Help us shape the future of Go! Take the 2026 Go Developer Survey

scan

package
v0.0.0-...-f98638f Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 9, 2026 License: BSD-3-Clause Imports: 41 Imported by: 0

Documentation

Overview

The scan package provides a collection of security scanning functions.

Each scanning function typically returns a slice of custom result structures and an error. The package utilizes concurrent operations to improve scanning performance and provides options for logging and timeout management.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func DetectLFIFromResponse 

func DetectLFIFromResponse(body string) (bool, string)

DetectLFIFromResponse checks a response body for LFI evidence

func Dnslist 

func Dnslist(size string, url string, timeout time.Duration, threads int, logdir string, resolvers []string) ([]string, error)

Dnslist performs DNS subdomain enumeration on the target domain. each candidate is resolved first; only names that actually resolve (and aren't a wildcard catch-all) are http-probed, so a big wordlist no longer means a http request per dead name.

func Git 

func Git(url string, timeout time.Duration, threads int, logdir string) ([]string, error)

func Nuclei 

func Nuclei(url string, timeout time.Duration, threads int, logdir string) ([]output.ResultEvent, error)

func Ports 

func Ports(ctx context.Context, scope string, url string, timeout time.Duration, threads int, logdir string) ([]string, error)

func Scan 

func Scan(url string, timeout time.Duration, threads int, logdir string)

Scan performs a basic URL scan, including checks for robots.txt and other common endpoints. It logs the results and doesn't return any values.

Parameters:

  • url: the target URL to scan
  • timeout: maximum duration for the scan
  • threads: number of concurrent threads to use
  • logdir: directory to store log files (empty string for no logging)

func Whois 

func Whois(url string, logdir string)

Types

type CMSResult 

type CMSResult struct {
	Name    string `json:"name"`
	Version string `json:"version"`
}

func CMS 

func CMS(url string, timeout time.Duration, logdir string) (*CMSResult, error)

func (*CMSResult) ResultType 

func (r *CMSResult) ResultType() string

type CORSFinding 

type CORSFinding struct {
	URL              string `json:"url"`
	OriginTested     string `json:"origin_tested"`
	AllowOrigin      string `json:"allow_origin"`
	AllowCredentials bool   `json:"allow_credentials"`
	Severity         string `json:"severity"`
	Note             string `json:"note"`
}

CORSFinding is a single reflecting/permissive cors response.

type CORSResult 

type CORSResult struct {
	Findings []CORSFinding `json:"findings,omitempty"`
}

CORSResult collects every cors misconfiguration found on the target.

func CORS 

func CORS(targetURL string, timeout time.Duration, threads int, logdir string) (*CORSResult, error)

CORS probes the target for cross-origin resource sharing misconfigurations.

func (*CORSResult) ResultType 

func (r *CORSResult) ResultType() string

ResultType identifies cors findings for the result registry.

type CloudStorageResult 

type CloudStorageResult struct {
	BucketName string `json:"bucket_name"`
	// IsPublic means the bucket's listing was actually retrieved (the
	// response body contains a ListBucketResult with no denial marker), not
	// merely that the request returned 200.
	IsPublic bool `json:"is_public"`
}

func CloudStorage 

func CloudStorage(url string, timeout time.Duration, logdir string) ([]CloudStorageResult, error)

type CloudStorageResults 

type CloudStorageResults []CloudStorageResult

Named slice types for scan results. These provide better type safety and allow method implementations.

func (CloudStorageResults) ResultType 

func (r CloudStorageResults) ResultType() string

type CrawlResult 

type CrawlResult struct {
	URLs      []string `json:"urls"`
	Truncated bool     `json:"truncated,omitempty"` // hit maxCrawlPages before the spider ran out of links
}

CrawlResult holds the deduped set of urls discovered by the spider.

func Crawl 

func Crawl(targetURL string, depth int, timeout time.Duration, logdir string) (*CrawlResult, error)

Crawl spiders the target up to depth, following same-host links/scripts/forms. all traffic flows through the shared httpx client so proxy/headers/rate-limit apply. robots.txt is intentionally NOT honored: this is a recon/pentest crawler and Disallow rules are not a scope boundary we want to respect.

func (*CrawlResult) ResultType 

func (r *CrawlResult) ResultType() string

type DirectoryResult 

type DirectoryResult struct {
	Url        string `json:"url"`
	StatusCode int    `json:"status_code"`
	Size       int    `json:"size"`
	Words      int    `json:"words"`
}

type DirectoryResults 

type DirectoryResults []DirectoryResult

Named slice types for scan results. These provide better type safety and allow method implementations.

func Dirlist 

func Dirlist(size string, url string, timeout time.Duration, threads int, logdir string, opts DirlistOptions) (DirectoryResults, error)

Dirlist performs directory fuzzing on the target URL with ffuf-style response filtering, soft-404 calibration and custom wordlists.

func (DirectoryResults) ResultType 

func (r DirectoryResults) ResultType() string

type DirlistOptions 

type DirlistOptions struct {
	MatchCodes  string // -mc comma list of status codes to keep
	FilterCodes string // -fc comma list of status codes to drop
	FilterSizes string // -fs comma list of body sizes to drop
	FilterWords string // -fw comma list of word counts to drop
	FilterRegex string // -fr regex; a body match drops the response
	Calibrate   bool   // -ac auto-calibrate the soft-404 wildcard baseline
	Wordlist    string // -w local path or url; overrides the size switch
	Extensions  string // -e comma list appended to each word (php,bak,env)
}

DirlistOptions carries the ffuf-style matcher knobs. the zero value reproduces the legacy behavior (report everything that isn't 404/403), so callers that don't set anything keep the old defaults.

type DorkResult 

type DorkResult struct {
	Url   string `json:"url"`   // The URL found by the dork
	Dork  string `json:"dork"`  // The dork query that surfaced this URL
	Count int    `json:"count"` // The number of times this URL appeared in the dork's results
}

DorkResult represents a single URL found by a Google dork search.

func Dork 

func Dork(targetURL string, timeout time.Duration, threads int, logdir string) ([]DorkResult, error)

Dork performs Google dorking operations on the target URL. It uses a predefined list of dorks to search for potentially sensitive information.

Parameters:

  • targetURL: The target URL to dork
  • timeout: Maximum duration for each dork search
  • threads: Number of concurrent threads to use
  • logdir: Directory to store log files (empty string for no logging)

Returns:

  • []DorkResult: A slice of results from the dorking operation
  • error: Any error encountered during the dorking process

type DorkResults 

type DorkResults []DorkResult

Named slice types for scan results. These provide better type safety and allow method implementations.

func (DorkResults) ResultType 

func (r DorkResults) ResultType() string

type FaviconResult 

type FaviconResult struct {
	FaviconURL string `json:"favicon_url"` // where the icon was fetched
	Hash       int32  `json:"hash"`        // shodan mmh3 hash (signed int32)
	Tech       string `json:"tech"`        // matched technology, empty when unknown
	ShodanQ    string `json:"shodan_query"`
}

FaviconResult is the computed shodan-style favicon hash plus the pivot query and any matched tech.

func Favicon 

func Favicon(targetURL string, timeout time.Duration, logdir string) (*FaviconResult, error)

Favicon fetches the target's favicon, computes the shodan mmh3 hash and matches it against the bundled fingerprint map.

func (*FaviconResult) ResultType 

func (r *FaviconResult) ResultType() string

ResultType identifies favicon findings for the result registry.

type HeaderResult 

type HeaderResult struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

func Headers 

func Headers(url string, timeout time.Duration, logdir string) ([]HeaderResult, error)

type HeaderResults 

type HeaderResults []HeaderResult

Named slice types for scan results. These provide better type safety and allow method implementations.

func (HeaderResults) ResultType 

func (r HeaderResults) ResultType() string

type JWTIssue 

type JWTIssue struct {
	Kind     string `json:"kind"`
	Severity string `json:"severity"`
	Detail   string `json:"detail"`
}

JWTIssue is a single weakness with a severity so the report layer can rank it.

type JWTResult 

type JWTResult struct {
	Tokens []JWTToken `json:"tokens,omitempty"`
}

JWTResult collects every token discovered on the target plus the offline analysis of each one.

func JWT 

func JWT(targetURL string, timeout time.Duration, logdir string) (*JWTResult, error)

JWT fetches the target once, harvests every jwt from the response headers, cookies and body, then analyzes each one entirely offline.

func (*JWTResult) ResultType 

func (r *JWTResult) ResultType() string

ResultType identifies jwt findings for the result registry.

type JWTToken 

type JWTToken struct {
	Source  string         `json:"source"`   // where we found it (header name / cookie / body)
	Preview string         `json:"preview"`  // first chars of the raw token, never the whole thing
	Alg     string         `json:"alg"`      // header alg claim
	Issues  []JWTIssue     `json:"issues"`   // the weaknesses, ranked
	Claims  map[string]any `json:"claims"`   // decoded payload (for reporting)
	WeakKey string         `json:"weak_key"` // cracked hmac secret, empty when none
}

JWTToken is one decoded jwt and the weaknesses found in it. Token is trimmed to a short prefix so we never log a full credential.

type LFIResult 

type LFIResult struct {
	Vulnerabilities []LFIVulnerability `json:"vulnerabilities,omitempty"`
	TestedParams    int                `json:"tested_params"`
	TestedPayloads  int                `json:"tested_payloads"`
}

LFIResult represents the results of LFI reconnaissance

func LFI 

func LFI(targetURL string, timeout time.Duration, threads int, logdir string) (*LFIResult, error)

LFI performs LFI (Local File Inclusion) reconnaissance on the target URL

func (*LFIResult) ResultType 

func (r *LFIResult) ResultType() string

type LFIVulnerability 

type LFIVulnerability struct {
	URL          string `json:"url"`
	Parameter    string `json:"parameter"`
	Payload      string `json:"payload"`
	Evidence     string `json:"evidence"`
	Severity     string `json:"severity"`
	FileIncluded string `json:"file_included,omitempty"`
}

LFIVulnerability represents a detected LFI vulnerability

type OpenAPIEndpoint 

type OpenAPIEndpoint struct {
	Path   string `json:"path"`
	Method string `json:"method"`
	Unauth bool   `json:"unauth"` // no security requirement on this operation
}

OpenAPIEndpoint is one path+method, flagged when nothing in the spec gates it.

type OpenAPIResult 

type OpenAPIResult struct {
	SpecURL   string            `json:"spec_url"`  // the path the spec was served at
	Title     string            `json:"title"`     // info.title from the spec
	Version   string            `json:"version"`   // openapi/swagger version string
	Endpoints []OpenAPIEndpoint `json:"endpoints"` // every path+method pair
	Severity  string            `json:"severity"`  // exposure severity
}

OpenAPIResult is the parsed spec exposure plus the endpoints enumerated from it.

func OpenAPI 

func OpenAPI(targetURL string, timeout time.Duration, threads int, logdir string) (*OpenAPIResult, error)

OpenAPI probes the candidate spec paths concurrently and, on the first hit, parses the spec and enumerates its endpoints.

func (*OpenAPIResult) ResultType 

func (r *OpenAPIResult) ResultType() string

ResultType identifies openapi findings for the result registry.

type PassiveResult 

type PassiveResult struct {
	Subdomains []string `json:"subdomains"`
	URLs       []string `json:"urls"`
}

PassiveResult holds passively-gathered subdomains and historical urls. all data comes from third-party feeds; the target itself sees zero traffic.

func Passive 

func Passive(targetURL string, timeout time.Duration, logdir string) (*PassiveResult, error)

Passive performs keyless passive recon: subdomains from certificate transparency feeds plus historical urls from the wayback machine. each source fails independently so one feed being down doesn't sink the rest.

func (*PassiveResult) ResultType 

func (r *PassiveResult) ResultType() string

type ProbeResult 

type ProbeResult struct {
	URL           string   `json:"url"`
	Alive         bool     `json:"alive"`
	StatusCode    int      `json:"status_code"`
	Title         string   `json:"title,omitempty"`
	Server        string   `json:"server,omitempty"`
	ContentLength int64    `json:"content_length"`
	RedirectChain []string `json:"redirect_chain,omitempty"`
}

ProbeResult is the httpx-style liveness snapshot for one target: did it answer, where did it land, and the few fingerprint fields worth keeping.

func Probe 

func Probe(targetURL string, timeout time.Duration, logdir string) (*ProbeResult, error)

Probe checks whether the target is alive and reports its final status, page title, Server header, content-length and the redirect chain it walked.

func (*ProbeResult) ResultType 

func (r *ProbeResult) ResultType() string

ResultType identifies probe results for the result registry.

type RedirectFinding 

type RedirectFinding struct {
	URL       string `json:"url"`
	Parameter string `json:"parameter"`
	Payload   string `json:"payload"`
	Location  string `json:"location"`
	Via       string `json:"via"` // header, meta-refresh, or javascript
	Severity  string `json:"severity"`
}

RedirectFinding is a single param/payload that sends the user off-site.

type RedirectResult 

type RedirectResult struct {
	Findings     []RedirectFinding `json:"findings,omitempty"`
	TestedParams int               `json:"tested_params"`
}

RedirectResult collects every open-redirect found on the target.

func Redirect 

func Redirect(targetURL string, timeout time.Duration, threads int, logdir string) (*RedirectResult, error)

Redirect probes the target's redirect-prone params for open-redirect.

func (*RedirectResult) ResultType 

func (r *RedirectResult) ResultType() string

ResultType identifies open-redirect findings for the result registry.

type SQLAdminPanel 

type SQLAdminPanel struct {
	URL    string `json:"url"`
	Type   string `json:"type"`
	Status int    `json:"status"`
}

SQLAdminPanel represents a found database admin panel

type SQLDatabaseError 

type SQLDatabaseError struct {
	URL          string `json:"url"`
	DatabaseType string `json:"database_type"`
	ErrorPattern string `json:"error_pattern"`
}

SQLDatabaseError represents a detected database error

type SQLResult 

type SQLResult struct {
	AdminPanels    []SQLAdminPanel    `json:"admin_panels,omitempty"`
	DatabaseErrors []SQLDatabaseError `json:"database_errors,omitempty"`
	ExposedPorts   []int              `json:"exposed_ports,omitempty"`
}

SQLResult represents the results of SQL reconnaissance

func SQL 

func SQL(targetURL string, timeout time.Duration, threads int, logdir string, calibrate bool) (*SQLResult, error)

SQL performs SQL reconnaissance on the target URL

func (*SQLResult) ResultType 

func (r *SQLResult) ResultType() string

type ScanResult 

type ScanResult interface {
	// ResultType returns the unique identifier for this result type.
	ResultType() string
}

ScanResult is the interface that all scan result types implement.

type SecurityHeaderResult 

type SecurityHeaderResult struct {
	Header   string `json:"header"`
	Present  bool   `json:"present"`
	Value    string `json:"value,omitempty"`
	Severity string `json:"severity"`
	Note     string `json:"note"`
}

type SecurityHeaderResults 

type SecurityHeaderResults []SecurityHeaderResult

Named slice types for scan results. These provide better type safety and allow method implementations.

func SecurityHeaders 

func SecurityHeaders(url string, timeout time.Duration, logdir string) (SecurityHeaderResults, error)

func (SecurityHeaderResults) ResultType 

func (r SecurityHeaderResults) ResultType() string

type SecurityTrailsResult 

type SecurityTrailsResult struct {
	Domain            string   `json:"domain"`
	Subdomains        []string `json:"subdomains,omitempty"`
	AssociatedDomains []string `json:"associated_domains,omitempty"`
}

SecurityTrailsResult holds discovered domains from SecurityTrails API

func SecurityTrails 

func SecurityTrails(targetURL string, timeout time.Duration, logdir string) (*SecurityTrailsResult, error)

SecurityTrails queries the SecurityTrails API for subdomains and associated domains. API key should be provided via the SECURITYTRAILS_API_KEY environment variable.

func (*SecurityTrailsResult) DiscoveredURLs 

func (r *SecurityTrailsResult) DiscoveredURLs() []string

DiscoveredURLs returns all discovered domains as https:// URLs. used by the orchestration layer for target expansion.

func (*SecurityTrailsResult) ResultType 

func (r *SecurityTrailsResult) ResultType() string

type ShodanResult 

type ShodanResult struct {
	IP           string          `json:"ip_str"`
	Hostnames    []string        `json:"hostnames,omitempty"`
	Organization string          `json:"org,omitempty"`
	ASN          string          `json:"asn,omitempty"`
	ISP          string          `json:"isp,omitempty"`
	Country      string          `json:"country_name,omitempty"`
	City         string          `json:"city,omitempty"`
	OS           string          `json:"os,omitempty"`
	Ports        []int           `json:"ports,omitempty"`
	Vulns        []string        `json:"vulns,omitempty"`
	Services     []ShodanService `json:"services,omitempty"`
	LastUpdate   string          `json:"last_update,omitempty"`
}

ShodanResult represents the results from a Shodan host lookup

func Shodan 

func Shodan(targetURL string, timeout time.Duration, logdir string) (*ShodanResult, error)

Shodan performs a Shodan lookup for the given URL The API key should be provided via the SHODAN_API_KEY environment variable

func (*ShodanResult) ResultType 

func (r *ShodanResult) ResultType() string

type ShodanService 

type ShodanService struct {
	Port     int    `json:"port"`
	Protocol string `json:"transport"`
	Product  string `json:"product,omitempty"`
	Version  string `json:"version,omitempty"`
	Banner   string `json:"data,omitempty"`
	Module   string `json:"_shodan,omitempty"`
}

ShodanService represents a service found by Shodan

type SubdomainTakeoverResult 

type SubdomainTakeoverResult struct {
	Subdomain  string `json:"subdomain"`
	Vulnerable bool   `json:"vulnerable"`
	Service    string `json:"service,omitempty"`
	// Confidence is "confirmed" when the cname chain resolves to the same
	// provider as the matched signature, or "potential" when only the body
	// fingerprint matched and the cname could not be checked against it.
	Confidence string `json:"confidence,omitempty"`
}

SubdomainTakeoverResult represents the outcome of a subdomain takeover vulnerability check. It includes the subdomain tested, whether it's vulnerable, and the potentially vulnerable service.

func SubdomainTakeover 

func SubdomainTakeover(url string, dnsResults []string, timeout time.Duration, threads int, logdir string) ([]SubdomainTakeoverResult, error)

SubdomainTakeover checks dnsResults for dangling subdomains pointing at unclaimed third-party services.

type SubdomainTakeoverResults 

type SubdomainTakeoverResults []SubdomainTakeoverResult

Named slice types for scan results. These provide better type safety and allow method implementations.

func (SubdomainTakeoverResults) ResultType 

func (r SubdomainTakeoverResults) ResultType() string

type TLSCertResult 

type TLSCertResult struct {
	Subject       string   `json:"subject"`
	Issuer        string   `json:"issuer"`
	SANs          []string `json:"sans"`
	NotBefore     string   `json:"not_before"`
	NotAfter      string   `json:"not_after"`
	SerialNumber  string   `json:"serial_number"`
	SelfSigned    bool     `json:"self_signed"`
	Expired       bool     `json:"expired"`
	ExpiringSoon  bool     `json:"expiring_soon"`
	Wildcard      bool     `json:"wildcard"`
	NewSubdomains []string `json:"new_subdomains"` // SANs not already known to be the target host
	ChainLength   int      `json:"chain_length"`
}

TLSCertResult holds what the target's leaf certificate reveals: extra hostnames from the SAN list, issuer/validity metadata, and posture flags a human would want surfaced without reading the cert by hand.

func TLSCert 

func TLSCert(targetURL string, port int, timeout time.Duration, logdir string) (*TLSCertResult, error)

TLSCert connects to the target on the given port (443 when unset) and mines its leaf certificate: SANs become candidate subdomains, issuer/validity feed posture flags (self-signed, expired, expiring soon). Unlike Passive's crt.sh and certspotter feeds this is an active probe against the target itself, so it catches certs that were never logged to a public CT log (short-lived certs not yet propagated, internal CAs) at the cost of touching the target.

func (*TLSCertResult) ResultType 

func (r *TLSCertResult) ResultType() string

type XSSFinding 

type XSSFinding struct {
	URL         string   `json:"url"`
	Parameter   string   `json:"parameter"`
	Context     string   `json:"context"`      // html, attribute, or script
	SurvivedRaw []string `json:"survived_raw"` // breaking chars echoed unescaped
	Severity    string   `json:"severity"`
}

XSSFinding is a reflection where one or more breaking chars survived unescaped in a context that makes injection plausible.

type XSSResult 

type XSSResult struct {
	Findings     []XSSFinding `json:"findings,omitempty"`
	TestedParams int          `json:"tested_params"`
}

XSSResult collects every likely reflected-xss point on the target.

func XSS 

func XSS(targetURL string, timeout time.Duration, threads int, logdir string) (*XSSResult, error)

XSS probes the target's params for reflected cross-site scripting.

func (*XSSResult) ResultType 

func (r *XSSResult) ResultType() string

ResultType identifies reflected-xss findings for the result registry.

Source Files

View all Source files

Directories

Path Synopsis
detectors
js
frameworks

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.