Web Interface

Overview

The Miku Miku Beam web interface provides a user-friendly graphical control panel for launching and monitoring attacks. It communicates with the backend server via Socket.IO for real-time statistics.

Starting the Server

Launch the web server using the mmb-server binary:

./bin/mmb-server

By default, the server listens on port 3000. You’ll see output like:

Server listening on :3000
Serving static files from bin/web-client

Server Flags

--no-proxy

boolean

default:"false"

Allow attacks without proxies. Can also be set via ALLOW_NO_PROXY=true environment variable.

Environment Variables

LOG_FORMAT

string

default:"console"

Set to json for JSON-formatted logs, or leave unset for human-readable console output

ALLOW_NO_PROXY

boolean

default:"false"

Set to true to allow attacks without proxies (equivalent to --no-proxy flag)

Accessing the Interface

Once the server is running, open your browser and navigate to:

http://localhost:3000

The web interface is served from either bin/web-client or web-client/dist depending on your build configuration.

Features

Attack Configuration

The web interface provides an intuitive form for configuring attacks:

Select Attack Method

Choose from available attack types:

http_flood - Standard HTTP flood
http_bypass - Bypass-focused HTTP attack
http_slowloris - Slowloris attack
tcp_flood - TCP-level flood
minecraft_ping - Minecraft server ping flood

Enter Target

Specify the target URL or address:

HTTP: http://example.com or https://example.com:8443
TCP: tcp://192.168.1.100:80
Minecraft: mc.example.com:25565

Configure Parameters

Set attack parameters:

Duration - Attack length in seconds (default: 60)
Packet Delay - Delay between packets in ms (default: 500)
Packet Size - Size of each packet in bytes (default: 512)
Threads - Number of concurrent threads (0 = auto)

Launch Attack

Click the attack button to begin. The interface immediately switches to monitoring mode.

Real-Time Statistics

Once an attack is running, the interface displays live statistics:

PPS

int

Packets per second - current attack rate

Total Packets

int

Cumulative packets sent since attack started

Proxies

int

Number of proxies currently in use

Log

string

Detailed attack logs and status messages (always verbose in web mode)

Configuration Management

The web interface allows you to manage proxies and user agents directly from the browser:

View Configuration
Update Configuration

The server exposes a GET /configuration endpoint that returns current proxy and user agent lists (base64 encoded).

{
  "proxies": "<base64-encoded proxy list>",
  "uas": "<base64-encoded user agent list>"
}

Send a POST /configuration request with updated lists:

{
  "proxies": "<base64-encoded proxy list>",
  "uas": "<base64-encoded user agent list>"
}

The server writes changes to the configured files (data/proxies.txt and data/uas.txt by default).

Socket.IO Communication

The web interface uses Socket.IO for bidirectional real-time communication.

Client Events

startAttack

object

Initiates a new attack with specified parameters:

socket.emit('startAttack', {
  target: 'http://example.com',
  attackMethod: 'http_flood',
  duration: 60,
  packetDelay: 500,
  packetSize: 512,
  threads: 0
});

stopAttack

void

Immediately stops the current attack:

socket.emit('stopAttack');

Server Events

stats

object

Real-time statistics updated every second:

socket.on('stats', (data) => {
  console.log('PPS:', data.pps);
  console.log('Total:', data.totalPackets);
  console.log('Proxies:', data.proxies);
  console.log('Log:', data.log); // Optional
});

attackAccepted

object

Confirmation that attack has started:

socket.on('attackAccepted', (data) => {
  console.log('Attack started with', data.proxies, 'proxies');
});

attackError

object

Error message if attack cannot start:

socket.on('attackError', (data) => {
  console.error('Attack failed:', data.message);
});

attackEnd

void

Notification that attack has completed or been stopped:

socket.on('attackEnd', () => {
  console.log('Attack ended');
});

REST API Endpoints

In addition to Socket.IO, the server provides HTTP endpoints:

List Available Attacks

GET /attacks

Response:

{
  "attacks": [
    "http_flood",
    "http_bypass",
    "http_slowloris",
    "tcp_flood",
    "minecraft_ping"
  ]
}

Get Configuration

GET /configuration

Response:

{
  "proxies": "aHR0cDovLzEuMi4zLjQ6ODA4MA==",
  "uas": "TW96aWxsYS81LjA..."
}

Proxy and user agent lists are base64-encoded.

Update Configuration

POST /configuration
Content-Type: application/json

{
  "proxies": "<base64-encoded proxy list>",
  "uas": "<base64-encoded user agent list>"
}

Response:

OK

CORS Configuration

The server supports CORS to allow frontend development servers to connect. By default, it allows:

Origin: http://localhost:5173 (Vite dev server)
Methods: GET, POST
Headers: Content-Type

To change the allowed origin, update your configuration file.

Running Without Proxies

By default, the web server requires proxies. To allow attacks without proxies:

./bin/mmb-server --no-proxy

Running without proxies exposes your server’s IP address. Only use this for local testing.

Multiple Clients

The server supports multiple simultaneous connections. Each client gets its own attack instance:

Client attacks are tracked by Socket.IO client ID
Each client can run one attack at a time
Starting a new attack automatically stops the previous one
Disconnecting automatically stops the client’s attack

Monitoring Server Logs

The server provides detailed logging of all operations:

Console Format (Default)
JSON Format

Human-readable logs for development:

2026-03-03T10:15:30Z INF socket connected id=abc123
2026-03-03T10:15:35Z INF startAttack received: method=http_flood target=http://example.com duration=60s
2026-03-03T10:15:35Z INF attack started: id=client-abc123 method=http_flood proxies=1250

Machine-readable logs for production:

LOG_FORMAT=json ./bin/mmb-server

Output:

{"level":"info","time":"2026-03-03T10:15:30Z","message":"socket connected id=abc123"}
{"level":"info","time":"2026-03-03T10:15:35Z","message":"startAttack received: method=http_flood..."}

Troubleshooting

Static Assets Not Found

Static web assets not found (bin/web-client or web-client/dist). Panel will be unavailable.

Solution: Build the web client first:

cd web-client
npm install
npm run build
cd ..
make build

No Proxies Available

{"message": "No proxies available; set ALLOW_NO_PROXY=true or --no-proxy to run without proxies"}

Solution: Either add proxies to your config file or start the server with --no-proxy.

CORS Errors

If developing the frontend separately, update the allowed_origin in your configuration file to match your dev server URL.

Best Practices

Use HTTPS

Deploy behind a reverse proxy with TLS for production use

Restrict Access

Use firewall rules or authentication to prevent unauthorized access

Monitor Resources

Keep an eye on server CPU/memory, especially with multiple clients

Log Everything

Use JSON logging in production for better monitoring and debugging

Get Started

Core Concepts

Usage

Attack Methods

Deployment

Development

Help

Overview

Starting the Server

Server Flags

Environment Variables

Accessing the Interface

Features

Attack Configuration

Real-Time Statistics

Configuration Management

Socket.IO Communication

Client Events

Server Events

REST API Endpoints

List Available Attacks

Get Configuration

Update Configuration

CORS Configuration

Running Without Proxies

Multiple Clients

Monitoring Server Logs

Troubleshooting

Static Assets Not Found

No Proxies Available

CORS Errors

Best Practices

Use HTTPS

Restrict Access

Monitor Resources

Log Everything

Build docs developers (and LLMs) love

Get Started

Core Concepts

Usage

Attack Methods

Deployment

Development

Help

​Overview

​Starting the Server

​Server Flags

​Environment Variables

​Accessing the Interface

​Features

​Attack Configuration

​Real-Time Statistics

​Configuration Management

​Socket.IO Communication

​Client Events

​Server Events

​REST API Endpoints

​List Available Attacks

​Get Configuration

​Update Configuration

​CORS Configuration

​Running Without Proxies

​Multiple Clients

​Monitoring Server Logs

​Troubleshooting

​Static Assets Not Found

​No Proxies Available

​CORS Errors

​Best Practices

Use HTTPS

Restrict Access

Monitor Resources

Log Everything

Build docs developers (and LLMs) love

Overview

Starting the Server

Server Flags

Environment Variables

Accessing the Interface

Features

Attack Configuration

Real-Time Statistics

Configuration Management

Socket.IO Communication

Client Events

Server Events

REST API Endpoints

List Available Attacks

Get Configuration

Update Configuration

CORS Configuration

Running Without Proxies

Multiple Clients

Monitoring Server Logs

Troubleshooting

Static Assets Not Found

No Proxies Available

CORS Errors

Best Practices