Top 23 Go Pentesting Projects

• ffuf

  17 11,444 5.7 Go

  Fast web fuzzer written in Go

  

Project mention: Show HN: Pfuzz, a web fuzzer following the Unix philosophy | news.ycombinator.com | 2024-01-21

It seems to me like "fuzzing" has a different meaning in web application penetration testing. Here, "fuzzer" is a term for tools that just generate different request using wordlists, without adding any mutations. For example, the two popular web fuzzers ffuf [1] and wfuzz [2] also call themselves fuzzers.

I see how reusing a term for a different concept is bothersome, but I feel like "fuzzer" is the term that people learning about bug bounty hunting are familiar with.

[1] https://github.com/ffuf/ffuf

[2] https://wfuzz.readthedocs.io/en/latest/

• gobuster

  14 9,019 4.5 Go

  Directory/File, DNS and VHost busting tool written in Go

Project mention: I need GoBuster on my OpenSUSE VM | /r/openSUSE | 2023-06-11

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• hetty

  3 5,906 0.0 Go

  An HTTP toolkit for security research.

• osmedeus

  2 5,090 6.4 Go

  A Workflow Engine for Offensive Security

• pspy

  8 4,510 0.0 Go

  Monitor linux processes without root permissions

Project mention: Ask HN: What's the big deal with Go (Golang)? | news.ycombinator.com | 2023-10-12

* https://github.com/DominicBreuker/pspy

When you deploy them they just work. Compare that to compiled C++ code you often face issues with the deployment in my experience. And production machines usually do not ship compilers.

• hakrawler

  3 4,236 0.0 Go

  Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application

• Cameradar

  3 3,891 3.4 Go

  Cameradar hacks its way into RTSP videosurveillance cameras

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

• Stowaway

  33 2,417 7.1 Go

  👻Stowaway -- Multi-hop Proxy Tool for pentesters

Project mention: Stowaway -- Multi-hop Proxy Tool for pentesters | /r/hacking | 2023-11-13

• ligolo-ng

  5 2,160 5.8 Go

  An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

  

Project mention: Actual SSH over HTTPS | news.ycombinator.com | 2023-12-23

I learned about chisel in PEN-200 / preparing for the OSCP.

Then I learned about, Ligolo-ng [1] which is a game-changer. I highly recommend checking it out. It is most applicable to a penetration test. It uses TLS so I'm not sure it could be used to address the issue mentioned in the article.

[1] https://github.com/nicocha30/ligolo-ng

• ksubdomain

  1 2,086 0.0 Go

  无状态子域名爆破工具

  

• ruler

  2 2,032 0.0 Go

  A tool to abuse Exchange services

  

Project mention: Office 365 email account with 2FA - Hacked. | /r/sysadmin | 2023-06-29

Obviously I cannot tell you what happened from just a reddit post, but from what you wrote it seems that the attacker might have discovered your executive's password from some leak and modified the user's outlook rules through the (I assume) publicly exposed MAPI functionality. Even with MFA enabled you can still bypass it with tools like Ruler.

• gitjacker

  1 1,529 0.0 Go

  🔪 :octocat: Leak git repositories from misconfigured websites

• cariddi

  7 1,352 7.6 Go

  Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

• metabigor

  1 1,141 6.4 Go

  OSINT tools and more but without API key

• nomore403

  1 954 6.0 Go

  Tool to bypass 403/40X response codes.

• pretender

  1 903 5.4 Go

  Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing. (by RedTeamPentesting)

  

• reverse_ssh

  2 819 9.0 Go

  SSH based reverse shell

• cent

  1 775 8.0 Go

  Community edition nuclei templates, a simple tool that allows you to organize all the Nuclei templates offered by the community in one place (by xm1k3)

• scilla

  4 746 8.0 Go

  Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

• nmap-formatter

  1 602 5.7 Go

  A tool that allows you to convert NMAP results to html, csv, json, markdown, graphviz (dot) or sqlite. Simply put it's nmap converter.

Project mention: NMAP-formatter: convert NMAP results to HTML, CSV, JSON, graphviz (dot), SQLite | news.ycombinator.com | 2024-01-26

• firefly

  1 371 8.7 Go

  Black box fuzzer for web applications (by Brum3ns)

• BucketLoot

  3 335 6.7 Go

  BucketLoot is an automated S3-compatible bucket inspector that can help users extract assets, flag secret exposures and even search for custom keywords as well as Regular Expressions from publicly-exposed storage buckets by scanning files that store data in plain-text.

  

Project mention: Open source S3 bucket scanner for secrets and assets | news.ycombinator.com | 2023-10-11

• KittyStager

  2 201 4.6 Go

  KittyStager is a simple stage 0 C2. It is made of a web server to host the shellcode and an implant, called kitten. The purpose of this project is to be able to have a web server and some kitten and be able to use the with any shellcode.

Project mention: KittyStager: KittyStager is a simple stage 0 C2. It is made of a web server to host the shellcode and an implant, called kitten. The purpose of this project is to be able to have a web server and some kitten and be able to use the with any shellcode. | /r/blueteamsec | 2023-05-25

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

Go Pentesting related posts

• Show HN: Pfuzz, a web fuzzer following the Unix philosophy

  6 projects | news.ycombinator.com | 21 Jan 2024

• Fast web fuzzer written in Go

  1 project | news.ycombinator.com | 24 Dec 2023

• Stowaway -- Multi-hop Proxy Tool for pentesters

  1 project | /r/hacking | 13 Nov 2023

• Ask HN: What's the big deal with Go (Golang)?

  3 projects | news.ycombinator.com | 12 Oct 2023

• Stowaway -- Multi-hop Proxy Tool for pentesters

  1 project | /r/cybersecurity | 11 Sep 2023

• Office 365 email account with 2FA - Hacked.

  1 project | /r/sysadmin | 29 Jun 2023

• Multi-hop proxy tool for pentesters XD

  1 project | /r/netsec | 12 Jun 2023
• A note from our sponsor - InfluxDB
  www.influxdata.com | 5 May 2024

  Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality. Learn more →

Index

Sponsored

SaaSHub - Software Alternatives and Reviews

SaaSHub helps you find the best software and product alternatives

www.saashub.com

Do not miss the trending Go projects with our weekly report!