CVE-2020-6308

CVE-2020-6308 Exploit script for SAP Business Objects SSRF This is a simple Golang script to automate the exploitation of CVE-2020-6308. The original Github repo did not show any automation https://github.com/InitRoot/CVE-2020-6308-PoC , thanks @InitRoot, so this was made in an effort to help...

godehashed

Godehashed A golang tool that uses the dehashed.com API to search for compromised assets. Results can then be compiled into a CSV for further analysis. Screenshot Dehashed API You must supply the tool an api key. See apikeytemplate.txt for example. Installation To install the tool in CLI run the...

totp-ssh-fluxer

TOTP SSH port fluxing Some people change their SSH port on their servers so that it is slightly harder to find for bots or other nasties, and while that is generally viewed as an action of security through obscurity it does work very well at killing a lot of the automated logins you always see in...

CVE-2018-6892-Golang

CVE-2018-6892-Golang Ported Exploit From Python To Golang https://packetstormsecurity.com/files/157407/CloudMe-1.11.2-Buffer-Overflow.html...

casbin

Apache Casbin News : still worry about how to write the correct Apache Casbin policy? Apache Casbin online editor is coming to help! Try it at: https://casbin.apache.org/editor/ Apache Casbin is a powerful and efficient open-source access control library for Golang projects. It provides support f...

scour

Scour - AWS Detection Framework This tool is used to emulate attack patterns inside of the AWS Controlplane. Each attack is tagged with a specific UA for the blue team to signal off of. Status This is still an active work in progress. Lots of Bugs Not ready for production Where to file issues :...

Mythic

Mythic A cross-platform, post-exploit, red teaming framework built with GoLang, docker, docker-compose, and a web browser UI. It's designed to provide a collaborative and user friendly interface for operators, managers, and reporting throughout red teaming. Check out a series of YouTube videos...

QueenSono

QueenSono ICMP Data Exfiltration A Golang Package for Data Exfiltration with ICMP protocol IPv4 & IPv6. QueenSono tool only relies on the fact that ICMP protocol isn't monitored. It is quite common. It could also been used within a system with basic ICMP inspection ie. frequency and content lengt...

Girsh

Girsh Golang Interactive Reverse SHell Who didn't get bored of manually typing the few lines to upgrade a reverse shell to a full interactive reverse shell tty spawn, stty size ..., stty raw -echo or typing the command to use ConPTY. Description With Girsh, just run it and it will detect the OS a...

CVE-2016-10033

CVE-2016-10033 This vulnerability affects PHPMailer 5.2.18 and is able to get Remote Code Execution. Resources https://vulners.com/cve/CVE-2016-10033 Usage As it is written in Golang, you can build the exploit yourself, as long there is golang installed into your system with: cd CVE-2016-10033 go...

GoSH

GoSH Golang reverse/bind shell generator Description This tool generates a Go binary that launches a shell of the desired type on the targeted host. The shell binary can be compiled for multiple platforms, supports partial polymorphism unique functions' names and can use UDP protocol instead of t...

go-get-RCE

go-get-RCE This is the exploit of CVE-2018-6574: go get RCE This vulnerability impacts Golang go get command and allows an attacker to gain code execution on a system installing their malicious library. This is a good example of a vulnerability that can be exploited using typosquatting to gain co...

GoGhost

GoGhost GoGhost is a High Performance, lightweight, portable Open Source tool for mass SMBGhost Scan. Installation You can download Windows Binary or Linux Binary. Alternatively, GoGhost uses native Golang libraries so the line above would be fine to compile it: go build GoGhost.go Usage Options...

gosec

gosec - Go Security Checker Inspects source code for security problems by scanning the Go AST and SSA code representation. Quick links GitHub Action Local installation Quick start Common usage patterns Selecting rules Output formats Features Pattern-based rules for detecting common security issue...

neurax

A framework that aids in creation of self-spreading software Overview With help of Neurax, Golang binaries can spread on LAN/WAN without using any external servers. Diverse config options and command stagers allow rapid propagation across various wireless environments. Example code package main...

browsertunnel

browsertunnel Browsertunnel is a tool for exfiltrating data from the browser using the DNS protocol. It achieves this by abusing dns-prefetch, a feature intended to reduce the perceived latency of websites by doing DNS lookups in the background for specified domains. DNS traffic does not appear i...

Golang-CVE-2025-55182-POC

Golang-CVE-2025-55182-POC Records a simple POC I wrote...

webanalyze

webanalyze This is a port of Wappalyzer in Go. This tool is designed to be performant and allows to test huge lists of hosts. !NOTE Because Wappalyzer removed the public access to their app definitions, webanalyze currently loads definitions from enthec. Installation and usage Precompiled release...

go_parser

Yet Another Golang binary parser for IDAPro English |中文 NOTE : Now the latest master branch is the Python3 version. The old master branch has been changed to branch py2 , and temporarily not maintained. Instructions for Python3 branch This version is developed and tested on macOS/Windows, IDA7.4+...

cngo

cngo v1 Fast Golang Tool take a filename with domains and get cname for every domain s Install $ go get -u github.com/yghonem14/cngo Basic Usage cngo accepts only text files: $ cngo -f /targets/spotify.txt creativeservice.spotify.com - creativeservicespotify.s3.amazonaws.com crashdump.spotify.com...