Codebase list gobuster / run/8eaa15f4-3c4a-4d5a-90c5-83558f30a161/main
New upstream snapshot. Kali Janitor 1 year, 5 months ago
17 changed file(s) with 359 addition(s) and 151 deletion(s). Raw diff Collapse all Expand all
+0
-6
.github/FUNDING.yml less more
0 # These are supported funding model platforms
1
2 github: [OJ, firefart]
3 patreon: OJReeves
4 open_collective: gobuster
5 ko_fi: OJReeves
+0
-19
.github/dependabot.yml less more
0 # To get started with Dependabot version updates, you'll need to specify which
1 # package ecosystems to update and where the package manifests are located.
2 # Please see the documentation for all configuration options:
3 # https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
4
5 version: 2
6 updates:
7 - package-ecosystem: "gomod"
8 directory: "/"
9 target-branch: "dev"
10 schedule:
11 interval: "weekly"
12
13 - package-ecosystem: "github-actions"
14 directory: "/"
15 target-branch: "dev"
16 schedule:
17 # Check for updates to GitHub Actions every weekday
18 interval: "daily"
+0
-38
.github/workflows/go.yml less more
0 name: Go
1 on: [push, pull_request]
2 jobs:
3 build:
4 name: Build
5 runs-on: ubuntu-latest
6 strategy:
7 matrix:
8 go: ["1.18", "1.19"]
9 steps:
10 - name: Set up Go ${{ matrix.go }}
11 uses: actions/setup-go@v3
12 with:
13 go-version: ${{ matrix.go }}
14
15 - name: Check out code
16 uses: actions/[email protected]
17
18 - name: build cache
19 uses: actions/cache@v3
20 with:
21 path: ~/go/pkg/mod
22 key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
23 restore-keys: |
24 ${{ runner.os }}-go-
25
26 - name: Get dependencies
27 run: |
28 go get -v -t -d ./...
29
30 - name: Build linux
31 run: make linux
32
33 - name: Build windows
34 run: make windows
35
36 - name: Test
37 run: make test
+0
-17
.github/workflows/golangci-lint.yml less more
0 name: golangci-lint
1 on: [push, pull_request]
2 jobs:
3 golangci:
4 name: lint
5 runs-on: ubuntu-latest
6 steps:
7 - uses: actions/[email protected]
8
9 - uses: actions/setup-go@v3
10 with:
11 go-version: "^1.19"
12
13 - name: golangci-lint
14 uses: golangci/golangci-lint-action@v3
15 with:
16 version: latest
+0
-32
.github/workflows/release.yml less more
0 name: goreleaser
1
2 on:
3 push:
4 tags:
5 - "*"
6
7 permissions:
8 contents: write
9
10 jobs:
11 goreleaser:
12 runs-on: ubuntu-latest
13 steps:
14 - name: Checkout
15 uses: actions/[email protected]
16 with:
17 fetch-depth: 0
18 - name: Fetch all tags
19 run: git fetch --force --tags
20 - name: Set up Go
21 uses: actions/setup-go@v3
22 with:
23 go-version: 1.19
24 - name: Run GoReleaser
25 uses: goreleaser/goreleaser-action@v3
26 with:
27 distribution: goreleaser
28 version: latest
29 args: release --rm-dist
30 env:
31 GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+0
-25
.gitignore less more
0 # Binaries for programs and plugins
1 *.exe
2 *.exe~
3 *.dll
4 *.so
5 *.dylib
6
7 # Test binary, built with `go test -c`
8 *.test
9
10 # Output of the go coverage tool, specifically when used with LiteIDE
11 *.out
12
13 # Dependency directories (remove the comment below to include it)
14 # vendor/
15
16 *.prof
17 *.txt
18 *.swp
19
20 .vscode/
21 gobuster
22 build
23
24 dist/
0 # Gobuster v3.2.0
0 # Gobuster
11
22 Gobuster is a tool used to brute-force:
33
55 - DNS subdomains (with wildcard support).
66 - Virtual Host names on target web servers.
77 - Open Amazon S3 buckets
8 - Open Google Cloud buckets
9 - TFTP servers
810
911 ## Tags, Statuses, etc
1012
2123
2224 # Changes
2325
26 ## 3.4
27
28 - Enable TLS1.0 and TLS1.1 support
29 - Add TFTP mode to search for files on tftp servers
30
2431 ## 3.3
2532
26 - Support TLS client certificates / mtl
33 - Support TLS client certificates / mtls
2734 - support loading extensions from file
2835 - support fuzzing POST body, HTTP headers and basic auth
2936 - new option to not canonicalize header names
6774 - gcs - Enumerate open google cloud buckets
6875 - vhost - virtual host brute-forcing mode (not the same as DNS!)
6976 - fuzz - some basic fuzzing, replaces the `FUZZ` keyword
77 - tftp - bruteforce tftp files
7078
7179 ## Easy Installation
7280
683691 gobuster gcs -w bucket-names.txt
684692 ```
685693
694 ## `tftp` Mode
695
696 ### Options
697
698 ```text
699 Uses TFTP enumeration mode
700
701 Usage:
702 gobuster tftp [flags]
703
704 Flags:
705 -h, --help help for tftp
706 -s, --server string The target TFTP server
707 --timeout duration TFTP timeout (default 1s)
708
709 Global Flags:
710 --delay duration Time each thread waits between requests (e.g. 1500ms)
711 --no-color Disable color output
712 --no-error Don't display errors
713 -z, --no-progress Don't display progress
714 -o, --output string Output file to write results to (defaults to stdout)
715 -p, --pattern string File containing replacement patterns
716 -q, --quiet Don't print the banner and other noise
717 -t, --threads int Number of concurrent threads (default 10)
718 -v, --verbose Verbose output (errors)
719 -w, --wordlist string Path to the wordlist
720 ```
721
722 ### Examples
723
724 ```text
725 gobuster tftp -s tftp.example.com -w common-filenames.txt
726 ```
727
728
686729 ## Wordlists via STDIN
687730
688731 Wordlists can be piped into `gobuster` via stdin by providing a `-` to the `-w` option:
0 package cmd
1
2 import (
3 "fmt"
4 "log"
5 "strings"
6 "time"
7
8 "github.com/OJ/gobuster/v3/cli"
9 "github.com/OJ/gobuster/v3/gobustertftp"
10 "github.com/OJ/gobuster/v3/libgobuster"
11 "github.com/spf13/cobra"
12 )
13
14 // nolint:gochecknoglobals
15 var cmdTFTP *cobra.Command
16
17 func runTFTP(cmd *cobra.Command, args []string) error {
18 globalopts, pluginopts, err := parseTFTPOptions()
19 if err != nil {
20 return fmt.Errorf("error on parsing arguments: %w", err)
21 }
22
23 plugin, err := gobustertftp.NewGobusterTFTP(globalopts, pluginopts)
24 if err != nil {
25 return fmt.Errorf("error on creating gobustertftp: %w", err)
26 }
27
28 if err := cli.Gobuster(mainContext, globalopts, plugin); err != nil {
29 return fmt.Errorf("error on running gobuster: %w", err)
30 }
31 return nil
32 }
33
34 func parseTFTPOptions() (*libgobuster.Options, *gobustertftp.OptionsTFTP, error) {
35 globalopts, err := parseGlobalOptions()
36 if err != nil {
37 return nil, nil, err
38 }
39 pluginOpts := gobustertftp.NewOptionsTFTP()
40
41 pluginOpts.Server, err = cmdTFTP.Flags().GetString("server")
42 if err != nil {
43 return nil, nil, fmt.Errorf("invalid value for domain: %w", err)
44 }
45
46 if !strings.Contains(pluginOpts.Server, ":") {
47 pluginOpts.Server = fmt.Sprintf("%s:69", pluginOpts.Server)
48 }
49
50 pluginOpts.Timeout, err = cmdTFTP.Flags().GetDuration("timeout")
51 if err != nil {
52 return nil, nil, fmt.Errorf("invalid value for timeout: %w", err)
53 }
54
55 return globalopts, pluginOpts, nil
56 }
57
58 // nolint:gochecknoinits
59 func init() {
60 cmdTFTP = &cobra.Command{
61 Use: "tftp",
62 Short: "Uses TFTP enumeration mode",
63 RunE: runTFTP,
64 }
65
66 cmdTFTP.Flags().StringP("server", "s", "", "The target TFTP server")
67 cmdTFTP.Flags().DurationP("timeout", "", time.Second, "TFTP timeout")
68 if err := cmdTFTP.MarkFlagRequired("server"); err != nil {
69 log.Fatalf("error on marking flag as required: %v", err)
70 }
71
72 cmdTFTP.PersistentPreRun = func(cmd *cobra.Command, args []string) {
73 configureGlobalOptions()
74 }
75
76 rootCmd.AddCommand(cmdTFTP)
77 }
8686 }
8787 }
8888 case <-ctx.Done():
89 fmt.Println()
8990 return
9091 }
9192 }
0 gobuster (3.4.0+git20221219.1.c49ddbf-0kali1) UNRELEASED; urgency=low
1
2 * New upstream snapshot.
3
4 -- Kali Janitor <[email protected]> Mon, 19 Dec 2022 22:38:57 -0000
5
06 gobuster (3.3.0-0kali1) kali-dev; urgency=medium
17
28 * New upstream version 3.3.0
44 require (
55 github.com/fatih/color v1.13.0
66 github.com/google/uuid v1.3.0
7 github.com/pin/tftp/v3 v3.0.0
78 github.com/spf13/cobra v1.6.1
8 golang.org/x/crypto v0.1.0
9 golang.org/x/term v0.1.0
9 golang.org/x/crypto v0.4.0
10 golang.org/x/term v0.3.0
1011 )
1112
1213 require (
13 github.com/inconshreveable/mousetrap v1.0.1 // indirect
14 github.com/inconshreveable/mousetrap v1.1.0 // indirect
1415 github.com/mattn/go-colorable v0.1.13 // indirect
1516 github.com/mattn/go-isatty v0.0.16 // indirect
1617 github.com/spf13/pflag v1.0.5 // indirect
17 golang.org/x/sys v0.1.0 // indirect
18 golang.org/x/net v0.4.0 // indirect
19 golang.org/x/sys v0.3.0 // indirect
1820 )
22 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
33 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
44 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
5 github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
65 github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
6 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
7 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
78 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
89 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
910 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
1112 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
1213 github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ=
1314 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
15 github.com/pin/tftp/v3 v3.0.0 h1:o9cQpmWBSbgiaYXuN+qJAB12XBIv4dT7OuOONucn2l0=
16 github.com/pin/tftp/v3 v3.0.0/go.mod h1:xwQaN4viYL019tM4i8iecm++5cGxSqen6AJEOEyEI0w=
1417 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
1518 github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=
1619 github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
1720 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
1821 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
19 golang.org/x/crypto v0.1.0 h1:MDRAIl0xIo9Io2xV565hzXHw3zVseKrJKodhohM5CjU=
20 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
22 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
23 golang.org/x/crypto v0.4.0 h1:UVQgzMY87xqpKNgb+kDsll2Igd33HszWHFLmpaRMq/8=
24 golang.org/x/crypto v0.4.0/go.mod h1:3quD/ATkf6oY+rnes5c3ExXTbLc8mueNue5/DoinL80=
25 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
26 golang.org/x/net v0.4.0 h1:Q5QPcMlvfxFTAPV0+07Xz/MpK9NTXu2VDUuy0FeMfaU=
27 golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
28 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
2129 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
2230 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
2331 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
2432 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
25 golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
26 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
27 golang.org/x/term v0.1.0 h1:g6Z6vPFA9dYBAF7DWcH6sCcOntplXsDKcliusYijMlw=
28 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
33 golang.org/x/sys v0.3.0 h1:w8ZOecv6NaNa/zC8944JTU3vz4u6Lagfk4RPQxv92NQ=
34 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
35 golang.org/x/term v0.3.0 h1:qoo4akIqOcDME5bhc/NgxUdovd6BSS2uMsVjB56q1xI=
36 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
37 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
2938 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
3039 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
0 package gobustertftp
1
2 import (
3 "bufio"
4 "bytes"
5 "context"
6 "fmt"
7 "strings"
8 "text/tabwriter"
9
10 "github.com/OJ/gobuster/v3/libgobuster"
11
12 "github.com/pin/tftp/v3"
13 )
14
15 // GobusterTFTP is the main type to implement the interface
16 type GobusterTFTP struct {
17 globalopts *libgobuster.Options
18 options *OptionsTFTP
19 }
20
21 // NewGobusterTFTP creates a new initialized NewGobusterTFTP
22 func NewGobusterTFTP(globalopts *libgobuster.Options, opts *OptionsTFTP) (*GobusterTFTP, error) {
23 if globalopts == nil {
24 return nil, fmt.Errorf("please provide valid global options")
25 }
26
27 if opts == nil {
28 return nil, fmt.Errorf("please provide valid plugin options")
29 }
30
31 g := GobusterTFTP{
32 options: opts,
33 globalopts: globalopts,
34 }
35 return &g, nil
36 }
37
38 // Name should return the name of the plugin
39 func (d *GobusterTFTP) Name() string {
40 return "TFTP enumeration"
41 }
42
43 // PreRun is the pre run implementation of gobustertftp
44 func (d *GobusterTFTP) PreRun(ctx context.Context) error {
45 _, err := tftp.NewClient(d.options.Server)
46 if err != nil {
47 return err
48 }
49 return nil
50 }
51
52 // ProcessWord is the process implementation of gobustertftp
53 func (d *GobusterTFTP) ProcessWord(ctx context.Context, word string, progress *libgobuster.Progress) error {
54 c, err := tftp.NewClient(d.options.Server)
55 if err != nil {
56 return err
57 }
58 c.SetTimeout(d.options.Timeout)
59 wt, err := c.Receive(word, "octet")
60 if err != nil {
61 // file not found
62 if d.globalopts.Verbose {
63 progress.ResultChan <- Result{
64 Filename: word,
65 Found: false,
66 ErrorMessage: err.Error(),
67 }
68 }
69
70 return nil
71 }
72 result := Result{
73 Filename: word,
74 Found: true,
75 }
76 if n, ok := wt.(tftp.IncomingTransfer).Size(); ok {
77 result.Size = n
78 }
79 progress.ResultChan <- result
80 return nil
81 }
82
83 func (d *GobusterTFTP) AdditionalWords(word string) []string {
84 return []string{}
85 }
86
87 // GetConfigString returns the string representation of the current config
88 func (d *GobusterTFTP) GetConfigString() (string, error) {
89 var buffer bytes.Buffer
90 bw := bufio.NewWriter(&buffer)
91 tw := tabwriter.NewWriter(bw, 0, 5, 3, ' ', 0)
92 o := d.options
93
94 if _, err := fmt.Fprintf(tw, "[+] Server:\t%s\n", o.Server); err != nil {
95 return "", err
96 }
97
98 if _, err := fmt.Fprintf(tw, "[+] Threads:\t%d\n", d.globalopts.Threads); err != nil {
99 return "", err
100 }
101
102 if d.globalopts.Delay > 0 {
103 if _, err := fmt.Fprintf(tw, "[+] Delay:\t%s\n", d.globalopts.Delay); err != nil {
104 return "", err
105 }
106 }
107
108 if _, err := fmt.Fprintf(tw, "[+] Timeout:\t%s\n", o.Timeout.String()); err != nil {
109 return "", err
110 }
111
112 wordlist := "stdin (pipe)"
113 if d.globalopts.Wordlist != "-" {
114 wordlist = d.globalopts.Wordlist
115 }
116 if _, err := fmt.Fprintf(tw, "[+] Wordlist:\t%s\n", wordlist); err != nil {
117 return "", err
118 }
119
120 if d.globalopts.PatternFile != "" {
121 if _, err := fmt.Fprintf(tw, "[+] Patterns:\t%s (%d entries)\n", d.globalopts.PatternFile, len(d.globalopts.Patterns)); err != nil {
122 return "", err
123 }
124 }
125
126 if d.globalopts.Verbose {
127 if _, err := fmt.Fprintf(tw, "[+] Verbose:\ttrue\n"); err != nil {
128 return "", err
129 }
130 }
131
132 if err := tw.Flush(); err != nil {
133 return "", fmt.Errorf("error on tostring: %w", err)
134 }
135
136 if err := bw.Flush(); err != nil {
137 return "", fmt.Errorf("error on tostring: %w", err)
138 }
139
140 return strings.TrimSpace(buffer.String()), nil
141 }
0 package gobustertftp
1
2 import (
3 "time"
4 )
5
6 // OptionsTFTP holds all options for the tftp plugin
7 type OptionsTFTP struct {
8 Server string
9 Timeout time.Duration
10 }
11
12 // NewOptionsTFTP returns a new initialized OptionsTFTP
13 func NewOptionsTFTP() *OptionsTFTP {
14 return &OptionsTFTP{}
15 }
0 package gobustertftp
1
2 import (
3 "bytes"
4 "fmt"
5
6 "github.com/fatih/color"
7 )
8
9 var (
10 red = color.New(color.FgRed).FprintfFunc()
11 green = color.New(color.FgGreen).FprintfFunc()
12 )
13
14 // Result represents a single result
15 type Result struct {
16 Filename string
17 Found bool
18 Size int64
19 ErrorMessage string
20 }
21
22 // ResultToString converts the Result to it's textual representation
23 func (r Result) ResultToString() (string, error) {
24 buf := &bytes.Buffer{}
25
26 if r.Found {
27 green(buf, "Found: ")
28 if _, err := fmt.Fprintf(buf, "%s", r.Filename); err != nil {
29 return "", err
30 }
31 if r.Size > 0 {
32 if _, err := fmt.Fprintf(buf, " [%d]", r.Size); err != nil {
33 return "", err
34 }
35 }
36 } else {
37 red(buf, "Missed: ")
38 if _, err := fmt.Fprintf(buf, "%s - %s", r.Filename, r.ErrorMessage); err != nil {
39 return "", err
40 }
41 }
42
43 s := buf.String()
44 return s, nil
45 }
6969
7070 tlsConfig := tls.Config{
7171 InsecureSkipVerify: opt.NoTLSValidation,
72 // enable TLS1.0 and TLS1.1 support
73 MinVersion: tls.VersionTLS10,
7274 }
7375 if opt.TLSCertificate != nil {
7476 tlsConfig.Certificates = []tls.Certificate{*opt.TLSCertificate}
11
22 const (
33 // VERSION contains the current gobuster version
4 VERSION = "3.3"
4 VERSION = "3.4"
55 )