name": "Cache Bust Attack",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Append random query parameters (?_=random) to force CDN cache MISS. Every request hits origin. CDN becomes expensive pass-through.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "No CDN to bust, but random params still bypass application-level caching."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DEFAULT: CDN caches by full URL including query string. Random params = 100% miss rate. Tuned: ignore query params for caching. Hardened: sort/normalize query params."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF doesn't cache. All requests hit origin regardless."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Appliance doesn't cache. But behavioral detection of high unique-URL rate."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Cache bust bypasses CDN layer. All requests hit appliance and origin."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "No caching layer."
        }
      },
      "prerequisites": [
        "CDN must cache by query string (most do by default)",
        "Technique: append random ?_=timestamp to each request"
      ],
      "taxonomy_id": "L7-06",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_redos": {
      "name": "ReDoS",
      "layer": "l7",
      "category": "L7 Resource",
      "mechanism": "Craft input that triggers catastrophic backtracking in server-side regex. Single request can consume 100% CPU for seconds.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Application regex processes input. Hardened: regex timeout, RE2 engine."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes to origin. Default: no regex analysis. Tuned: rate limit POST endpoints."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "deadly",
          "notes": "WAF's OWN regex rules may be vulnerable to ReDoS. Ironic: the WAF can be the victim."
        },
        "ddos_appliance": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance passes through. Origin processes regex. Hardened: response time anomaly."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither layer understands regex complexity."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Firewall passes. Application processes."
        }
      },
      "prerequisites": [
        "Vulnerable regex pattern on target (discovered by fuzzing)"
      ],
      "taxonomy_id": "L7-35",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http2_rapid_reset": {
      "name": "HTTP/2 Rapid Reset (CVE-2023-44487)",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Open HTTP/2 stream and immediately RST_STREAM. Server allocates resources for stream but client cancels before response. Thousands of streams per connection.",
      "cve": "CVE-2023-44487",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Unpatched servers extremely vulnerable. Hardened: patched + stream concurrency limits."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Major CDNs patched Oct 2023. CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF HTTP/2 stack may be vulnerable itself. Few WAFs properly track rapid stream resets."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects rapid reset pattern. Older: vulnerable."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2",
        "Unpatched servers most vulnerable"
      ],
      "taxonomy_id": "L7-44",
      "type": "cve",
      "cve_id": "CVE-2023-44487",
      "patched_since": "2023-10",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http2_continuation": {
      "name": "HTTP/2 CONTINUATION Flood (CVE-2024-27316)",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Send HEADERS frame without END_HEADERS flag, followed by many CONTINUATION frames. Server must buffer all headers before processing.",
      "cve": "CVE-2024-27316",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Unpatched Apache/nginx/Go extremely vulnerable. Memory exhaustion."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2. Major CDNs patched early 2024."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF HTTP/2 parser may be vulnerable itself. Memory exhaustion from header buffering."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware limits CONTINUATION frames."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2",
        "Unpatched servers"
      ],
      "taxonomy_id": "L7-48",
      "type": "cve",
      "cve_id": "CVE-2024-27316",
      "patched_since": "2024-04",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http2_ping": {
      "name": "HTTP/2 PING Flood",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Flood HTTP/2 PING frames. Server must respond to each PING immediately. Disrupts frame scheduling.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Server CPU on PING responses. Hardened: PING rate limit."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN limits PING rate per connection."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF handles PING at TCP level."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "taxonomy_id": "L7-45",
      "type": "cve",
      "cve_id": "CVE-2019-9512",
      "patched_since": "2019-08",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http2_settings": {
      "name": "HTTP/2 SETTINGS Flood",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Flood SETTINGS frames requiring ACK. Each requires processing and ACK response.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CPU on SETTINGS processing."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN limits SETTINGS rate."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF processes SETTINGS."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "taxonomy_id": "L7-46",
      "type": "cve",
      "cve_id": "CVE-2019-9515",
      "patched_since": "2019-08",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http2_empty": {
      "name": "HTTP/2 Empty Frame Flood",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Flood empty DATA frames on open streams. Forces frame processing without payload.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Frame processing overhead. Lower impact than other H2 vectors."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops empty frames."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Frame processing."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "taxonomy_id": "L7-47",
      "type": "cve",
      "cve_id": "CVE-2019-9518",
      "patched_since": "2019-08",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_quic_initial": {
      "name": "QUIC Initial Flood",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Flood QUIC Initial packets. Server performs TLS 1.3 handshake + crypto for each. High CPU cost per packet.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Crypto handshake per Initial. CPU exhaustion. Hardened: retry token, address validation."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN has massive QUIC capacity + rate limiting."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF cannot inspect QUIC (encrypted). Passes through."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Newer appliances: QUIC-aware rate limiting. Older: pass through."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes UDP/443."
        }
      },
      "prerequisites": [
        "Target must support QUIC/HTTP3"
      ],
      "taxonomy_id": "L7-56",
      "type": "design_vector",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_quic_cid": {
      "name": "QUIC Connection ID Exhaustion",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Exhaust QUIC connection ID space. Each CID requires server state.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "State table exhaustion."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN manages CID at scale."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't manage QUIC CIDs."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CID tracking if QUIC-aware."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Passes through."
        }
      },
      "prerequisites": [
        "Target must support QUIC"
      ],
      "taxonomy_id": "L7-57",
      "type": "design_vector",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_quic_version": {
      "name": "QUIC Version Negotiation Abuse",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Send unknown QUIC version. Server responds with Version Negotiation packet. Amplification from server responses.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Server CPU on version negotiation. Low amp factor."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Passes through."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Passes."
        }
      },
      "prerequisites": [
        "Target must support QUIC"
      ],
      "taxonomy_id": "L7-58",
      "type": "design_vector",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_quic_ack": {
      "name": "QUIC ACK Manipulation",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Send manipulated ACK frames to confuse congestion control. Can cause server to retransmit or stall.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Congestion control confusion. Service degradation."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Passes through."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "QUIC awareness."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Passes."
        }
      },
      "prerequisites": [
        "Active QUIC connection required"
      ],
      "taxonomy_id": "L7-60",
      "type": "design_vector",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_quic_malformed": {
      "name": "QUIC Malformed Frame Flood",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Flood malformed QUIC frames. Server must parse and error-handle each.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Error handling overhead."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops malformed."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Passes through."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Drops malformed."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Passes."
        }
      },
      "prerequisites": [
        "Target must support QUIC"
      ],
      "taxonomy_id": "L7-61",
      "type": "design_vector",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_quic_0rtt": {
      "name": "QUIC 0-RTT Replay",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Replay 0-RTT data from captured handshake. Server processes request before authentication completes. Amplification without own crypto cost.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "0-RTT replay skips handshake. Server processes captured requests. Hardened: 0-RTT disabled or limited."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN limits 0-RTT replay."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF can't distinguish replay from legitimate 0-RTT."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection of replayed requests."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN handles 0-RTT."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Passes through."
        }
      },
      "prerequisites": [
        "Target must support QUIC 0-RTT",
        "Requires captured handshake session ticket"
      ],
      "taxonomy_id": "L7-62",
      "type": "design_vector",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_http3_headers": {
      "name": "HTTP/3 HEADERS Flood",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Flood HTTP/3 HEADERS frames over QUIC. Each requires QPACK decompression + request processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "QPACK decompression + request processing. Newer attack surface."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/3."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF doesn't inspect HTTP/3. Passes through."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Limited HTTP/3 awareness."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Passes through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/3"
      ],
      "taxonomy_id": "L7-63",
      "type": "design_vector",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_quic_reflect": {
      "name": "QUIC Reflection",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Spoofed QUIC Initial to servers, causing Retry or Version Negotiation responses sent to victim. Low amp factor (~3-5x).",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Low amplification. Needs many reflectors."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN drops unsolicited QUIC responses."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Low volume."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Low volume."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "QUIC-enabled servers as reflectors"
      ],
      "taxonomy_id": "L7-59",
      "type": "design_vector",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "slow_slowloris": {
      "name": "Slowloris",
      "layer": "l7",
      "category": "Low & Slow",
      "mechanism": "Open HTTP connections and send headers very slowly (one byte/sec). Never completes request. Holds connection slots indefinitely.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Apache/nginx connection pool exhausted. 10K connections = server down. Hardened: aggressive header timeout (5s)."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates slow connections with strict timeouts (typically 30s header timeout)."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with IPS/AV. Drains much faster than rated. Tuned: header timeout."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects connections with incomplete headers. Large connection table (40M+). Hardened: idle connection cleanup."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout kills slow connections."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP."
        }
      },
      "taxonomy_id": "L7-11",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "Torshammer",
          "slowloris.py (GitHub)"
        ],
        "intermediate": [
          "slowhttptest (Qualys)",
          "SlowHTTPTest",
          "PySlowLoris"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom async Python"
        ]
      }
    },
    "slow_slow_post": {
      "name": "Slow POST",
      "layer": "l7",
      "category": "Low & Slow",
      "mechanism": "Send POST with large Content-Length, then drip body byte-by-byte. Server holds thread/worker waiting for complete body.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Worker threads blocked waiting for body. Hardened: body receive timeout."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN body receive timeout (typically 60s). Buffers before forwarding to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF buffers POST body for DPI. Memory + connection held. Shared resources drain."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects slow body rate. Connection timeout."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN buffers body."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "taxonomy_id": "L7-12",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "Torshammer",
          "slowloris.py (GitHub)"
        ],
        "intermediate": [
          "slowhttptest (Qualys)",
          "SlowHTTPTest",
          "PySlowLoris"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom async Python"
        ]
      }
    },
    "slow_rudy": {
      "name": "R.U.D.Y.",
      "layer": "l7",
      "category": "Low & Slow",
      "mechanism": "POST to forms with Content-Type: application/x-www-form-urlencoded, send one form field byte at a time. Apache specifically vulnerable.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Apache mod_cgi holds thread per connection. Same as Slow POST but form-specific."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Same as Slow POST."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "prerequisites": [
        "Target must accept form POST"
      ],
      "taxonomy_id": "L7-12",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "Torshammer",
          "slowloris.py (GitHub)"
        ],
        "intermediate": [
          "slowhttptest (Qualys)",
          "SlowHTTPTest",
          "PySlowLoris"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom async Python"
        ]
      }
    },
    "slow_slow_read": {
      "name": "Slow Read",
      "layer": "l7",
      "category": "Low & Slow",
      "mechanism": "Request large response, then read at 10 bytes/sec (tiny TCP window). Server holds send buffer and connection open.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Server buffers response in memory. Combined with LFD = massive memory hold."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN may buffer response. But CDN-to-client connection still held. Tuned: client send timeout."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF buffers response for DPI. Memory exhaustion. Shared with IPS/AV."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects zero/tiny window connections. Send timeout."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN may buffer."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "prerequisites": [
        "Large response available (LFD target from recon)"
      ],
      "taxonomy_id": "L7-13",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "Torshammer",
          "slowloris.py (GitHub)"
        ],
        "intermediate": [
          "slowhttptest (Qualys)",
          "SlowHTTPTest",
          "PySlowLoris"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom async Python"
        ]
      }
    },
    "slow_tls_renegotiation": {
      "name": "TLS Renegotiation",
      "layer": "l7",
      "category": "Low & Slow",
      "mechanism": "Repeatedly initiate TLS renegotiation on established connections. Server does ~15x more crypto work than client.",
      "cve": "CVE-2009-3555",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CPU exhaustion from repeated key exchange. Hardened: disable renegotiation (TLS 1.3 has no renegotiation)."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates TLS. Renegotiation limited or disabled."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF SSL offload CPU. Renegotiation multiplies crypto cost. Tuned: limit renegotiation count."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Hardware SSL offload. Rate limit renegotiation. TLS 1.3: no renegotiation."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates TLS."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall TLS inspection CPU."
        }
      },
      "prerequisites": [
        "Target must support TLS 1.2 or older (TLS 1.3 removed renegotiation)"
      ],
      "taxonomy_id": "L7-65",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "Torshammer",
          "slowloris.py (GitHub)"
        ],
        "intermediate": [
          "slowhttptest (Qualys)",
          "SlowHTTPTest",
          "PySlowLoris"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom async Python"
        ]
      }
    },
    "slow_tls_reconnection": {
      "name": "TLS Reconnection Flood",
      "layer": "l7",
      "category": "Low & Slow",
      "mechanism": "Rapidly connect/disconnect TLS. Each handshake costs server CPU (ECDHE key exchange). Client reuses session ticket, server may not.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Each new handshake = ECDHE computation. Hardened: session resumption, handshake rate limit."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN has massive TLS capacity."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF SSL offload CPU. Each handshake expensive."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Hardware SSL acceleration. Rate limit new TLS handshakes."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates TLS."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall TLS inspection."
        }
      },
      "taxonomy_id": "L7-64",
      "type": "technique",
      "tool_category": "raw-socket-l3l4",
      "common_tools": {
        "script_kiddie": [
          "Torshammer",
          "slowloris.py (GitHub)"
        ],
        "intermediate": [
          "slowhttptest (Qualys)",
          "SlowHTTPTest",
          "PySlowLoris"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom async Python"
        ]
      }
    },
    "slow_http2_window": {
      "name": "HTTP/2 Slow Read (Window Exhaustion)",
      "layer": "l7",
      "category": "Low & Slow",
      "mechanism": "Set HTTP/2 flow control window to 0 (or very small). Server buffers response data. Memory exhaustion similar to TCP slow read but at HTTP/2 stream level.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Server buffers per-stream. Many streams x large responses = memory exhaustion."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN may enforce stream window minimums. Tuned: stream timeout."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 buffer memory shared with DPI engine."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects zero-window streams. Timeout."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN may buffer."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Passes through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "taxonomy_id": "L7-49",
      "type": "design_vector",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "slow_empty_connection": {
      "name": "Empty TCP Connection Flood",
      "layer": "l7",
      "category": "Low & Slow",
      "mechanism": "Complete TCP handshake, keep connection open, never send data. Exhaust server connection slots without triggering request-level monitoring.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Connection table exhaustion. Hardened: aggressive idle timeout (10s)."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN idle timeout kills empty connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared. Idle connections still consume slots."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects connections with no data. Large table helps."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall connection table."
        }
      },
      "prerequisites": [
        "Requires real TCP connections from bot IPs"
      ],
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "Torshammer",
          "slowloris.py (GitHub)"
        ],
        "intermediate": [
          "slowhttptest (Qualys)",
          "SlowHTTPTest",
          "PySlowLoris"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom async Python"
        ]
      }
    },
    "sip_invite": {
      "name": "SIP INVITE Flood",
      "layer": "protocol",
      "category": "L7 SIP",
      "mechanism": "Flood SIP INVITE to VoIP servers. Each INVITE triggers call setup processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "SIP server processes each INVITE (session creation, auth, codec negotiation)."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SIP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "WAF may inspect SIP if configured. Most don't."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "SIP-aware appliances rate limit INVITE."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SIP."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall can rate limit SIP."
        }
      },
      "prerequisites": [
        "Target must run SIP server (UDP/5060 or TCP/5060)"
      ],
      "taxonomy_id": "L7-84",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "SIPVicious",
          "sipp",
          "Opal VoIP tester"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom SIP with evasion"
        ]
      }
    },
    "sip_bye": {
      "name": "SIP BYE Flood",
      "layer": "protocol",
      "category": "L7 SIP",
      "mechanism": "Spoofed BYE to tear down active calls.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Active calls terminated. Hardened: strict session validation."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SIP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "WAF may inspect."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Session validation."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Target must run SIP server"
      ],
      "taxonomy_id": "L7-85",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "SIPVicious",
          "sipp",
          "Opal VoIP tester"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom SIP with evasion"
        ]
      }
    },
    "sip_register": {
      "name": "SIP REGISTER Flood",
      "layer": "protocol",
      "category": "L7 SIP",
      "mechanism": "Flood REGISTER to exhaust registrar database and auth processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Registrar DB overwhelmed. Auth processing per REGISTER."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SIP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "WAF may inspect."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit REGISTER."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Target must run SIP registrar"
      ],
      "taxonomy_id": "L7-86",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "SIPVicious",
          "sipp",
          "Opal VoIP tester"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom SIP with evasion"
        ]
      }
    },
    "sip_options": {
      "name": "SIP OPTIONS Flood",
      "layer": "protocol",
      "category": "L7 SIP",
      "mechanism": "Flood SIP OPTIONS. Low overhead but still requires server processing.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Lightweight. Mainly useful for reconnaissance/scanning."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SIP."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Low overhead."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Trivial."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Target must run SIP server"
      ],
      "taxonomy_id": "L7-87",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "SIPVicious",
          "sipp",
          "Opal VoIP tester"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom SIP with evasion"
        ]
      }
    },
    "sip_cancel": {
      "name": "SIP CANCEL Flood",
      "layer": "protocol",
      "category": "L7 SIP",
      "mechanism": "Cancel pending INVITEs to waste processing.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Cancel processing."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SIP."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Low overhead."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Trivial."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Target must run SIP server"
      ],
      "taxonomy_id": "L7-88",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "SIPVicious",
          "sipp",
          "Opal VoIP tester"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom SIP with evasion"
        ]
      }
    },
    "sip_reflect": {
      "name": "SIP Amplification",
      "layer": "protocol",
      "category": "L7 SIP",
      "mechanism": "Spoofed SIP OPTIONS to open SIP servers. Amplification ~10x.",
      "amp_factor": 10,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Volume from many reflectors."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SIP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Lower amp factor."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Lower volume."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Open SIP servers as reflectors"
      ],
      "taxonomy_id": "L7-89",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "SIPVicious",
          "sipp",
          "Opal VoIP tester"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom SIP with evasion"
        ]
      }
    },
    "sip_malformed": {
      "name": "SIP Malformed Request",
      "layer": "protocol",
      "category": "L7 SIP",
      "mechanism": "Malformed SIP messages to crash parser or trigger error handling.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Parser error handling."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SIP."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "WAF drops malformed."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Drops malformed."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Drops."
        }
      },
      "prerequisites": [
        "Target must run SIP server"
      ],
      "taxonomy_id": "L7-90",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "SIPVicious",
          "sipp",
          "Opal VoIP tester"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom SIP with evasion"
        ]
      }
    },
    "smtp_rcpt": {
      "name": "SMTP RCPT TO Flood",
      "layer": "protocol",
      "category": "L7 SMTP",
      "mechanism": "Flood RCPT TO to mail server. Each recipient requires address validation (LDAP/DB lookup).",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "LDAP/DB lookup per recipient. Hardened: recipient rate limit, greylisting."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SMTP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall rate limits SMTP connections."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "SMTP-aware rate limiting."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SMTP."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Target must run SMTP server (port 25/587)"
      ],
      "taxonomy_id": "L7-91",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "swaks",
          "smtp-user-enum",
          "custom Python smtplib"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "smtp_ehlo": {
      "name": "SMTP EHLO Flood",
      "layer": "protocol",
      "category": "L7 SMTP",
      "mechanism": "Rapid SMTP connection + EHLO to exhaust connection slots.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Connection slot exhaustion. Lower impact than RCPT flood."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SMTP."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit connections."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Trivial to detect."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Target must run SMTP server"
      ],
      "taxonomy_id": "L7-92",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "swaks",
          "smtp-user-enum",
          "custom Python smtplib"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "smtp_data": {
      "name": "SMTP DATA Flood",
      "layer": "protocol",
      "category": "L7 SMTP",
      "mechanism": "Send large email messages. Server stores to disk, runs content filter, AV scan.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Disk I/O + content filter CPU. Hardened: message size limit, rate limit."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SMTP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Content filter CPU."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit messages."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Target must run SMTP server"
      ],
      "taxonomy_id": "L7-93",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "swaks",
          "smtp-user-enum",
          "custom Python smtplib"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "smtp_auth": {
      "name": "SMTP AUTH Flood",
      "layer": "protocol",
      "category": "L7 SMTP",
      "mechanism": "Flood SMTP AUTH. Each attempt triggers auth backend (LDAP/AD).",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Auth backend exhaustion. Hardened: auth rate limit, fail2ban."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SMTP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit auth."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Auth rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Target must run SMTP server with auth"
      ],
      "taxonomy_id": "L7-94",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "swaks",
          "smtp-user-enum",
          "custom Python smtplib"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "smtp_bounce": {
      "name": "SMTP Bounce Flood",
      "layer": "protocol",
      "category": "L7 SMTP",
      "mechanism": "Send mail to non-existent recipients. Server generates NDR (bounce) messages to spoofed sender.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "NDR generation CPU + disk. Hardened: disable NDR for unknown senders."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SMTP."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Trivial."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Target must run SMTP server"
      ],
      "taxonomy_id": "L7-95",
      "type": "technique",
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "swaks",
          "smtp-user-enum",
          "custom Python smtplib"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "smtp_backscatter": {
      "name": "SMTP Backscatter",
      "layer": "protocol",
      "category": "L7 SMTP",
      "mechanism": "Spoofed sender=victim, send to servers that generate bounces TO the victim. Indirect flood.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Bounce messages flood victim's MX. Lower volume than direct."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SMTP."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "SMTP rate limit."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Trivial volume."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Low volume."
        }
      },
      "prerequisites": [
        "Victim must have MX records",
        "Third-party SMTP servers as reflectors"
      ],
      "taxonomy_id": "L7-96",
      "type": "technique",
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "swaks",
          "smtp-user-enum",
          "custom Python smtplib"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "ssh_handshake": {
      "name": "SSH Handshake Flood",
      "layer": "protocol",
      "category": "L7 Remote Access",
      "mechanism": "Rapid SSH connection initiation. Each handshake requires DH key exchange (CPU intensive).",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DH key exchange CPU. Hardened: MaxStartups, fail2ban."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SSH."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall rate limits SSH."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SSH."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "SSH must be exposed (port 22)"
      ],
      "taxonomy_id": "L7-97",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "Hydra",
          "Medusa",
          "ncrack"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/crypto/ssh"
        ]
      }
    },
    "ssh_auth": {
      "name": "SSH Auth Flood",
      "layer": "protocol",
      "category": "L7 Remote Access",
      "mechanism": "Brute force SSH authentication. Each attempt triggers PAM/LDAP auth.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Auth backend exhaustion. Hardened: key-only auth, fail2ban."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SSH."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy SSH."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "SSH must be exposed with password auth enabled"
      ],
      "taxonomy_id": "L7-98",
      "type": "technique",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "Hydra",
          "Medusa",
          "ncrack"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/crypto/ssh"
        ]
      }
    },
    "rdp_flood": {
      "name": "RDP Connection Flood",
      "layer": "protocol",
      "category": "L7 Remote Access",
      "mechanism": "Flood RDP connection initiation. TLS + CredSSP handshake CPU cost.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "RDP handshake CPU. Hardened: NLA, rate limit."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy RDP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall rate limits."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "RDP must be exposed (port 3389)"
      ],
      "taxonomy_id": "L7-99",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "Crowbar",
          "Hydra -s 3389"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "rdp_reflect": {
      "name": "RDP Amplification",
      "layer": "protocol",
      "category": "L7 Remote Access",
      "mechanism": "RDP UDP transport amplification ~85x.",
      "amp_factor": 85,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "High amp. Volume."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy RDP."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Pipe saturation risk."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Hardware drops RDP UDP."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Pipe saturation."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Exposed RDP servers with UDP enabled"
      ],
      "taxonomy_id": "L7-100",
      "type": "technique",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "Crowbar",
          "Hydra -s 3389"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "telnet_flood": {
      "name": "Telnet Flood",
      "layer": "protocol",
      "category": "L7 Remote Access",
      "mechanism": "Flood telnet connection attempts. Low resource cost to attacker.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Connection exhaustion. Hardened: disable telnet."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy telnet."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Telnet must be exposed (port 23)"
      ],
      "taxonomy_id": "L7-101",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "ncat",
          "custom Python socket"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "ldap_query": {
      "name": "LDAP Query Flood",
      "layer": "protocol",
      "category": "L7 Directory",
      "mechanism": "Flood complex LDAP queries. Each requires directory tree traversal.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Directory CPU from complex queries. Hardened: query complexity limits."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy LDAP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit LDAP."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "LDAP must be exposed (port 389/636)"
      ],
      "taxonomy_id": "L7-102",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "ldapsearch in a loop",
          "JXplorer"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "cldap_reflect": {
      "name": "CLDAP Amplification",
      "layer": "protocol",
      "category": "L7 Directory",
      "mechanism": "Connectionless LDAP amplification ~56-70x. Duplicate of amp_cldap for protocol category.",
      "amp_factor": 70,
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "High amp. See amp_cldap."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Hardware drops."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN absorbs."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates."
        }
      },
      "prerequisites": [
        "Spoofed source",
        "Open LDAP servers"
      ],
      "taxonomy_id": "L7-103",
      "type": "technique",
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "ldapsearch in a loop",
          "JXplorer"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "ldap_bind": {
      "name": "LDAP Bind Flood",
      "layer": "protocol",
      "category": "L7 Directory",
      "mechanism": "Flood LDAP bind (auth) requests. Each triggers password validation.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Auth processing per bind. Hardened: rate limit, account lockout."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy LDAP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "LDAP must be exposed"
      ],
      "taxonomy_id": "L7-104",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "ldapsearch in a loop",
          "JXplorer"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "mqtt_connect": {
      "name": "MQTT CONNECT Flood",
      "layer": "protocol",
      "category": "L7 IoT",
      "mechanism": "Flood MQTT CONNECT to broker. Each connection requires auth + session state.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Broker connection table exhaustion. Hardened: max connections, auth rate limit."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy MQTT."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall rate limits."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "MQTT broker must be exposed (port 1883/8883)"
      ],
      "taxonomy_id": "L7-105",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "mosquitto_pub",
          "mqtt-fuzz"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "mqtt_publish": {
      "name": "MQTT PUBLISH Flood",
      "layer": "protocol",
      "category": "L7 IoT",
      "mechanism": "Flood MQTT PUBLISH messages. Broker must route to all subscribers.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Broker CPU + memory for message routing. Hardened: message rate limit, ACL."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy MQTT."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "MQTT broker must be exposed",
        "Must authenticate or broker allows anonymous"
      ],
      "taxonomy_id": "L7-106",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "mosquitto_pub",
          "mqtt-fuzz"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "coap_flood": {
      "name": "CoAP Request Flood",
      "layer": "protocol",
      "category": "L7 IoT",
      "mechanism": "Flood CoAP requests to IoT devices. UDP-based, each requires processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "IoT device overwhelmed. Limited CPU/memory."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy CoAP."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Low volume needed."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Trivial."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "CoAP device must be exposed (UDP/5683)"
      ],
      "taxonomy_id": "L7-107",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "ncat",
          "custom Python socket"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "modbus_read": {
      "name": "Modbus Read Flood",
      "layer": "protocol",
      "category": "L7 Industrial",
      "mechanism": "Flood Modbus read requests to PLCs/RTUs. Industrial devices have minimal CPU.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "PLC CPU exhausted. Industrial devices not designed for high request rates."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy Modbus."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Industrial WAF if present."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Firewall rate limit."
        }
      },
      "prerequisites": [
        "Modbus TCP exposed (port 502)"
      ],
      "taxonomy_id": "L7-108",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "mbtget",
          "pymodbus scripts"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "modbus_write": {
      "name": "Modbus Write Flood",
      "layer": "protocol",
      "category": "L7 Industrial",
      "mechanism": "Flood Modbus write coils/registers. Can cause physical process disruption.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Physical process disruption + CPU exhaustion."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy Modbus."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Industrial WAF."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "Modbus TCP exposed",
        "Write access not restricted"
      ],
      "taxonomy_id": "L7-109",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "mbtget",
          "pymodbus scripts"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "dnp3_flood": {
      "name": "DNP3 Flood",
      "layer": "protocol",
      "category": "L7 Industrial",
      "mechanism": "Flood DNP3 requests to SCADA systems.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "SCADA CPU exhausted."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy DNP3."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Industrial WAF."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "DNP3 exposed (port 20000)"
      ],
      "taxonomy_id": "L7-110",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "mbtget",
          "pymodbus scripts"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "rtsp_describe": {
      "name": "RTSP DESCRIBE Flood",
      "layer": "protocol",
      "category": "L7 Streaming",
      "mechanism": "Flood RTSP DESCRIBE to streaming servers. Each request requires session setup processing.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Streaming server session processing."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy RTSP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "RTSP server exposed (port 554)"
      ],
      "taxonomy_id": "L7-111",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "ncat",
          "custom Python socket"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "rtsp_setup": {
      "name": "RTSP SETUP Flood",
      "layer": "protocol",
      "category": "L7 Streaming",
      "mechanism": "RTSP SETUP to allocate media transport channels. Server allocates RTP ports per session.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Port allocation + session state exhaustion."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy RTSP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "RTSP server exposed"
      ],
      "taxonomy_id": "L7-112",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "ncat",
          "custom Python socket"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "rtmp_flood": {
      "name": "RTMP Connect Flood",
      "layer": "protocol",
      "category": "L7 Streaming",
      "mechanism": "Flood RTMP connect + handshake to streaming servers.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Handshake CPU + connection slots."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy RTMP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "RTMP server exposed (port 1935)"
      ],
      "taxonomy_id": "L7-113",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "ncat",
          "custom Python socket"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "hls_segment": {
      "name": "HLS Segment Flood",
      "layer": "l7",
      "category": "L7 Streaming",
      "mechanism": "Flood HLS .ts segment requests. Each segment is a video chunk (2-10s of video). High bandwidth per request.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Bandwidth exhaustion from large video segments. Disk I/O."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN caches HLS segments at edge. Very effective caching."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "DPI on video segments = massive CPU + memory."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Bandwidth. Behavioral detection."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN caches segments."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Bandwidth exhaustion."
        }
      },
      "prerequisites": [
        "HLS endpoint must exist (discovered by recon)"
      ],
      "taxonomy_id": "L7-114",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "ncat",
          "custom Python socket"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "xmpp_stanza": {
      "name": "XMPP Stanza Flood",
      "layer": "protocol",
      "category": "L7 Messaging",
      "mechanism": "Flood XMPP message stanzas. Server must route, store, and possibly archive each.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Message routing + storage CPU."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy XMPP."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "XMPP server exposed (port 5222/5269)"
      ],
      "taxonomy_id": "L7-115",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "ncat",
          "custom Python socket"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "xmpp_presence": {
      "name": "XMPP Presence Flood",
      "layer": "protocol",
      "category": "L7 Messaging",
      "mechanism": "Rapid presence status changes. Server must broadcast to all contacts.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Broadcast CPU. Lower impact than stanza flood."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Trivial."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "XMPP server exposed",
        "Must authenticate"
      ],
      "taxonomy_id": "L7-116",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "ncat",
          "custom Python socket"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "xmpp_iq": {
      "name": "XMPP IQ Flood",
      "layer": "protocol",
      "category": "L7 Messaging",
      "mechanism": "Flood XMPP info/query stanzas. Server must process each query.",
      "effectiveness": {
        "exposed": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Query processing."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "security_waf": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Trivial."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN doesn't proxy."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Rate limit."
        }
      },
      "prerequisites": [
        "XMPP server exposed"
      ],
      "taxonomy_id": "L7-117",
      "type": "technique",
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS"
        ],
        "intermediate": [
          "ncat",
          "custom Python socket"
        ],
        "advanced": [
          "L7 HTTP stress toolkit"
        ]
      }
    },
    "ws_flood": {
      "name": "WebSocket Connection Flood",
      "layer": "l7",
      "category": "L7 WebSocket",
      "mechanism": "Flood WebSocket upgrade requests. Each connection holds server resources for persistent bidirectional channel.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WebSocket connections are persistent - server holds state per connection. Pool exhaustion."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN may proxy WebSocket. Default: limited WS connections. Tuned: rate limit WS upgrades."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF processes WS upgrade. Persistent connections drain connection table."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral: detects rapid WS upgrades. Connection limit."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN WS proxy + appliance."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes WS."
        }
      },
      "prerequisites": [
        "WebSocket endpoint must exist (discovered by recon)"
      ],
      "taxonomy_id": "L7-69",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (websocket method)"
        ],
        "intermediate": [
          "websocat",
          "wscat",
          "custom Python websockets"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go gorilla/websocket"
        ]
      }
    },
    "ws_message": {
      "name": "WebSocket Message Flood",
      "layer": "l7",
      "category": "L7 WebSocket",
      "mechanism": "Send rapid messages on established WebSocket connections. Server processes each message (JSON parse, business logic, broadcast).",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Server processes each message. Broadcast to other clients amplifies."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN proxies WS. Tuned: message rate limit."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF may inspect WS messages. CPU per message."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Message rate detection."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN + appliance."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes."
        }
      },
      "prerequisites": [
        "Active WebSocket connection required"
      ],
      "taxonomy_id": "L7-70",
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (websocket method)"
        ],
        "intermediate": [
          "websocat",
          "wscat",
          "custom Python websockets"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go gorilla/websocket"
        ]
      }
    },
    "grpc_stream": {
      "name": "gRPC Stream Flood",
      "layer": "l7",
      "category": "gRPC",
      "mechanism": "Flood gRPC streaming RPCs. Each stream holds server resources. Protobuf deserialization per message.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "gRPC server processes each stream. Protobuf deserialization CPU."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN gRPC proxy support varies. cloud CDN/WAF supports gRPC."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAFs generally don't understand gRPC/protobuf. Pass through."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Limited gRPC awareness."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN gRPC proxy if supported."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes gRPC (HTTP/2)."
        }
      },
      "prerequisites": [
        "gRPC endpoint must exist (discovered by recon)"
      ],
      "taxonomy_id": "L7-74",
      "type": "technique",
      "tool_category": "grpc-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "ghz (gRPC benchmarking)",
          "grpcurl"
        ],
        "advanced": [
          "gRPC stress toolkit",
          "custom Go gRPC client"
        ]
      }
    },
    "grpc_metadata": {
      "name": "gRPC Metadata Flood",
      "layer": "l7",
      "category": "gRPC",
      "mechanism": "Flood gRPC calls with oversized metadata headers. Server must parse and validate.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Metadata parsing + validation CPU. Hardened: metadata size limit."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN header size limits."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF processes headers."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Header size limits."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN + appliance."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Passes through."
        }
      },
      "prerequisites": [
        "gRPC endpoint must exist"
      ],
      "type": "technique",
      "tool_category": "grpc-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "ghz (gRPC benchmarking)",
          "grpcurl"
        ],
        "advanced": [
          "gRPC stress toolkit",
          "custom Go gRPC client"
        ]
      }
    },
    "direct_origin_attack": {
      "name": "Direct Origin Attack (CDN Bypass)",
      "layer": "l7",
      "category": "L7 CDN Bypass",
      "mechanism": "Discover origin IP (DNS history, MX records, SPF, cert transparency, subdomain enum) and attack directly, bypassing all CDN/WAF protection.",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "deadly",
          "notes": "Already exposed - this IS the default state."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "If origin IP found: all CDN protection bypassed. Hardened: origin lockdown (only accept CDN IPs)."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "deadly",
          "notes": "On-prem WAF IS the target. No bypass needed."
        },
        "ddos_appliance": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "deadly",
          "notes": "On-prem appliance IS the target. No bypass needed."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "mitigated",
          "notes": "If origin IP found: CDN layer bypassed. On-prem appliance still in path. Hardened: origin only accepts CDN IPs."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "deadly",
          "notes": "Perimeter filter IS the target."
        }
      },
      "prerequisites": [
        "Must discover origin IP through OSINT (DNS history, MX, SPF, CT logs, subdomains)",
        "Origin must accept connections from non-CDN IPs"
      ],
      "type": "technique",
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l3_ping_of_death": {
      "name": "Ping of Death",
      "taxonomy_id": "L3-02",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Oversized ICMP packets >65535 bytes crash IP stack",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Obsolete: modern OS/stacks patched against this. Only affects legacy systems."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Modern WAFs trivially block obsolete attacks."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware trivially blocks obsolete attacks."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Both layers block obsolete attacks."
        },
        "perimeter_filtered": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall blocks obsolete attacks."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_smurf_attack": {
      "name": "Smurf Attack",
      "taxonomy_id": "L3-03",
      "layer": "l3",
      "category": "Amplification",
      "mechanism": "Spoofed ICMP to broadcast, amplified reply floods victim",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Obsolete: modern OS/stacks patched against this. Only affects legacy systems."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Modern WAFs trivially block obsolete attacks."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware trivially blocks obsolete attacks."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Both layers block obsolete attacks."
        },
        "perimeter_filtered": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall blocks obsolete attacks."
        }
      },
      "prerequisites": [
        "Spoofed source IP required"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_teardrop": {
      "name": "Teardrop",
      "taxonomy_id": "L3-06",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Overlapping IP fragments crash OS reassembly",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Obsolete: modern OS/stacks patched against this. Only affects legacy systems."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Modern WAFs trivially block obsolete attacks."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware trivially blocks obsolete attacks."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Both layers block obsolete attacks."
        },
        "perimeter_filtered": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall blocks obsolete attacks."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l3_land_attack": {
      "name": "Land Attack",
      "taxonomy_id": "L3-08",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Src IP = Dst IP confuses TCP stack into loop",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Obsolete: modern OS/stacks patched against this. Only affects legacy systems."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Modern WAFs trivially block obsolete attacks."
        },
        "ddos_appliance": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware trivially blocks obsolete attacks."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Both layers block obsolete attacks."
        },
        "perimeter_filtered": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall blocks obsolete attacks."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC",
          "MHDDoS",
          "PyFlooder",
          "XERXES"
        ],
        "intermediate": [
          "hping3",
          "nping",
          "Scapy",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom C/Go raw sockets",
          "DPDK/XDP kernel bypass"
        ]
      }
    },
    "l4_slp_amplification": {
      "name": "SLP Amplification",
      "taxonomy_id": "L4-19",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "Service Location Protocol returns 2200x to victim",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Amplified volume floods pipe."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates before WAF can process. WAF irrelevant at this volume."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN blocks non-HTTP at edge."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates from amplified volume."
        }
      },
      "prerequisites": [
        "Spoofed source IP required"
      ],
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "l4_tp240_amplification": {
      "name": "TP240 Amplification",
      "taxonomy_id": "L4-20",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "Mitel phones return 4.3Bx data, largest known amplifier",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Amplified volume floods pipe."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates before WAF can process. WAF irrelevant at this volume."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN blocks non-HTTP at edge."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates from amplified volume."
        }
      },
      "prerequisites": [
        "Spoofed source IP required"
      ],
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "l4_dvr_cctv_amplification": {
      "name": "DVR/CCTV Amplification",
      "taxonomy_id": "L4-27",
      "layer": "l4",
      "category": "Amplification",
      "mechanism": "DVR protocol reflection returns variable data to victim",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Amplified volume floods pipe."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates before WAF can process. WAF irrelevant at this volume."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware drops at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN blocks non-HTTP at edge."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Pipe saturates from amplified volume."
        }
      },
      "prerequisites": [
        "Spoofed source IP required"
      ],
      "tool": "tcpreplay",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "l4_dns_nxdomain_flood": {
      "name": "DNS NXDOMAIN Flood",
      "taxonomy_id": "L4-30",
      "layer": "l4",
      "category": "L4 UDP",
      "mechanism": "Queries for non-existent domains exhaust resolver cache",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Volumetric flood saturates pipe or CPU."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF drops non-HTTP but shares pipe with legitimate traffic."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware-accelerated packet processing at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN blocks non-HTTP at edge."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops at packet level."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (DNS methods)"
        ],
        "intermediate": [
          "dnsperf",
          "dnsbomb",
          "custom Scapy DNS"
        ],
        "advanced": [
          "dns_stress (DDactic planned)"
        ]
      }
    },
    "l4_dns_rebinding": {
      "name": "DNS Rebinding",
      "taxonomy_id": "L4-31",
      "layer": "l4",
      "category": "L4 UDP",
      "mechanism": "Alternate DNS between attacker and internal IP, bypass same-origin",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Low-and-slow resource exhaustion."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF drops non-HTTP but shares pipe with legitimate traffic."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware-accelerated packet processing at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN blocks non-HTTP at edge."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops at packet level."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (DNS methods)"
        ],
        "intermediate": [
          "dnsperf",
          "dnsbomb",
          "custom Scapy DNS"
        ],
        "advanced": [
          "dns_stress (DDactic planned)"
        ]
      }
    },
    "l7_http_1_0_fallback_flood": {
      "name": "HTTP/1.0 Fallback Flood",
      "taxonomy_id": "L7-07",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Force HTTP/1.0 (no Host, no keep-alive), some WAFs skip 1.0 rules",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http_pipelining_flood": {
      "name": "HTTP Pipelining Flood",
      "taxonomy_id": "L7-08",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "50+ requests in one TCP write, no round-trip wait between them",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_random_existing_uri_flood": {
      "name": "Random Existing URI Flood",
      "taxonomy_id": "L7-09",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Flood random VALID URIs found by crawler, all hit CDN cache miss",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_uncached_endpoint_flood": {
      "name": "Uncached Endpoint Flood",
      "taxonomy_id": "L7-10",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Target endpoints with Cache-Control: no-cache, every request hits origin",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_slow_headers_crlf_drip": {
      "name": "Slow Headers CRLF Drip",
      "taxonomy_id": "L7-14",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Variant: drip individual CRLFs between header lines, never finish",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN enforces timeouts on slow connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with IPS/AV. Slow attacks drain resources."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection of slow connections. Large connection table."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout kills slow connections."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Limited L7 inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "Torshammer",
          "slowloris.py (GitHub)"
        ],
        "intermediate": [
          "slowhttptest (Qualys)",
          "SlowHTTPTest",
          "PySlowLoris"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom async Python"
        ]
      }
    },
    "l7_chunked_transfer_drip": {
      "name": "Chunked Transfer Drip",
      "taxonomy_id": "L7-15",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "POST Transfer-Encoding: chunked, send 1-byte chunks every 5s forever",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN enforces timeouts on slow connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with IPS/AV. Slow attacks drain resources."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection of slow connections. Large connection table."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout kills slow connections."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Limited L7 inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_expect_100_continue_hold": {
      "name": "Expect: 100-Continue Hold",
      "taxonomy_id": "L7-16",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "POST Expect: 100-continue + huge Content-Length, never send body",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN enforces timeouts on slow connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with IPS/AV. Slow attacks drain resources."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection of slow connections. Large connection table."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout kills slow connections."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Limited L7 inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_session_creation_flood": {
      "name": "Session Creation Flood",
      "taxonomy_id": "L7-17",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Requests without cookies force new session (DB/Redis write) per request",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_redirect_amplification": {
      "name": "Redirect Amplification",
      "taxonomy_id": "L7-18",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Target URLs with 3-10 hop redirect chains, 1 request = N server requests",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "l7_long_polling_exhaustion": {
      "name": "Long Polling Exhaustion",
      "taxonomy_id": "L7-19",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Open thousands of /events connections, server holds each 30-60s",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN enforces timeouts on slow connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with IPS/AV. Slow attacks drain resources."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection of slow connections. Large connection table."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout kills slow connections."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Limited L7 inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_sse_exhaustion": {
      "name": "SSE Exhaustion",
      "taxonomy_id": "L7-20",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Connect to text/event-stream endpoints, server pushes indefinitely",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN enforces timeouts on slow connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with IPS/AV. Slow attacks drain resources."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection of slow connections. Large connection table."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout kills slow connections."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Limited L7 inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_lfd_slow_read_combo": {
      "name": "LFD + Slow Read Combo",
      "taxonomy_id": "L7-22",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Request large file then read with 1-byte window, server buffers entire file",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN enforces timeouts on slow connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with IPS/AV. Slow attacks drain resources."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection of slow connections. Large connection table."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout kills slow connections."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Limited L7 inspection."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "Torshammer",
          "slowloris.py (GitHub)"
        ],
        "intermediate": [
          "slowhttptest (Qualys)",
          "SlowHTTPTest",
          "PySlowLoris"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom async Python"
        ]
      }
    },
    "l7_lfd_amplification": {
      "name": "LFD Amplification",
      "taxonomy_id": "L7-23",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Request large file without Accept-Encoding, 2-10x uncompressed bandwidth",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Origin processes all traffic directly."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN absorbs HTTP flood with rate limiting and caching."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DPI processes each request. CPU collapses under volume."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection identifies flood patterns. Hardened: trained baselines."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN absorbs cache hits. Appliance handles rest."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Rate limiting helps."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "l7_compression_abuse": {
      "name": "Compression Abuse",
      "taxonomy_id": "L7-25",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Omit Accept-Encoding header, server sends uncompressed (2-10x larger)",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Origin processes all traffic directly."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN absorbs HTTP flood with rate limiting and caching."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DPI processes each request. CPU collapses under volume."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection identifies flood patterns. Hardened: trained baselines."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN absorbs cache hits. Appliance handles rest."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Rate limiting helps."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_multipart_range_amp": {
      "name": "Multipart Range Amp",
      "taxonomy_id": "L7-26",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Single request with 50+ Range segments, server builds MIME multipart response",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (APACHE method)",
          "slowhttptest --range-test"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_query_param_inflation": {
      "name": "Query Param Inflation",
      "taxonomy_id": "L7-27",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "500+ query params per request, framework parses all into hash tables (HashDoS)",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_xml_bomb": {
      "name": "XML Bomb (Billion Laughs)",
      "taxonomy_id": "L7-28",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "~1KB XML with recursive entity expansion consumes GBs of server memory",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_json_deep_nesting": {
      "name": "JSON Deep Nesting",
      "taxonomy_id": "L7-29",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "5000+ nesting levels cause stack overflow in recursive JSON parsers",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_large_header_flood": {
      "name": "Large Header Flood",
      "taxonomy_id": "L7-30",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Max-size HTTP headers (16-32KB) per request amplify memory allocation cost",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_cookie_bomb": {
      "name": "Cookie Bomb",
      "taxonomy_id": "L7-31",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Set oversized cookies via reflected headers, all future requests carry 4KB+",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Origin processes all traffic directly."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN absorbs HTTP flood with rate limiting and caching."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DPI processes each request. CPU collapses under volume."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection identifies flood patterns. Hardened: trained baselines."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN absorbs cache hits. Appliance handles rest."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Rate limiting helps."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_multipart_upload_abuse": {
      "name": "Multipart Upload Abuse",
      "taxonomy_id": "L7-32",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Multipart/form-data with 1000s of tiny parts, buffer allocated per part",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_content_type_parser_cycle": {
      "name": "Content-Type Parser Cycle",
      "taxonomy_id": "L7-33",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Alternate JSON/XML/multipart/form bodies, force different parser code paths",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_xml_external_entity": {
      "name": "XML External Entity (XXE)",
      "taxonomy_id": "L7-34",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "XML parser resolves external entities, triggers outbound requests / file reads",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_db_query_amplification": {
      "name": "DB Query Amplification",
      "taxonomy_id": "L7-38",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Flood sort/filter/offset combos (ORDER BY + LIKE % + OFFSET 999999)",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (amp methods)",
          "DRDoS scripts on GitHub"
        ],
        "intermediate": [
          "Scapy + spoofed source",
          "custom amplification scripts"
        ],
        "advanced": [
          "tcpreplay + custom pcaps",
          "amp_replay (DDactic planned)"
        ]
      }
    },
    "l7_pagination_abuse": {
      "name": "Pagination Abuse",
      "taxonomy_id": "L7-39",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "limit=10000 or offset=999999 forces full table scan per request",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_ssr_exhaustion": {
      "name": "SSR Exhaustion",
      "taxonomy_id": "L7-40",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Target server-side rendered pages that execute heavy JS/templates per request",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_pdf_image_gen_flood": {
      "name": "PDF/Image Gen Flood",
      "taxonomy_id": "L7-41",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Target export endpoints (PDF, CSV, image resize) that generate files per request",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_cache_poisoning": {
      "name": "Cache Poisoning",
      "taxonomy_id": "L7-42",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Inject X-Forwarded-Host to poison CDN cache with attacker-controlled content",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_app_layer_ping_of_death": {
      "name": "App-Layer Ping of Death",
      "taxonomy_id": "L7-43",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Send max-size valid POST body (100MB) to endpoints that buffer entire body",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http_2_priority_manipulation": {
      "name": "HTTP/2 PRIORITY Manipulation",
      "taxonomy_id": "L7-50",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Conflicting PRIORITY frames force expensive dependency tree recalculation",
      "type": "cve",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Major CDNs patched (CVE-2019-9513). CDN terminates HTTP/2."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "cve_id": "CVE-2019-9513",
      "patched_since": "2019-08",
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http_2_goaway_flood": {
      "name": "HTTP/2 GOAWAY Flood",
      "taxonomy_id": "L7-51",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "GOAWAY + immediate reconnect forces repeated TLS+H2 handshake cost",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http_2_data_trickle": {
      "name": "HTTP/2 DATA Trickle",
      "taxonomy_id": "L7-52",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Send DATA frames 1 byte per stream across many streams (modern Slow POST)",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 processing shares CPU with DPI. Few WAFs properly track H2 frames."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects H2 attack patterns."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http_2_stream_exhaustion": {
      "name": "HTTP/2 Stream Exhaustion",
      "taxonomy_id": "L7-53",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Open max_concurrent_streams and never close, block new streams",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 processing shares CPU with DPI. Few WAFs properly track H2 frames."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects H2 attack patterns."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http_2_hpack_bomb": {
      "name": "HTTP/2 HPACK Bomb",
      "taxonomy_id": "L7-54",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Headers decompress to huge values via HPACK dynamic table manipulation",
      "type": "cve",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Major CDNs patched (CVE-2019-9516). CDN terminates HTTP/2."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "cve_id": "CVE-2019-9516",
      "patched_since": "2019-08",
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http_2_rst_loop": {
      "name": "HTTP/2 RST Loop",
      "taxonomy_id": "L7-55",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Rapid open stream -> partial request -> RST_STREAM -> repeat cycle",
      "type": "cve",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Major CDNs patched (CVE-2019-9514). CDN terminates HTTP/2."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 processing shares CPU with DPI. Few WAFs properly track H2 frames."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects H2 attack patterns."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "cve_id": "CVE-2019-9514",
      "patched_since": "2019-08",
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_tls_clienthello_flood": {
      "name": "TLS ClientHello Flood",
      "taxonomy_id": "L7-66",
      "layer": "l7",
      "category": "L7 TLS",
      "mechanism": "Flood ClientHello but never complete handshake, server allocates session state",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN absorbs HTTP flood with rate limiting and caching."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "DPI processes each request. CPU collapses under volume."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection identifies flood patterns. Hardened: trained baselines."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN absorbs cache hits. Appliance handles rest."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Rate limiting helps."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "openssl s_client in a loop",
          "thc-ssl-dos"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom OpenSSL/BoringSSL"
        ]
      }
    },
    "l7_ocsp_stapling_abuse": {
      "name": "OCSP Stapling Abuse",
      "taxonomy_id": "L7-67",
      "layer": "l7",
      "category": "L7 TLS",
      "mechanism": "Trigger OCSP validation, server must contact CA for cert status",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_tls_1_3_0_rtt_replay": {
      "name": "TLS 1.3 0-RTT Replay",
      "taxonomy_id": "L7-68",
      "layer": "l7",
      "category": "L7 TLS",
      "mechanism": "Replay 0-RTT early data to trigger processing without full handshake",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "openssl s_client in a loop",
          "thc-ssl-dos"
        ],
        "advanced": [
          "raw-socket toolkit",
          "custom OpenSSL/BoringSSL"
        ]
      }
    },
    "l7_websocket_frame_frag": {
      "name": "WebSocket Frame Frag",
      "taxonomy_id": "L7-71",
      "layer": "l7",
      "category": "L7 WebSocket",
      "mechanism": "Tiny fragmented WS frames force server-side reassembly and memory alloc",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "WebSocket endpoint must exist"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (websocket method)"
        ],
        "intermediate": [
          "websocat",
          "wscat",
          "custom Python websockets"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go gorilla/websocket"
        ]
      }
    },
    "l7_websocket_idle_exhaust": {
      "name": "WebSocket Idle Exhaust",
      "taxonomy_id": "L7-72",
      "layer": "l7",
      "category": "L7 WebSocket",
      "mechanism": "Open WS connections and go idle, server holds them for minutes",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN enforces timeouts on slow connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with IPS/AV. Slow attacks drain resources."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection of slow connections. Large connection table."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout kills slow connections."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Limited L7 inspection."
        }
      },
      "prerequisites": [
        "WebSocket endpoint must exist"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (websocket method)"
        ],
        "intermediate": [
          "websocat",
          "wscat",
          "custom Python websockets"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go gorilla/websocket"
        ]
      }
    },
    "l7_grpc_request_flood": {
      "name": "gRPC Request Flood",
      "taxonomy_id": "L7-73",
      "layer": "l7",
      "category": "gRPC",
      "mechanism": "High-volume unary gRPC requests exhaust server",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool_category": "grpc-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "ghz (gRPC benchmarking)",
          "grpcurl"
        ],
        "advanced": [
          "gRPC stress toolkit",
          "custom Go gRPC client"
        ]
      }
    },
    "l7_grpc_large_message": {
      "name": "gRPC Large Message",
      "taxonomy_id": "L7-75",
      "layer": "l7",
      "category": "gRPC",
      "mechanism": "Send oversized protobuf messages exceeding server buffer limits",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool_category": "grpc-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "ghz (gRPC benchmarking)",
          "grpcurl"
        ],
        "advanced": [
          "gRPC stress toolkit",
          "custom Go gRPC client"
        ]
      }
    },
    "l7_grpc_deadline_abuse": {
      "name": "gRPC Deadline Abuse",
      "taxonomy_id": "L7-76",
      "layer": "l7",
      "category": "gRPC",
      "mechanism": "Set long deadlines, server holds resources for entire duration",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 processing shares CPU with DPI. Few WAFs properly track H2 frames."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects H2 attack patterns."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool_category": "grpc-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "ghz (gRPC benchmarking)",
          "grpcurl"
        ],
        "advanced": [
          "gRPC stress toolkit",
          "custom Go gRPC client"
        ]
      }
    },
    "l7_grpc_stream_exhaustion": {
      "name": "gRPC Stream Exhaustion",
      "taxonomy_id": "L7-77",
      "layer": "l7",
      "category": "gRPC",
      "mechanism": "Open bidirectional streams, send slowly, never close",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 processing shares CPU with DPI. Few WAFs properly track H2 frames."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects H2 attack patterns."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool_category": "grpc-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "ghz (gRPC benchmarking)",
          "grpcurl"
        ],
        "advanced": [
          "gRPC stress toolkit",
          "custom Go gRPC client"
        ]
      }
    },
    "l7_graphql_batching": {
      "name": "GraphQL Batching",
      "taxonomy_id": "L7-78",
      "layer": "l7",
      "category": "L7 GraphQL",
      "mechanism": "1000+ queries in single request bypass per-request rate limits",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "GraphQL endpoint must exist"
      ],
      "tool_category": "graphql-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "graphql-cop",
          "InQL (Burp)"
        ],
        "advanced": [
          "GraphQL stress toolkit",
          "custom batching/nesting scripts"
        ]
      }
    },
    "l7_graphql_field_dup": {
      "name": "GraphQL Field Dup",
      "taxonomy_id": "L7-80",
      "layer": "l7",
      "category": "L7 GraphQL",
      "mechanism": "Repeat same field 10000x in one query, massive memory allocation",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "GraphQL endpoint must exist"
      ],
      "tool_category": "graphql-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "graphql-cop",
          "InQL (Burp)"
        ],
        "advanced": [
          "GraphQL stress toolkit",
          "custom batching/nesting scripts"
        ]
      }
    },
    "l7_graphql_alias_overload": {
      "name": "GraphQL Alias Overload",
      "taxonomy_id": "L7-81",
      "layer": "l7",
      "category": "L7 GraphQL",
      "mechanism": "Aliases bypass per-field limits, each alias = separate resolver exec",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "GraphQL endpoint must exist"
      ],
      "tool_category": "graphql-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "graphql-cop",
          "InQL (Burp)"
        ],
        "advanced": [
          "GraphQL stress toolkit",
          "custom batching/nesting scripts"
        ]
      }
    },
    "l7_graphql_directive_flood": {
      "name": "GraphQL Directive Flood",
      "taxonomy_id": "L7-82",
      "layer": "l7",
      "category": "L7 GraphQL",
      "mechanism": "Abuse @skip/@include/custom directives for parser exhaustion",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "GraphQL endpoint must exist"
      ],
      "tool_category": "graphql-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "graphql-cop",
          "InQL (Burp)"
        ],
        "advanced": [
          "GraphQL stress toolkit",
          "custom batching/nesting scripts"
        ]
      }
    },
    "l7_graphql_introspection": {
      "name": "GraphQL Introspection",
      "taxonomy_id": "L7-83",
      "layer": "l7",
      "category": "L7 GraphQL",
      "mechanism": "Full schema query is expensive and reveals entire attack surface",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "GraphQL endpoint must exist"
      ],
      "tool_category": "graphql-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "graphql-cop",
          "InQL (Burp)"
        ],
        "advanced": [
          "GraphQL stress toolkit",
          "custom batching/nesting scripts"
        ]
      }
    },
    "l7_api_key_stuffing": {
      "name": "API Key Stuffing",
      "taxonomy_id": "L7-119",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Try leaked/common API keys at scale against auth endpoints",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool_category": "ato-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http_2_flood_via_mux": {
      "name": "HTTP/2 Flood via Mux",
      "taxonomy_id": "L7-120",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Multiplex 100s of requests on single TCP connection, bypass per-conn limits",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_encrypted_attack": {
      "name": "Encrypted Attack (TLS)",
      "taxonomy_id": "L7-121",
      "layer": "l7",
      "category": "L7 TLS",
      "mechanism": "L7 flood over TLS, DDoS scrubbers can't inspect encrypted payload",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_bgp_hijack_flood": {
      "name": "BGP Hijack + Flood",
      "taxonomy_id": "L7-122",
      "layer": "l3",
      "category": "L3 Network",
      "mechanism": "Hijack victim's IP prefix via BGP, absorb or blackhole their traffic",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Volumetric flood saturates pipe or CPU."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF drops non-HTTP but shares pipe with legitimate traffic."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware-accelerated packet processing at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN blocks non-HTTP at edge."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops at packet level."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_tcp_rst_injection": {
      "name": "TCP RST Injection",
      "taxonomy_id": "L7-123",
      "layer": "l4",
      "category": "L4 TCP",
      "mechanism": "Inject forged RST packets into active connections to kill them",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN only proxies HTTP/HTTPS. Non-HTTP protocol blocked at edge."
        },
        "security_waf": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "WAF drops non-HTTP but shares pipe with legitimate traffic."
        },
        "ddos_appliance": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Hardware-accelerated packet processing at line rate."
        },
        "hybrid": {
          "default": "blocked",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN blocks non-HTTP at edge."
        },
        "perimeter_filtered": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "Firewall drops at packet level."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_fragmented_http_flood": {
      "name": "Fragmented HTTP Flood",
      "taxonomy_id": "L7-124",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Split HTTP request across IP fragments, bypass WAF signature matching",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_cloud_function_abuse": {
      "name": "Cloud Function Abuse",
      "taxonomy_id": "L7-125",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Use attacker's cloud functions (Lambda/CF Workers) as free distributed botnet",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool_category": "l7-http-stress",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_headless_browser_flood": {
      "name": "Headless Browser Flood",
      "taxonomy_id": "L7-126",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Full browser-rendered requests with valid JS execution, bypass all bot detection",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": "http_recon.js",
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_api_batch_endpoint_abuse": {
      "name": "API Batch Endpoint Abuse",
      "taxonomy_id": "L7-127",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Target batch/bulk API endpoints that process N operations per single request",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_server_side_request_forgery": {
      "name": "Server-Side Request Forgery",
      "taxonomy_id": "L7-128",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Trigger SSRF to make server send requests to internal services, chain into DoS",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http_1_0_handshake_storm": {
      "name": "HTTP/1.0 Handshake Storm",
      "taxonomy_id": "L7-129",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Force HTTP/1.0 (no keep-alive): each request = new TCP+TLS handshake, 10Kx costlier for server",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "CDN passes application-layer requests through. Default: no app-logic inspection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http_2_stream_mux_slowloris": {
      "name": "HTTP/2 Stream Mux Slowloris",
      "taxonomy_id": "L7-130",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Open 100 streams per conn, drip headers on each - 100x Slowloris efficiency per TCP connection",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 processing shares CPU with DPI. Few WAFs properly track H2 frames."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects H2 attack patterns."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http_2_mux_slow_post": {
      "name": "HTTP/2 Mux Slow POST",
      "taxonomy_id": "L7-131",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "POST on 100 streams per conn, drip body on each - 100x Slow POST per connection",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 processing shares CPU with DPI. Few WAFs properly track H2 frames."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects H2 attack patterns."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http_3_mux_flood": {
      "name": "HTTP/3 Mux Flood",
      "taxonomy_id": "L7-132",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Multiplex 1000s of requests over single QUIC conn, no TCP HOL, no TCP overhead",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC/HTTP3. Rate limiting."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "Target must support QUIC/HTTP3"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_http_3_stream_exhaust": {
      "name": "HTTP/3 Stream Exhaust",
      "taxonomy_id": "L7-133",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Fill QUIC max_streams, hold them open - connection cannot accept new requests",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC/HTTP3. Rate limiting."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF cannot inspect QUIC (encrypted). Passes through to server."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Limited QUIC awareness. Newer appliances improving."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes UDP/443 if QUIC enabled. No QUIC-specific mitigation."
        }
      },
      "prerequisites": [
        "Target must support QUIC/HTTP3"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_http_3_slow_qpack": {
      "name": "HTTP/3 Slow QPACK",
      "taxonomy_id": "L7-134",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Drip QPACK-encoded headers slowly across QUIC streams, server buffers partial headers",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC/HTTP3. Rate limiting."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF cannot inspect QUIC (encrypted). Passes through to server."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Limited QUIC awareness. Newer appliances improving."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes UDP/443 if QUIC enabled. No QUIC-specific mitigation."
        }
      },
      "prerequisites": [
        "Target must support QUIC/HTTP3"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_http_3_connection_migration_abuse": {
      "name": "HTTP/3 Connection Migration Abuse",
      "taxonomy_id": "L7-135",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "QUIC connection migration: keep switching source IP mid-connection, force server to track multiple paths",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC/HTTP3. Rate limiting."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF cannot inspect QUIC (encrypted). Passes through to server."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Limited QUIC awareness. Newer appliances improving."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes UDP/443 if QUIC enabled. No QUIC-specific mitigation."
        }
      },
      "prerequisites": [
        "Target must support QUIC/HTTP3"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_http_1_1_keep_alive_starvation": {
      "name": "HTTP/1.1 Keep-Alive Starvation",
      "taxonomy_id": "L7-136",
      "layer": "l7",
      "category": "L7 HTTP",
      "mechanism": "Open max keep-alive connections, send minimum traffic to keep them alive, starve new clients",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN enforces timeouts on slow connections."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF connection table shared with IPS/AV. Slow attacks drain resources."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Behavioral detection of slow connections. Large connection table."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN timeout kills slow connections."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. Limited L7 inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "l7_http_2_server_push_abuse": {
      "name": "HTTP/2 Server Push Abuse",
      "taxonomy_id": "L7-137",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "Trigger server push on many streams, server sends unrequested resources consuming its own bandwidth",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Origin processes all traffic directly."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 processing shares CPU with DPI. Few WAFs properly track H2 frames."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects H2 attack patterns."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_http_2_connect_tunnel_abuse": {
      "name": "HTTP/2 CONNECT Tunnel Abuse",
      "taxonomy_id": "L7-138",
      "layer": "l7",
      "category": "L7 HTTP/2",
      "mechanism": "HTTP/2 Extended CONNECT (RFC 8441) to open WebSocket/TCP tunnels, hold resources",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "State table/resource exhaustion. Hardened: connection limits, timeouts."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes to origin."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF HTTP/2 processing shares CPU with DPI. Few WAFs properly track H2 frames."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "Newer firmware detects H2 attack patterns."
        },
        "hybrid": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates HTTP/2 and re-multiplexes."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP/2 through."
        }
      },
      "prerequisites": [
        "Target must support HTTP/2"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "MHDDoS (CONNECTION method)"
        ],
        "intermediate": [
          "h2load (nghttp2)",
          "curl --http2"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom Go x/net/http2",
          "hyper (Rust)"
        ]
      }
    },
    "l7_quic_retry_token_flood": {
      "name": "QUIC Retry Token Flood",
      "taxonomy_id": "L7-139",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Forge or replay QUIC Retry tokens to exhaust server validation resources",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC/HTTP3. Rate limiting."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "Target must support QUIC/HTTP3"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "curl --http3",
          "quiche"
        ],
        "advanced": [
          "quic_stress (DDactic planned)",
          "custom Go quic-go",
          "custom Rust quinn"
        ]
      }
    },
    "l7_protocol_downgrade_flood": {
      "name": "Protocol Downgrade Flood",
      "taxonomy_id": "L7-140",
      "layer": "l7",
      "category": "L7 QUIC",
      "mechanism": "Send mixed H1/H2/H3 requests forcing server to maintain multiple protocol state machines",
      "type": "design_vector",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Application-level flood exhausts server resources."
        },
        "cloud_cdn": {
          "default": "mitigated",
          "tuned": "blocked",
          "hardened": "blocked",
          "notes": "CDN terminates QUIC/HTTP3. Rate limiting."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "WAF DPI processes each request. App logic bypasses signature rules."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Appliance doesn't understand app logic. Passes through. Behavioral anomaly detection."
        },
        "hybrid": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Neither CDN nor appliance understands app logic by default."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "Firewall passes HTTP. No application inspection."
        }
      },
      "prerequisites": [
        "Target must support QUIC/HTTP3"
      ],
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "LOIC (HTTP)",
          "HULK",
          "GoldenEye",
          "MHDDoS (L7 methods)",
          "DDoS-Ripper"
        ],
        "intermediate": [
          "wrk",
          "hey",
          "vegeta",
          "bombardier",
          "ab",
          "Siege",
          "MHDDoS_proxy"
        ],
        "advanced": [
          "L7 HTTP stress toolkit",
          "custom aiohttp/Go",
          "Playwright fleet + residential proxies"
        ]
      }
    },
    "ato_credential_stuffing": {
      "name": "Credential Stuffing",
      "taxonomy_id": "ATO-01",
      "layer": "l7",
      "category": "Account Takeover",
      "mechanism": "Use breached email:password pairs against login (0.1-2% success)",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool_category": "ato-stress",
      "common_tools": {
        "script_kiddie": [
          "SentryMBA",
          "OpenBullet",
          "STORM"
        ],
        "intermediate": [
          "Hydra",
          "Medusa",
          "Burp Intruder",
          "custom Python requests"
        ],
        "advanced": [
          "ATO stress toolkit",
          "custom aiohttp + proxy rotation + fingerprint evasion"
        ]
      }
    },
    "ato_password_spraying": {
      "name": "Password Spraying",
      "taxonomy_id": "ATO-02",
      "layer": "l7",
      "category": "Account Takeover",
      "mechanism": "Try common passwords across many accounts (0.5-5% success)",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool_category": "ato-stress",
      "common_tools": {
        "script_kiddie": [
          "SentryMBA",
          "OpenBullet",
          "STORM"
        ],
        "intermediate": [
          "Hydra",
          "Medusa",
          "Burp Intruder",
          "custom Python requests"
        ],
        "advanced": [
          "ATO stress toolkit",
          "custom aiohttp + proxy rotation + fingerprint evasion"
        ]
      }
    },
    "ato_brute_force": {
      "name": "Brute Force",
      "taxonomy_id": "ATO-03",
      "layer": "l7",
      "category": "Account Takeover",
      "mechanism": "Try all password combinations against single account",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool_category": "ato-stress",
      "common_tools": {
        "script_kiddie": [
          "SentryMBA",
          "OpenBullet",
          "STORM"
        ],
        "intermediate": [
          "Hydra",
          "Medusa",
          "Burp Intruder",
          "custom Python requests"
        ],
        "advanced": [
          "ATO stress toolkit",
          "custom aiohttp + proxy rotation + fingerprint evasion"
        ]
      }
    },
    "ato_username_enumeration": {
      "name": "Username Enumeration",
      "taxonomy_id": "ATO-04",
      "layer": "l7",
      "category": "Account Takeover",
      "mechanism": "Detect valid usernames via response timing or content differences",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool_category": "ato-stress",
      "common_tools": {
        "script_kiddie": [
          "SentryMBA",
          "OpenBullet",
          "STORM"
        ],
        "intermediate": [
          "Hydra",
          "Medusa",
          "Burp Intruder",
          "custom Python requests"
        ],
        "advanced": [
          "ATO stress toolkit",
          "custom aiohttp + proxy rotation + fingerprint evasion"
        ]
      }
    },
    "ato_otp_brute_force": {
      "name": "OTP Brute Force",
      "taxonomy_id": "ATO-05",
      "layer": "l7",
      "category": "Account Takeover",
      "mechanism": "Brute force 4-6 digit MFA codes within validity window",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool_category": "ato-stress",
      "common_tools": {
        "script_kiddie": [
          "SentryMBA",
          "OpenBullet",
          "STORM"
        ],
        "intermediate": [
          "Hydra",
          "Medusa",
          "Burp Intruder",
          "custom Python requests"
        ],
        "advanced": [
          "ATO stress toolkit",
          "custom aiohttp + proxy rotation + fingerprint evasion"
        ]
      }
    },
    "ato_session_fixation": {
      "name": "Session Fixation",
      "taxonomy_id": "ATO-06",
      "layer": "l7",
      "category": "Account Takeover",
      "mechanism": "Force user to use attacker-controlled session ID",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "SentryMBA",
          "OpenBullet",
          "STORM"
        ],
        "intermediate": [
          "Hydra",
          "Medusa",
          "Burp Intruder",
          "custom Python requests"
        ],
        "advanced": [
          "ATO stress toolkit",
          "custom aiohttp + proxy rotation + fingerprint evasion"
        ]
      }
    },
    "ato_session_hijacking": {
      "name": "Session Hijacking",
      "taxonomy_id": "ATO-07",
      "layer": "l7",
      "category": "Account Takeover",
      "mechanism": "Steal active session tokens via XSS, network sniff, or malware",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "SentryMBA",
          "OpenBullet",
          "STORM"
        ],
        "intermediate": [
          "Hydra",
          "Medusa",
          "Burp Intruder",
          "custom Python requests"
        ],
        "advanced": [
          "ATO stress toolkit",
          "custom aiohttp + proxy rotation + fingerprint evasion"
        ]
      }
    },
    "ato_mfa_fatigue": {
      "name": "MFA Fatigue",
      "taxonomy_id": "ATO-08",
      "layer": "l7",
      "category": "Account Takeover",
      "mechanism": "Spam push notifications until user approves (10-30% success)",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "SentryMBA",
          "OpenBullet",
          "STORM"
        ],
        "intermediate": [
          "Hydra",
          "Medusa",
          "Burp Intruder",
          "custom Python requests"
        ],
        "advanced": [
          "ATO stress toolkit",
          "custom aiohttp + proxy rotation + fingerprint evasion"
        ]
      }
    },
    "ato_oauth_token_theft": {
      "name": "OAuth Token Theft",
      "taxonomy_id": "ATO-09",
      "layer": "l7",
      "category": "Account Takeover",
      "mechanism": "Abuse OAuth redirect flows to steal authorization codes/tokens",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "SentryMBA",
          "OpenBullet",
          "STORM"
        ],
        "intermediate": [
          "Hydra",
          "Medusa",
          "Burp Intruder",
          "custom Python requests"
        ],
        "advanced": [
          "ATO stress toolkit",
          "custom aiohttp + proxy rotation + fingerprint evasion"
        ]
      }
    },
    "api_jwt_none_algorithm": {
      "name": "JWT None Algorithm",
      "taxonomy_id": "API-01",
      "layer": "l7",
      "category": "API Security",
      "mechanism": "Set alg=none to bypass signature verification entirely",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "jwt_tool"
        ],
        "intermediate": [
          "Burp Suite"
        ],
        "advanced": [
          "custom scripts"
        ]
      }
    },
    "api_jwt_key_confusion": {
      "name": "JWT Key Confusion",
      "taxonomy_id": "API-02",
      "layer": "l7",
      "category": "API Security",
      "mechanism": "RS256->HS256 confusion, sign with leaked public key",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "jwt_tool"
        ],
        "intermediate": [
          "Burp Suite"
        ],
        "advanced": [
          "custom scripts"
        ]
      }
    },
    "api_jwt_secret_brute_force": {
      "name": "JWT Secret Brute Force",
      "taxonomy_id": "API-03",
      "layer": "l7",
      "category": "API Security",
      "mechanism": "Crack weak HMAC secrets offline, then forge tokens",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "jwt_tool"
        ],
        "intermediate": [
          "Burp Suite"
        ],
        "advanced": [
          "custom scripts"
        ]
      }
    },
    "api_jwt_kid_injection": {
      "name": "JWT KID Injection",
      "taxonomy_id": "API-04",
      "layer": "l7",
      "category": "API Security",
      "mechanism": "SQL/Path injection via Key ID header parameter",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "jwt_tool"
        ],
        "intermediate": [
          "Burp Suite"
        ],
        "advanced": [
          "custom scripts"
        ]
      }
    },
    "api_jwt_jwk_injection": {
      "name": "JWT JWK Injection",
      "taxonomy_id": "API-05",
      "layer": "l7",
      "category": "API Security",
      "mechanism": "Inject attacker-controlled key via JWK header",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "jwt_tool"
        ],
        "intermediate": [
          "Burp Suite"
        ],
        "advanced": [
          "custom scripts"
        ]
      }
    },
    "api_jwt_expiration_bypass": {
      "name": "JWT Expiration Bypass",
      "taxonomy_id": "API-06",
      "layer": "l7",
      "category": "API Security",
      "mechanism": "Modify exp claim to extend token lifetime indefinitely",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "jwt_tool"
        ],
        "intermediate": [
          "Burp Suite"
        ],
        "advanced": [
          "custom scripts"
        ]
      }
    },
    "api_graphql_introspection": {
      "name": "GraphQL Introspection",
      "taxonomy_id": "API-07",
      "layer": "l7",
      "category": "API Security",
      "mechanism": "Full schema enumeration reveals types, fields, mutations",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "prerequisites": [
        "GraphQL endpoint must exist"
      ],
      "tool_category": "graphql-stress",
      "common_tools": {
        "script_kiddie": [],
        "intermediate": [
          "graphql-cop",
          "InQL (Burp)"
        ],
        "advanced": [
          "GraphQL stress toolkit",
          "custom batching/nesting scripts"
        ]
      }
    },
    "api_bola_idor": {
      "name": "BOLA/IDOR",
      "taxonomy_id": "API-08",
      "layer": "l7",
      "category": "API Security",
      "mechanism": "Access other users' resources by changing object ID in request",
      "type": "technique",
      "effectiveness": {
        "exposed": {
          "default": "deadly",
          "tuned": "deadly",
          "hardened": "degraded",
          "notes": "App-logic attack. Hardened: proper auth controls, rate limiting."
        },
        "cloud_cdn": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN passes app-logic requests to origin. Tuned: rate limiting, bot detection."
        },
        "security_waf": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "WAF doesn't understand app logic. Passes through to origin."
        },
        "ddos_appliance": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "mitigated",
          "notes": "Appliance doesn't inspect app logic deeply. Behavioral detection of anomalies."
        },
        "hybrid": {
          "default": "degraded",
          "tuned": "mitigated",
          "hardened": "blocked",
          "notes": "CDN rate limits. Appliance behavioral detection. App logic still complex."
        },
        "perimeter_filtered": {
          "default": "deadly",
          "tuned": "degraded",
          "hardened": "mitigated",
          "notes": "Firewall passes HTTP. No app-logic inspection."
        }
      },
      "tool": null,
      "common_tools": {
        "script_kiddie": [
          "jwt_tool"
        ],
        "intermediate": [
          "Burp Suite"
        ],
        "advanced": [
          "custom scripts"
        ]
      }
    }
  },
  "_modifiers_note": "Defender-side modifiers (architecture_modifiers) are public, see that section. Attacker-side modifiers (technique_modifiers and strategy_modifiers) remain held back because they describe specific bypass behaviour at a level closer to a playbook than a research dataset. Contact DDactic if you need the attacker-side framework for academic or defensive work under NDA.",
  "_summary": {
    "total_vectors": 211,
    "by_layer": {
      "account_takeover": 9,
      "amplification": 17,
      "api_security": 8,
      "cdn_bypass": 1,
      "directory": 3,
      "graphql": 5,
      "industrial": 3,
      "iot": 3,
      "l3": 16,
      "l4_tcp": 12,
      "l4_udp": 7,
      "l7_http": 43,
      "l7_http2": 16,
      "l7_quic": 14,
      "l7_resource": 7,
      "messaging": 3,
      "other": 8,
      "remote_access": 5,
      "sip": 7,
      "smtp": 6,
      "streaming": 4,
      "tls": 4,
      "websocket_grpc": 10
    },
    "key_insights": [
      "Cloud CDN blocks ALL non-HTTP protocols (L3, L4, SIP, SMTP, SSH, etc.) by design",
      "Security WAFs (F5, Check Point, FortiGate) are MOST vulnerable to L7 floods and slow attacks because DPI shares CPU with IPS/AV/SSL",
      "DDoS appliances (Radware DefensePro, Arbor) are hardware-accelerated but still vulnerable to pipe saturation",
      "Cache bust is the key technique against CDN - turns CDN into expensive pass-through",
      "GraphQL complexity and ReDoS can be deadly against ANY architecture because they exploit application logic, not network capacity",
      "QUIC/HTTP3 vectors bypass most WAFs and older DDoS appliances that don't support QUIC inspection",
      "Direct origin attack (CDN bypass) is the most impactful vector against cloud-protected assets",
      "Protocol-specific vectors (SIP, SMTP, MQTT, Modbus) only apply to assets running those services",
      "Amplification vectors (NTP, DNS, Memcached) require spoofed source IPs - only effective against non-CDN assets",
      "Config level matters most for L7 attacks - behavioral baselines take 2+ weeks to train"
    ],
    "total_by_type": {
      "technique": 181,
      "cve": 8,
      "design_vector": 22
    }
  },
  "_changelog": [
    {
      "version": "3.1",
      "date": "2026-04-26",
      "change": "Added architecture_modifiers section (14 defender-side modifier categories addressing the v1.0 gaps documented in KNOWN_GAPS.md). Additive; v3.0 readers continue to work because the existing keys are untouched."
    }
  ],
  "architecture_modifiers": {
    "_description": "Defender-side modifiers that adjust base architecture effectiveness based on deployment-time choices. Compose with the base rating using _arch_modifier_computation. Unlike the attacker-side modifiers (held back from public release), these modifiers are safe to share because they help a defender characterize their own posture, not an attacker.",
    "_applicable_layers": "all",
    "engagement_mode": {
      "name": "Engagement mode",
      "applies_to": [
        "cloud_cdn",
        "ddos_appliance",
        "hybrid"
      ],
      "affects_mechanisms": [
        "M-01",
        "M-02",
        "M-15",
        "M-19"
      ],
      "options": {
        "always_on_inline": {
          "shift": 0,
          "notes": "Default assumption. Mitigation engages on first packet."
        },
        "always_on_with_escalation": {
          "shift": 1,
          "notes": "Manual escalation step required for full mitigation. Adds 60-300s of degraded posture during escalation."
        },
        "on_demand_bgp_redirect": {
          "shift": 2,
          "notes": "BGP redirect convergence ~30-90s. Pulse attacks under 30s land before mitigation engages."
        }
      }
    },
    "api_controllability": {
      "name": "API-controllability of the protection product",
      "applies_to": "all",
      "options": {
        "full_api_iac": {
          "shift": 0,
          "notes": "Tuned and hardened cells reachable via Terraform / Pulumi / GitOps. Operationally cheap to harden."
        },
        "partial_api": {
          "shift": 0,
          "notes": "Some hardening requires console sessions. Operationally slower to reach hardened."
        },
        "click_ops_only": {
          "shift": 1,
          "notes": "Hardened in practice is one config-level lower than rated because hardening is operationally too painful to maintain."
        }
      }
    },
    "integration_class": {
      "name": "Integration class (unified vs bolted-on)",
      "applies_to": [
        "cloud_cdn",
        "hybrid"
      ],
      "options": {
        "unified_edge": {
          "shift": 0,
          "notes": "Single policy plane. WAF, DDoS, rate-limit, bot-management share state and signal."
        },
        "bolted_on_2_layer": {
          "shift": 1,
          "notes": "Edge plus behind-edge product with separate policy. Trust assumptions between layers exploitable."
        },
        "bolted_on_3_plus_layer": {
          "shift": 1,
          "notes": "Three or more independent products in line. Each integration boundary is its own attack surface."
        }
      }
    },
    "origin_scaling_class": {
      "name": "Origin scaling class",
      "applies_to": "all",
      "affects_mechanisms": [
        "M-07",
        "M-11",
        "M-15",
        "M-19"
      ],
      "options": {
        "serverless": {
          "shift": -1,
          "notes": "Functions / Cloud Run / Lambda autoscale. Floods cost money but rarely take service down. Cell shifts toward mitigated for request floods."
        },
        "container_kubernetes": {
          "shift": 0,
          "notes": "Default assumption. Scales fast with a warm-up window and a horizontal pod cap."
        },
        "alb_fronted": {
          "shift": 0,
          "notes": "ALB / NLB scales on connection count, not RPS. M-07 (Idle Hold) and M-11 (H/2 Stream Churn) hit ALB connection accounting differently than they hit a request-counting WAF."
        },
        "api_gateway_fronted": {
          "shift": -1,
          "notes": "AWS API Gateway / Apigee / Azure APIM provide rate limiting at the gateway, before origin sees the request."
        },
        "vm_or_metal": {
          "shift": 1,
          "notes": "No autoscale. Floods either fit within rated capacity or they overwhelm it."
        }
      }
    },
    "rate_limit_basis": {
      "name": "Rate-limit basis",
      "applies_to": "all",
      "affects_mechanisms": [
        "M-15",
        "M-16",
        "M-19"
      ],
      "options": {
        "per_ip": {
          "shift": 0,
          "notes": "Default assumption. Carpet bombing across a /24 defeats it."
        },
        "per_subnet_aggregated": {
          "shift": -1,
          "notes": "Limits aggregated across /24 or /23 subnets. Defeats single-block carpet bombing."
        },
        "per_api_key": {
          "shift": -1,
          "notes": "Per-API-key limits. Carpet bombing must be per-account, not per-IP. Significantly stronger for B2B APIs."
        },
        "per_session": {
          "shift": -1,
          "notes": "Session correlation across IPs. Defeats per-IP rotation."
        },
        "per_authenticated_user": {
          "shift": -2,
          "notes": "Limits keyed to an authenticated user identity. The strongest standard form. Useful for any post-login traffic."
        }
      }
    },
    "cost_aware_throttling": {
      "name": "Per-endpoint cost budgets / expensive-request tagging",
      "applies_to": "all",
      "affects_mechanisms": [
        "M-18",
        "M-19"
      ],
      "options": {
        "absent": {
          "shift": 0,
          "notes": "Default assumption. All endpoints treated equally."
        },
        "per_endpoint_budgets": {
          "shift": -1,
          "notes": "Costly endpoints (login, search, GraphQL deep selection, PDF generation, image resize) have per-account or per-key budgets that throttle expensive operations independently of cheap ones."
        },
        "graphql_cost_analysis": {
          "shift": -1,
          "notes": "GraphQL query-cost analysis with a budget. Specifically defends GraphQL Backend Query Amp variants."
        }
      }
    },
    "origin_ip_exposure": {
      "name": "Origin IP exposure",
      "applies_to": "all",
      "affects_mechanisms": [
        "direct_origin_attack"
      ],
      "options": {
        "public": {
          "shift": 0,
          "notes": "Origin IP discoverable via OSINT (DNS history, MX, SPF, certificate transparency). CDN bypass is viable."
        },
        "ip_allowlisted_to_cdn": {
          "shift": -2,
          "notes": "Origin firewall accepts traffic only from documented CDN IP ranges plus mTLS. OSINT-discovered IP is useless because origin refuses non-CDN sources."
        },
        "private_tunnel": {
          "shift": -3,
          "notes": "Cloudflare Tunnel / AWS PrivateLink / Azure Private Link / GCP Private Service Connect. Origin has no public IP. CDN bypass is N/A."
        }
      }
    },
    "caching_layers": {
      "name": "Caching layers present",
      "applies_to": "all",
      "affects_mechanisms": [
        "M-16"
      ],
      "options": {
        "none": {
          "shift": 0,
          "notes": "No cache layer. Every request hits origin."
        },
        "cdn_edge_only": {
          "shift": -1,
          "notes": "CDN edge cache absorbs cache-friendly traffic. Cache-bust attacks bypass it."
        },
        "cdn_edge_plus_shield": {
          "shift": -1,
          "notes": "CDN edge plus regional shield (Cloudflare Tiered Cache, Akamai Tiered Distribution, Fastly Origin Shield). Reduces origin pull rate even under cache-bust."
        },
        "cdn_edge_plus_app_cache": {
          "shift": -2,
          "notes": "CDN edge plus in-app cache (Redis, Memcached, Varnish). Multi-layer cache absorbs cache-bust at the application layer."
        }
      }
    },
    "ipv6_origin_protection": {
      "name": "IPv6 origin protection parity",
      "applies_to": [
        "cloud_cdn",
        "hybrid"
      ],
      "affects_mechanisms": [
        "direct_origin_attack"
      ],
      "options": {
        "dual_stack_protected": {
          "shift": 0,
          "notes": "CDN protects IPv4 and IPv6 traffic equivalently. Origin firewall rejects non-CDN sources on both stacks."
        },
        "ipv4_only_cdn_dual_stack_origin": {
          "shift": 2,
          "notes": "CDN proxies only IPv4. Origin has an AAAA record reachable directly. Attackers route over IPv6, bypass the CDN entirely. This is one of the most common silent gaps."
        }
      }
    },
    "regional_pop_density": {
      "name": "Regional PoP density at attack source region",
      "applies_to": [
        "cloud_cdn",
        "hybrid"
      ],
      "affects_mechanisms": [
        "M-01",
        "M-02"
      ],
      "options": {
        "thin": {
          "shift": 1,
          "notes": "Fewer than 5 PoPs in the attack source region. Volumetric absorption is constrained."
        },
        "medium": {
          "shift": 0,
          "notes": "5 to 20 PoPs in region. Default assumption."
        },
        "dense": {
          "shift": -1,
          "notes": "Over 20 PoPs in region. Regional volumetric attacks absorbed at edge with margin."
        }
      }
    },
    "engagement_latency_seconds": {
      "name": "Mitigation engagement latency",
      "applies_to": "all",
      "type": "numeric_metadata",
      "interaction": "Compare with attack pulse window. If pulse_window_seconds is less than engagement_latency_seconds, downshift the cell by 1 for the duration of the pulse, because the mitigation does not engage before the burst ends.",
      "typical_values": {
        "always_on_edge_signature": "1-3s",
        "always_on_edge_behavioral": "10-60s",
        "always_on_with_escalation": "60-300s",
        "on_demand_bgp_redirect": "30-90s",
        "manual_response_only": "300s+"
      }
    },
    "baseline_maturity": {
      "name": "Behavioral baseline maturity",
      "applies_to": "all",
      "options": {
        "untrained_under_1_week": {
          "shift": 1,
          "notes": "Hardened cells are effectively tuned. Most behavioral classifiers have not seen enough traffic to flag anomalies."
        },
        "training_1_2_weeks": {
          "shift": 1,
          "notes": "Behavioral models still converging. Treat hardened ratings with caution."
        },
        "trained_2_plus_weeks": {
          "shift": 0,
          "notes": "Default hardened assumption. Behavioral baselines stable enough to flag deviations."
        }
      }
    },
    "policy_statefulness": {
      "name": "WAF policy statefulness",
      "applies_to": [
        "cloud_cdn",
        "security_waf",
        "hybrid"
      ],
      "affects_mechanisms": [
        "M-15",
        "M-19"
      ],
      "options": {
        "stateless": {
          "shift": 0,
          "notes": "Default assumption. Each request evaluated independently."
        },
        "stateful_session": {
          "shift": -1,
          "notes": "Sliding-window per-session counters. Defeats request-rate attacks that rotate IPs but reuse sessions."
        },
        "stateful_user": {
          "shift": -2,
          "notes": "Cross-session correlation per authenticated user. Strongest stateful posture for application-layer defense."
        }
      }
    },
    "human_response_latency": {
      "name": "Operator response latency assumption",
      "applies_to": "all",
      "type": "numeric_metadata",
      "default_assumption_seconds": 300,
      "interaction": "Hardened ratings against M-18 / M-19 implicitly assume the operator sees the alert and responds within ~5 minutes. Sites with longer response latency should downshift these cells. Sites with sub-minute incident response (typically 24/7 SOCs) can leave hardened as-is."
    }
  },
  "_arch_modifier_computation": {
    "_description": "Architecture modifiers compose with the base effectiveness rating additively, like the attacker-side modifiers. The composition rule is: effective_rating = clamp(base_rating + sum(applicable_arch_modifier_shifts), 0, 3) where the 4-point scale is deadly=0, degraded=1, mitigated=2, blocked=3 and 'applicable' means the modifier's `applies_to` field includes the architecture you are evaluating, and you have selected a non-default option.",
    "scale": {
      "deadly": 0,
      "degraded": 1,
      "mitigated": 2,
      "blocked": 3
    },
    "rule": "effective = clamp(base + sum(arch_modifier_shifts), 0, 3)",
    "notes": "Numeric-metadata modifiers (engagement_latency_seconds, human_response_latency) do not contribute a numeric shift directly. They are inputs to a per-attack interaction described in their own interaction field."
  }
}