loadtest

Webapp Loadtest

Time-bounded HTTP load test with Locust. Generates a scenario file from a template, runs for the duration the user names, produces a markdown report.

Default language: match user. Output: {cwd}/pentest-output/{target-slug}-{YYYY-MM-DD}/loadtest/.

Never run without a billing-awareness check. Serverless targets (Vercel, Cloudflare Workers, AWS Lambda) charge per request. A load test that runs for 10 minutes at 50 RPS = 30,000 requests the target owner pays for. Confirm the budget before starting.

---

Phase 0 — Scope

Ask or confirm:

• Target URL — base URL, e.g. https://api.example.com
• Endpoints to hit — list of paths + methods + bodies. Default: just GET / if user didn't say.
• Auth — none / bearer token / cookie / Telegram initData / custom header. If auth is needed, ask user for the artifact once and store in secrets.env (gitignored).
• Load profile — concurrent users + ramp-up + duration. Sane defaults:
  • --users 20 --spawn-rate 2 --run-time 2m for a baseline
  • User can override with --users 100 --spawn-rate 10 --run-time 5m etc.
• RPS cap — enforced inside the generated locustfile via wait_time = between(WAIT_MIN, WAIT_MAX). Defaults WAIT_MIN=1, WAIT_MAX=2 → ~0.5–1 req/s/user → ~10–20 RPS at 20 users. Locust itself has no --no-rps-cap flag; to remove the cap, the user passes WAIT_MIN=0 WAIT_MAX=0 as env vars and the locustfile switches to constant(0) wait.
• Billing consent — confirm the target can afford this. If Vercel / serverless is involved, say it out loud.

Phase 1 — Workspace

slug=$(echo "<target-host>" | tr -cd 'a-z0-9-')
day=$(date +%Y-%m-%d)
workdir="${PWD}/pentest-output/${slug}-${day}/loadtest"
mkdir -p "${workdir}"
echo 'secrets.env
*.local.*' > "${workdir}/.gitignore"

Phase 2 — Generate Locustfile

Render references/locustfile-template.py into ${workdir}/locustfile.py. Fill in:

• Base URL
• Endpoint list (one @task(weight=N) per endpoint)
• Auth injection (headers or cookies)
• Optional: warm-up request on on_start