diff --git a/.dockerignore b/.dockerignore index 0961e36..159cb28 100644 --- a/.dockerignore +++ b/.dockerignore @@ -7,3 +7,4 @@ gobuster .git/ mitm* +.idea/ diff --git a/.idea/.gitignore b/.idea/.gitignore new file mode 100644 index 0000000..13566b8 --- /dev/null +++ b/.idea/.gitignore @@ -0,0 +1,8 @@ +# Default ignored files +/shelf/ +/workspace.xml +# Editor-based HTTP Client requests +/httpRequests/ +# Datasource local storage ignored files +/dataSources/ +/dataSources.local.xml diff --git a/.idea/gobuster.iml b/.idea/gobuster.iml new file mode 100644 index 0000000..5e764c4 --- /dev/null +++ b/.idea/gobuster.iml @@ -0,0 +1,9 @@ + + + + + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 0000000..75b76c4 --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000..35eb1dd --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/README.md b/README.md index 12c66b1..ba3ac76 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ Gobuster is a tool used to brute-force: -- URIs (directories and files) in web sites. +- URIs (directories and files) in websites. - DNS subdomains (with wildcard support). - Virtual Host names on target web servers. - Open Amazon S3 buckets diff --git a/cli/dir/dir.go b/cli/dir/dir.go index ac94cc3..1df9dc1 100644 --- a/cli/dir/dir.go +++ b/cli/dir/dir.go @@ -79,7 +79,7 @@ func run(c *cli.Context) error { pluginOpts.StatusCodesBlacklistParsed = ret3 if pluginOpts.StatusCodes != "" && pluginOpts.StatusCodesBlacklist != "" { - return fmt.Errorf("status-codes (%q) and status-codes-blacklist (%q) are both set - please set only one. status-codes-blacklist is set by default so you might want to disable it by supplying an empty string.", + return fmt.Errorf("status-codes (%q) and status-codes-blacklist (%q) are both set - please set only one. status-codes-blacklist is set by default so you might want to disable it by supplying an empty string", pluginOpts.StatusCodes, pluginOpts.StatusCodesBlacklist) } diff --git a/cli/dir/dir_test.go b/cli/dir/dir_test.go index e27f2b1..066b18e 100644 --- a/cli/dir/dir_test.go +++ b/cli/dir/dir_test.go @@ -17,7 +17,9 @@ import ( func httpServer(b *testing.B, content string) *httptest.Server { b.Helper() ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - fmt.Fprint(w, content) + if _, err := fmt.Fprint(w, content); err != nil { + b.Fatalf("%v", err) + } })) return ts } @@ -51,7 +53,9 @@ func BenchmarkDirMode(b *testing.B) { for w := 0; w < 1000; w++ { _, _ = wordlist.WriteString(fmt.Sprintf("%d\n", w)) } - wordlist.Close() + if err := wordlist.Close(); err != nil { + b.Fatalf("%v", err) + } globalopts := libgobuster.Options{ Threads: 10, diff --git a/cli/vhost/vhost_test.go b/cli/vhost/vhost_test.go index 6fd4424..bd12338 100644 --- a/cli/vhost/vhost_test.go +++ b/cli/vhost/vhost_test.go @@ -17,7 +17,9 @@ import ( func httpServer(b *testing.B, content string) *httptest.Server { b.Helper() ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - fmt.Fprint(w, content) + if _, err := fmt.Fprint(w, content); err != nil { + b.Fatalf("%v", err) + } })) return ts } @@ -38,7 +40,9 @@ func BenchmarkVhostMode(b *testing.B) { for w := 0; w < 1000; w++ { _, _ = wordlist.WriteString(fmt.Sprintf("%d\n", w)) } - wordlist.Close() + if err := wordlist.Close(); err != nil { + b.Fatalf("%v", err) + } globalopts := libgobuster.Options{ Threads: 10, diff --git a/gobusterdir/gobusterdir.go b/gobusterdir/gobusterdir.go index fd54523..fb9b3d0 100644 --- a/gobusterdir/gobusterdir.go +++ b/gobusterdir/gobusterdir.go @@ -101,7 +101,7 @@ func (d *GobusterDir) Name() string { } // PreRun is the pre run implementation of gobusterdir -func (d *GobusterDir) PreRun(ctx context.Context, progress *libgobuster.Progress) error { +func (d *GobusterDir) PreRun(ctx context.Context, _ *libgobuster.Progress) error { // add trailing slash if !strings.HasSuffix(d.options.URL, "/") { d.options.URL = fmt.Sprintf("%s/", d.options.URL) @@ -237,7 +237,7 @@ func (d *GobusterDir) ProcessWord(ctx context.Context, word string, progress *li if os.IsTimeout(err) && i != tries { continue } else if strings.Contains(err.Error(), "invalid control character in URL") { - // put error in error chan so it's printed out and ignore it + // put error in error chan, so it's printed out and ignore it // so gobuster will not quit progress.ErrorChan <- err continue diff --git a/gobusterdir/result.go b/gobusterdir/result.go index a252274..c9ec9a2 100644 --- a/gobusterdir/result.go +++ b/gobusterdir/result.go @@ -25,7 +25,7 @@ type Result struct { Size int64 } -// ResultToString converts the Result to it's textual representation +// ResultToString converts the Result to its textual representation func (r Result) ResultToString() (string, error) { buf := &bytes.Buffer{} if _, err := buf.WriteString(r.Path); err != nil { @@ -33,18 +33,18 @@ func (r Result) ResultToString() (string, error) { } if r.StatusCode >= 0 { - color := white + textColor := white if r.StatusCode == 200 { - color = green + textColor = green } else if r.StatusCode >= 300 && r.StatusCode < 400 { - color = cyan + textColor = cyan } else if r.StatusCode >= 400 && r.StatusCode < 500 { - color = yellow + textColor = yellow } else if r.StatusCode >= 500 && r.StatusCode < 600 { - color = red + textColor = red } - color(buf, " (Status: %d)", r.StatusCode) + textColor(buf, " (Status: %d)", r.StatusCode) } if r.Size >= 0 { diff --git a/gobusterdns/gobusterdns.go b/gobusterdns/gobusterdns.go index d066fc9..3be0c14 100644 --- a/gobusterdns/gobusterdns.go +++ b/gobusterdns/gobusterdns.go @@ -112,7 +112,7 @@ func (d *GobusterDNS) PreRun(ctx context.Context, progress *libgobuster.Progress func (d *GobusterDNS) ProcessWord(ctx context.Context, word string, progress *libgobuster.Progress) error { subdomain := fmt.Sprintf("%s.%s", word, d.options.Domain) if !d.options.NoFQDN && !strings.HasSuffix(subdomain, ".") { - // add a . to indicate this is the full domain and we do not want to traverse the search domains on the system + // add a . to indicate this is the full domain, and we do not want to traverse the search domains on the system subdomain = fmt.Sprintf("%s.", subdomain) } @@ -159,7 +159,7 @@ func (d *GobusterDNS) ProcessWord(ctx context.Context, word string, progress *li return nil } -func (d *GobusterDNS) AdditionalWords(word string) []string { +func (d *GobusterDNS) AdditionalWords(_ string) []string { return []string{} } diff --git a/gobusterdns/result.go b/gobusterdns/result.go index 87cafdc..658f200 100644 --- a/gobusterdns/result.go +++ b/gobusterdns/result.go @@ -20,7 +20,7 @@ type Result struct { CNAME string } -// ResultToString converts the Result to it's textual representation +// ResultToString converts the Result to its textual representation func (r Result) ResultToString() (string, error) { buf := &bytes.Buffer{} diff --git a/gobusterfuzz/gobusterfuzz.go b/gobusterfuzz/gobusterfuzz.go index f51e9ae..f8d3e98 100644 --- a/gobusterfuzz/gobusterfuzz.go +++ b/gobusterfuzz/gobusterfuzz.go @@ -86,7 +86,7 @@ func (d *GobusterFuzz) Name() string { } // PreRun is the pre run implementation of gobusterfuzz -func (d *GobusterFuzz) PreRun(ctx context.Context, progress *libgobuster.Progress) error { +func (d *GobusterFuzz) PreRun(_ context.Context, _ *libgobuster.Progress) error { return nil } @@ -150,7 +150,7 @@ func (d *GobusterFuzz) ProcessWord(ctx context.Context, word string, progress *l if os.IsTimeout(err) && i != tries { continue } else if strings.Contains(err.Error(), "invalid control character in URL") { - // put error in error chan so it's printed out and ignore it + // put error in error chan, so it's printed out and ignore it // so gobuster will not quit progress.ErrorChan <- err continue @@ -194,7 +194,7 @@ func (d *GobusterFuzz) ProcessWord(ctx context.Context, word string, progress *l return nil } -func (d *GobusterFuzz) AdditionalWords(word string) []string { +func (d *GobusterFuzz) AdditionalWords(_ string) []string { return []string{} } diff --git a/gobusterfuzz/result.go b/gobusterfuzz/result.go index b5453df..44c7df3 100644 --- a/gobusterfuzz/result.go +++ b/gobusterfuzz/result.go @@ -22,7 +22,7 @@ type Result struct { Header http.Header } -// ResultToString converts the Result to it's textual representation +// ResultToString converts the Result to its textual representation func (r Result) ResultToString() (string, error) { buf := &bytes.Buffer{} diff --git a/gobustergcs/gobustersgcs.go b/gobustergcs/gobustersgcs.go index f8636c8..fbd019a 100644 --- a/gobustergcs/gobustersgcs.go +++ b/gobustergcs/gobustersgcs.go @@ -74,7 +74,7 @@ func (s *GobusterGCS) Name() string { } // PreRun is the pre run implementation of GobusterS3 -func (s *GobusterGCS) PreRun(ctx context.Context, progress *libgobuster.Progress) error { +func (s *GobusterGCS) PreRun(_ context.Context, _ *libgobuster.Progress) error { return nil } @@ -112,7 +112,7 @@ func (s *GobusterGCS) ProcessWord(ctx context.Context, word string, progress *li if os.IsTimeout(err) && i != tries { continue } else if strings.Contains(err.Error(), "invalid control character in URL") { - // put error in error chan so it's printed out and ignore it + // put error in error chan, so it's printed out and ignore it // so gobuster will not quit progress.ErrorChan <- err continue @@ -198,7 +198,7 @@ func (s *GobusterGCS) ProcessWord(ctx context.Context, word string, progress *li return nil } -func (s *GobusterGCS) AdditionalWords(word string) []string { +func (s *GobusterGCS) AdditionalWords(_ string) []string { return []string{} } diff --git a/gobustergcs/result.go b/gobustergcs/result.go index 55b124a..189f646 100644 --- a/gobustergcs/result.go +++ b/gobustergcs/result.go @@ -17,7 +17,7 @@ type Result struct { Status string } -// ResultToString converts the Result to it's textual representation +// ResultToString converts the Result to its textual representation func (r Result) ResultToString() (string, error) { buf := &bytes.Buffer{} diff --git a/gobusters3/gobusters3.go b/gobusters3/gobusters3.go index 12f7f3c..f090ccf 100644 --- a/gobusters3/gobusters3.go +++ b/gobusters3/gobusters3.go @@ -73,7 +73,7 @@ func (s *GobusterS3) Name() string { } // PreRun is the pre run implementation of GobusterS3 -func (s *GobusterS3) PreRun(ctx context.Context, progress *libgobuster.Progress) error { +func (s *GobusterS3) PreRun(_ context.Context, _ *libgobuster.Progress) error { return nil } @@ -111,7 +111,7 @@ func (s *GobusterS3) ProcessWord(ctx context.Context, word string, progress *lib if os.IsTimeout(err) && i != tries { continue } else if strings.Contains(err.Error(), "invalid control character in URL") { - // put error in error chan so it's printed out and ignore it + // put error in error chan, so it's printed out and ignore it // so gobuster will not quit progress.ErrorChan <- err continue @@ -189,7 +189,7 @@ func (s *GobusterS3) ProcessWord(ctx context.Context, word string, progress *lib return nil } -func (d *GobusterS3) AdditionalWords(word string) []string { +func (s *GobusterS3) AdditionalWords(_ string) []string { return []string{} } diff --git a/gobusters3/result.go b/gobusters3/result.go index c2d1c62..765e85f 100644 --- a/gobusters3/result.go +++ b/gobusters3/result.go @@ -17,7 +17,7 @@ type Result struct { Status string } -// ResultToString converts the Result to it's textual representation +// ResultToString converts the Result to its textual representation func (r Result) ResultToString() (string, error) { buf := &bytes.Buffer{} diff --git a/gobustertftp/gobustertftp.go b/gobustertftp/gobustertftp.go index 01f130a..5e57b79 100644 --- a/gobustertftp/gobustertftp.go +++ b/gobustertftp/gobustertftp.go @@ -42,7 +42,7 @@ func (d *GobusterTFTP) Name() string { } // PreRun is the pre run implementation of gobustertftp -func (d *GobusterTFTP) PreRun(ctx context.Context, progress *libgobuster.Progress) error { +func (d *GobusterTFTP) PreRun(_ context.Context, _ *libgobuster.Progress) error { _, err := tftp.NewClient(d.options.Server) if err != nil { return err @@ -51,7 +51,7 @@ func (d *GobusterTFTP) PreRun(ctx context.Context, progress *libgobuster.Progres } // ProcessWord is the process implementation of gobustertftp -func (d *GobusterTFTP) ProcessWord(ctx context.Context, word string, progress *libgobuster.Progress) error { +func (d *GobusterTFTP) ProcessWord(_ context.Context, word string, progress *libgobuster.Progress) error { // add some debug output if d.globalopts.Debug { progress.MessageChan <- libgobuster.Message{ @@ -80,7 +80,7 @@ func (d *GobusterTFTP) ProcessWord(ctx context.Context, word string, progress *l return nil } -func (d *GobusterTFTP) AdditionalWords(word string) []string { +func (d *GobusterTFTP) AdditionalWords(_ string) []string { return []string{} } diff --git a/gobustertftp/result.go b/gobustertftp/result.go index acacad9..518d5a8 100644 --- a/gobustertftp/result.go +++ b/gobustertftp/result.go @@ -18,7 +18,7 @@ type Result struct { ErrorMessage string } -// ResultToString converts the Result to it's textual representation +// ResultToString converts the Result to its textual representation func (r Result) ResultToString() (string, error) { buf := &bytes.Buffer{} diff --git a/gobustervhost/gobustervhost.go b/gobustervhost/gobustervhost.go index 1b50bde..20d314c 100644 --- a/gobustervhost/gobustervhost.go +++ b/gobustervhost/gobustervhost.go @@ -80,7 +80,7 @@ func (v *GobusterVhost) Name() string { } // PreRun is the pre run implementation of gobusterdir -func (v *GobusterVhost) PreRun(ctx context.Context, progress *libgobuster.Progress) error { +func (v *GobusterVhost) PreRun(ctx context.Context, _ *libgobuster.Progress) error { // add trailing slash if !strings.HasSuffix(v.options.URL, "/") { v.options.URL = fmt.Sprintf("%s/", v.options.URL) @@ -174,7 +174,7 @@ func (v *GobusterVhost) ProcessWord(ctx context.Context, word string, progress * if os.IsTimeout(err) && i != tries { continue } else if strings.Contains(err.Error(), "invalid control character in URL") { - // put error in error chan so it's printed out and ignore it + // put error in error chan, so it's printed out and ignore it // so gobuster will not quit progress.ErrorChan <- err continue @@ -206,7 +206,7 @@ func (v *GobusterVhost) ProcessWord(ctx context.Context, word string, progress * return nil } -func (v *GobusterVhost) AdditionalWords(word string) []string { +func (v *GobusterVhost) AdditionalWords(_ string) []string { return []string{} } diff --git a/gobustervhost/result.go b/gobustervhost/result.go index 27c71e2..07bdd8c 100644 --- a/gobustervhost/result.go +++ b/gobustervhost/result.go @@ -24,7 +24,7 @@ type Result struct { Header http.Header } -// ResultToString converts the Result to it's textual representation +// ResultToString converts the Result to its textual representation func (r Result) ResultToString() (string, error) { statusCodeColor := white if r.StatusCode == 200 { diff --git a/libgobuster/errors.go b/libgobuster/errors.go index e68cfc7..e295cb4 100644 --- a/libgobuster/errors.go +++ b/libgobuster/errors.go @@ -3,7 +3,7 @@ package libgobuster import "errors" var ( - ErrorTimeout = errors.New("timeout occured during the request") + ErrorTimeout = errors.New("timeout occurred during the request") ErrorEOF = errors.New("server closed connection without sending any data back. Maybe you are connecting via https to on http port or vice versa?") ErrorConnectionRefused = errors.New("connection refused") ) diff --git a/libgobuster/helpers.go b/libgobuster/helpers.go index 59f38b2..ffca6ef 100644 --- a/libgobuster/helpers.go +++ b/libgobuster/helpers.go @@ -17,7 +17,7 @@ type Set[T comparable] struct { Set map[T]bool } -// NewSSet creates a new initialized Set +// NewSet creates a new initialized Set func NewSet[T comparable]() Set[T] { return Set[T]{Set: map[T]bool{}} } @@ -68,7 +68,7 @@ func (set *Set[T]) Stringify() string { return strings.Join(values, ",") } -// this method is much more faster than lineCounter_slow but has the following errors: +// this method is much faster than lineCounter_slow but has the following errors: // - empty files are reported as 1 line // - files only containing a newline are reported as 1 line // - also counts lines with comments @@ -101,7 +101,7 @@ func lineCounter(r io.Reader) (int, error) { } } -func lineCounter_slow(r io.Reader) (int, error) { +func lineCounterSlow(r io.Reader) (int, error) { scanner := bufio.NewScanner(r) scanner.Split(bufio.ScanLines) var count int @@ -154,7 +154,7 @@ func ParseExtensionsFile(file string) ([]string, error) { e := scanner.Text() e = strings.TrimSpace(e) // remove leading . from extensions - ret = append(ret, (strings.TrimPrefix(e, "."))) + ret = append(ret, strings.TrimPrefix(e, ".")) } if err := scanner.Err(); err != nil { @@ -207,14 +207,3 @@ func ParseCommaSeparatedInt(inputString string) (Set[int], error) { } return ret, nil } - -// JoinIntSlice joins an int slice by , -func JoinIntSlice(s []int) string { - valuesText := make([]string, len(s)) - for i, number := range s { - text := strconv.Itoa(number) - valuesText[i] = text - } - result := strings.Join(valuesText, ",") - return result -} diff --git a/libgobuster/helpers_test.go b/libgobuster/helpers_test.go index 5b33372..845e659 100644 --- a/libgobuster/helpers_test.go +++ b/libgobuster/helpers_test.go @@ -3,6 +3,7 @@ package libgobuster import ( "errors" "fmt" + "io" "os" "reflect" "strings" @@ -167,9 +168,9 @@ func TestLineCounter(t *testing.T) { {"3 Lines", "TestString\nTest\n1234", 3}, {"Trailing newline", "TestString\nTest\n1234\n", 3}, {"3 Lines cr lf", "TestString\r\nTest\r\n1234", 3}, - {"Empty", "", 1}, // these are wrong but I've found no good way to handle those - {"Empty 2", "\n", 1}, // these are wrong but I've found no good way to handle those - {"Empty 3", "\r\n", 1}, // these are wrong but I've found no good way to handle those + {"Empty", "", 1}, // these are wrong, but I've found no good way to handle those + {"Empty 2", "\n", 1}, // these are wrong, but I've found no good way to handle those + {"Empty 3", "\r\n", 1}, // these are wrong, but I've found no good way to handle those } for _, x := range tt { x := x // NOTE: https://github.com/golang/go/wiki/CommonMistakes#using-goroutines-on-loop-iterator-variables @@ -207,7 +208,7 @@ func TestLineCounterSlow(t *testing.T) { t.Run(x.testName, func(t *testing.T) { t.Parallel() r := strings.NewReader(x.s) - l, err := lineCounter_slow(r) + l, err := lineCounterSlow(r) if err != nil { t.Fatalf("Got error: %v", err) } @@ -219,12 +220,16 @@ func TestLineCounterSlow(t *testing.T) { } func BenchmarkLineCounter(b *testing.B) { + r, err := os.Open("../rockyou.txt") + if err != nil { + b.Fatalf("Got error: %v", err) + } + defer r.Close() for i := 0; i < b.N; i++ { - r, err := os.Open("../rockyou.txt") + _, err := r.Seek(0, io.SeekStart) if err != nil { b.Fatalf("Got error: %v", err) } - defer r.Close() c, err := lineCounter(r) if err != nil { b.Fatalf("Got error: %v", err) @@ -236,13 +241,17 @@ func BenchmarkLineCounter(b *testing.B) { } func BenchmarkLineCounterSlow(b *testing.B) { + r, err := os.Open("../rockyou.txt") + if err != nil { + b.Fatalf("Got error: %v", err) + } + defer r.Close() for i := 0; i < b.N; i++ { - r, err := os.Open("../rockyou.txt") + _, err := r.Seek(0, io.SeekStart) if err != nil { b.Fatalf("Got error: %v", err) } - defer r.Close() - c, err := lineCounter_slow(r) + c, err := lineCounterSlow(r) if err != nil { b.Fatalf("Got error: %v", err) } diff --git a/libgobuster/http.go b/libgobuster/http.go index 16a055a..0d131de 100644 --- a/libgobuster/http.go +++ b/libgobuster/http.go @@ -110,7 +110,7 @@ func NewHTTPClient(opt *HTTPOptions, logger *Logger) (*HTTPClient, error) { return &client, nil } -// Request makes an http request and returns the status, the content length, the headers, the body and an error +// Request makes a http request and returns the status, the content length, the headers, the body and an error // if you want the body returned set the corresponding property inside RequestOptions func (client *HTTPClient) Request(ctx context.Context, fullURL string, opts RequestOptions) (int, int64, http.Header, []byte, error) { resp, err := client.makeRequest(ctx, fullURL, opts) @@ -156,7 +156,7 @@ func (client *HTTPClient) makeRequest(ctx context.Context, fullURL string, opts req.Header.Set("Cookie", client.cookies) } - // Use host for VHOST mode on a per request basis, otherwise the one provided from headers + // Use host for VHOST mode on a per-request basis, otherwise the one provided from headers if opts.Host != "" { req.Host = opts.Host } else if client.host != "" { @@ -174,7 +174,7 @@ func (client *HTTPClient) makeRequest(ctx context.Context, fullURL string, opts // currently only relevant on fuzzing if len(opts.ModifiedHeaders) > 0 { for _, h := range opts.ModifiedHeaders { - // empty headers are not valid (happens when fuzzing the host header for example because the slice is intialized with the provided header length) + // empty headers are not valid (happens when fuzzing the host header for example because the slice is initialized with the provided header length) if h.Name == "" { continue } diff --git a/libgobuster/http_test.go b/libgobuster/http_test.go index 5d5c65e..8a9cfc3 100644 --- a/libgobuster/http_test.go +++ b/libgobuster/http_test.go @@ -14,7 +14,9 @@ import ( func httpServerB(b *testing.B, content string) *httptest.Server { b.Helper() ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - fmt.Fprint(w, content) + if _, err := fmt.Fprint(w, content); err != nil { + b.Fatalf("%v", err) + } })) return ts } @@ -22,7 +24,9 @@ func httpServerB(b *testing.B, content string) *httptest.Server { func httpServerT(t *testing.T, content string) *httptest.Server { t.Helper() ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - fmt.Fprint(w, content) + if _, err := fmt.Fprint(w, content); err != nil { + t.Fatalf("%v", err) + } })) return ts } diff --git a/libgobuster/options.go b/libgobuster/options.go index fc9108e..b5f6351 100644 --- a/libgobuster/options.go +++ b/libgobuster/options.go @@ -17,8 +17,3 @@ type Options struct { Quiet bool Delay time.Duration } - -// NewOptions returns a new initialized Options object -func NewOptions() *Options { - return &Options{} -}