Local DNS cache, tuned kernel, expanded file descriptors, and swap — all installed and hardened in a single paste. Built for hunters running 100+ concurrent scans.
Tuned for the tools you already run
Every line does one job — no bloat, no daemons you don't need, nothing that lingers past a paste.
dnsmasq bound to loopback with a 100k-entry cache and Cloudflare + Google upstreams. Resolves are near-instant, even under load.
chattr +i on /etc/resolv.conf so nothing overwrites it.
Expanded ephemeral port range, TIME_WAIT reuse, huge SYN backlog for parallel workloads.
Soft and hard nofile limits raised so scanners never hit EMFILE.
4GB swap file provisioned and persisted in /etc/fstab.
Re-runnable. Non-fatal errors silenced. No prompts, no surprises.
Run as root on a fresh Debian or Ubuntu VPS. Silences non-fatal errors, re-runnable, and finishes in under thirty seconds.
apt-get update -qq && apt-get install -y -qq dnsmasq 2>/dev/null; systemctl stop systemd-resolved 2>/dev/null; systemctl disable systemd-resolved 2>/dev/null; echo "nameserver 127.0.0.1" > /etc/resolv.conf; chattr +i /etc/resolv.conf 2>/dev/null; printf '%s\n' 'bind-interfaces' 'interface=lo' 'no-resolv' 'server=1.1.1.1' 'server=8.8.8.8' 'cache-size=100000' 'neg-ttl=3600' 'dns-forward-max=10000' > /etc/dnsmasq.conf; systemctl restart dnsmasq 2>/dev/null; printf '%s\n' 'net.ipv4.ip_local_port_range=1024 65535' 'net.ipv4.tcp_tw_reuse=1' 'fs.file-max=999999999' 'net.core.somaxconn=65535' 'net.core.netdev_max_backlog=100000' > /etc/sysctl.d/99-bugbounty.conf; sysctl -p /etc/sysctl.d/99-bugbounty.conf 2>/dev/null; printf '%s\n' ' soft nofile 999999999' ' hard nofile 999999999' > /etc/security/limits.d/99-bugbounty.conf; fallocate -l 4G /swapfile 2>/dev/null && chmod 600 /swapfile && mkswap /swapfile 2>/dev/null && swapon /swapfile 2>/dev/null && echo "/swapfile none swap sw 0 0" >> /etc/fstab; echo "===== VPS HARDENED FOR 100+ SCANS ====="Debian or Ubuntu 22.04+. Root shell required.
One click, one clipboard, no editing.
Executes end-to-end. No prompts, no interaction.
Kick off nuclei, subfinder, httpx — full concurrency.
No. It's designed for disposable VPS instances dedicated to scanning. It disables systemd-resolved and locks /etc/resolv.conf via chattr.
Debian and Ubuntu (22.04+ recommended). Any distro with apt, systemd, and chattr should work with minor edits.
Yes. Package installs are idempotent, sysctl values are re-applied, and swap allocation is guarded by fallocate checks.
No. dnsmasq is explicitly bound to the loopback interface, so no service is exposed to the network.
chattr -i /etc/resolv.conf, remove /etc/sysctl.d/99-bugbounty.conf, /etc/security/limits.d/99-bugbounty.conf, and the /swapfile fstab entry, then reboot.