20 | {title && {title} }
21 | {description && (
22 | {description}
23 | )}
24 |
25 | {action}
26 |
6 |
15 | );
16 | };
17 |
18 | const SmallSkeleton = () => {
19 | return (
20 |
8 |
14 |
21 |
27 | );
28 | };
29 |
30 | export { SmallSkeleton, WideSkeleton };
--------------------------------------------------------------------------------
/pkg/runner/drivers/restricted_ports.go:
--------------------------------------------------------------------------------
1 | package driver
2 |
3 | import (
4 | "strconv"
5 | "strings"
6 | )
7 |
8 | // src: https://chromium.googlesource.com/chromium/src.git/+/refs/heads/master/net/base/port_util.cc#27
9 | var kRestrictedPorts = []int{
10 | 1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77, 79,
11 | 87, 95, 101, 102, 103, 104, 109, 110, 111, 113, 115, 117, 119, 123, 135, 137,
12 | 139, 143, 161, 179, 389, 427, 465, 512, 513, 514, 515, 526, 530, 531, 532,
13 | 540, 548, 554, 556, 563, 587, 601, 636, 989, 990, 993, 995, 1719, 1720, 1723,
14 | 2049, 3659, 4045, 5060, 5061, 6000, 6566, 6665, 6666, 6667, 6668, 6669, 6697,
15 | 10080,
16 | }
17 |
18 | // restrictedPorts returns a a string of Chrome's restricted ports as a comma
19 | // separated list of integers.
20 | func restrictedPorts() string {
21 | var strPorts []string
22 | for _, port := range kRestrictedPorts {
23 | strPorts = append(strPorts, strconv.Itoa(port))
24 | }
25 |
26 | return strings.Join(strPorts, ",")
27 | }
28 |
--------------------------------------------------------------------------------
/.github/workflows/install-check.yml:
--------------------------------------------------------------------------------
1 | name: Go Install Check
2 |
3 | on:
4 | push:
5 | branches: [master]
6 | pull_request:
7 | branches: [master]
8 | schedule:
9 | - cron: "0 0 * * 1"
10 | workflow_dispatch:
11 |
12 | jobs:
13 | build:
14 | runs-on: ubuntu-latest
15 |
16 | steps:
17 | - name: Checkout Repository
18 | uses: actions/checkout@v3
19 |
20 | - name: Set up Go
21 | uses: actions/setup-go@v4
22 | with:
23 | go-version: "1.25"
24 |
25 | - name: Install chromium
26 | run: |
27 | sudo apt-get update && \
28 | sudo apt-get install -y \
29 | ca-certificates chromium \
30 |
31 | - name: Install gowitness
32 | run: |
33 | go install ./...
34 |
35 | - name: Verify Installation
36 | run: |
37 | gowitness scan single -u https://sensepost.com --write-jsonl
38 |
39 | - name: Generate a static report
40 | run: |
41 | gowitness report generate --json-file gowitness.jsonl
42 |
--------------------------------------------------------------------------------
/web/api/wappalyzer.go:
--------------------------------------------------------------------------------
1 | package api
2 |
3 | import (
4 | "encoding/json"
5 | "fmt"
6 | "net/http"
7 | )
8 |
9 | // probably not the smartest idea, but he
10 | const iconBase = `https://raw.githubusercontent.com/enthec/webappanalyzer/main/src/images/icons/`
11 |
12 | // WappalyzerHandler returns wappalyzer data
13 | //
14 | // @Summary Get wappalyzer data
15 | // @Description Get all of the available wappalyzer data.
16 | // @Tags Results
17 | // @Accept json
18 | // @Produce json
19 | // @Success 200 {object} map[string]string
20 | // @Router /wappalyzer [get]
21 | func (h *ApiHandler) WappalyzerHandler(w http.ResponseWriter, r *http.Request) {
22 | response := make(map[string]string)
23 |
24 | for name, finger := range h.Wappalyzer.GetFingerprints().Apps {
25 | if finger.Icon == "" {
26 | continue
27 | }
28 |
29 | response[name] = fmt.Sprintf(`%s%s`, iconBase, finger.Icon)
30 | }
31 |
32 | jsonData, err := json.Marshal(response)
33 | if err != nil {
34 | http.Error(w, err.Error(), http.StatusInternalServerError)
35 | return
36 | }
37 |
38 | w.Write(jsonData)
39 | }
40 |
--------------------------------------------------------------------------------
/web/ui/src/lib/common.ts:
--------------------------------------------------------------------------------
1 | import { toast } from "@/hooks/use-toast";
2 | import * as apitypes from "@/lib/api/types";
3 |
4 | const copyToClipboard = (content: string, type: string) => {
5 | navigator.clipboard.writeText(content).then(() => {
6 | toast({
7 | description: `${type} copied to clipboard`,
8 | });
9 | }).catch((err) => {
10 | console.error('Failed to copy content: ', err);
11 | toast({
12 | title: "Error",
13 | description: "Failed to copy content",
14 | variant: "destructive",
15 | });
16 | });
17 | };
18 |
19 | const getIconUrl = (tech: string, wappalyzer: apitypes.wappalyzer | undefined): string | undefined => {
20 | if (!wappalyzer || !(tech in wappalyzer)) return undefined;
21 |
22 | return wappalyzer[tech];
23 | };
24 |
25 | const getStatusColor = (code: number) => {
26 | if (code >= 200 && code < 300) return "bg-green-500 text-white";
27 | if (code >= 400 && code < 500) return "bg-yellow-500 text-black";
28 | if (code >= 500) return "bg-red-500 text-white";
29 | return "bg-gray-500 text-white";
30 | };
31 |
32 | export { copyToClipboard, getIconUrl, getStatusColor };
--------------------------------------------------------------------------------
/web/api/technology.go:
--------------------------------------------------------------------------------
1 | package api
2 |
3 | import (
4 | "encoding/json"
5 | "net/http"
6 |
7 | "github.com/sensepost/gowitness/pkg/log"
8 | "github.com/sensepost/gowitness/pkg/models"
9 | )
10 |
11 | type technologyListResponse struct {
12 | Value []string `json:"technologies"`
13 | }
14 |
15 | // TechnologyListHandler lists technologies
16 | //
17 | // @Summary Get technology results
18 | // @Description Get all the unique technology detected.
19 | // @Tags Results
20 | // @Accept json
21 | // @Produce json
22 | // @Success 200 {object} technologyListResponse
23 | // @Router /results/technology [get]
24 | func (h *ApiHandler) TechnologyListHandler(w http.ResponseWriter, r *http.Request) {
25 | var results = &technologyListResponse{}
26 |
27 | if err := h.DB.Model(&models.Technology{}).Distinct("value").
28 | Find(&results.Value).Error; err != nil {
29 |
30 | log.Error("could not find distinct technologies", "err", err)
31 | return
32 | }
33 |
34 | jsonData, err := json.Marshal(results)
35 | if err != nil {
36 | http.Error(w, err.Error(), http.StatusInternalServerError)
37 | return
38 | }
39 |
40 | w.Write(jsonData)
41 | }
42 |
--------------------------------------------------------------------------------
/web/api/gallery_detail.go:
--------------------------------------------------------------------------------
1 | package api
2 |
3 | import (
4 | "encoding/json"
5 | "net/http"
6 |
7 | "github.com/go-chi/chi/v5"
8 | "github.com/sensepost/gowitness/pkg/log"
9 | "github.com/sensepost/gowitness/pkg/models"
10 | "gorm.io/gorm/clause"
11 | )
12 |
13 | // DetailHandler returns the detail for a screenshot
14 | //
15 | // @Summary Results detail
16 | // @Description Get details for a result.
17 | // @Tags Results
18 | // @Accept json
19 | // @Produce json
20 | // @Param id path int true "The screenshot ID to load."
21 | // @Success 200 {object} models.Result
22 | // @Router /results/detail/{id} [get]
23 | func (h *ApiHandler) DetailHandler(w http.ResponseWriter, r *http.Request) {
24 | var response = &models.Result{}
25 |
26 | if err := h.DB.Model(&models.Result{}).
27 | Preload(clause.Associations).
28 | Preload("TLS.SanList").
29 | First(&response, chi.URLParam(r, "id")).Error; err != nil {
30 |
31 | log.Error("could not get detail for id", "err", err)
32 | return
33 | }
34 |
35 | jsonData, err := json.Marshal(response)
36 | if err != nil {
37 | http.Error(w, err.Error(), http.StatusInternalServerError)
38 | return
39 | }
40 |
41 | w.Write(jsonData)
42 | }
43 |
--------------------------------------------------------------------------------
/internal/islazy/slices.go:
--------------------------------------------------------------------------------
1 | package islazy
2 |
3 | import (
4 | "time"
5 |
6 | "math/rand"
7 | )
8 |
9 | // SliceHasStr checks if a slice has a string
10 | func SliceHasStr(slice []string, item string) bool {
11 | for _, s := range slice {
12 | if s == item {
13 | return true
14 | }
15 | }
16 |
17 | return false
18 | }
19 |
20 | // SliceHasInt checks if a slice has an int
21 | func SliceHasInt(slice []int, item int) bool {
22 | for _, s := range slice {
23 | if s == item {
24 | return true
25 | }
26 | }
27 |
28 | return false
29 | }
30 |
31 | // UniqueIntSlice returns a slice of unique ints
32 | func UniqueIntSlice(slice []int) []int {
33 | seen := make(map[int]bool)
34 | result := []int{}
35 |
36 | for _, num := range slice {
37 | if !seen[num] {
38 | seen[num] = true
39 | result = append(result, num)
40 | }
41 | }
42 |
43 | return result
44 | }
45 |
46 | // ShuffleStr shuffles a slice of strings
47 | func ShuffleStr(slice []string) {
48 | source := rand.NewSource(time.Now().UnixNano())
49 | rng := rand.New(source)
50 |
51 | // Fisher-Yates shuffle algorithm
52 | for i := len(slice) - 1; i > 0; i-- {
53 | j := rng.Intn(i + 1)
54 | slice[i], slice[j] = slice[j], slice[i]
55 | }
56 | }
57 |
--------------------------------------------------------------------------------
/pkg/writers/json.go:
--------------------------------------------------------------------------------
1 | package writers
2 |
3 | import (
4 | "encoding/json"
5 | "os"
6 |
7 | "github.com/sensepost/gowitness/internal/islazy"
8 | "github.com/sensepost/gowitness/pkg/models"
9 | )
10 |
11 | // JsonWriter is a JSON lines writer
12 | type JsonWriter struct {
13 | FilePath string
14 | }
15 |
16 | // NewJsonWriter return a new Json lines writer
17 | func NewJsonWriter(destination string) (*JsonWriter, error) {
18 | // check if the destination exists, if not, create it
19 | dst, err := islazy.CreateFileWithDir(destination)
20 | if err != nil {
21 | return nil, err
22 | }
23 |
24 | return &JsonWriter{
25 | FilePath: dst,
26 | }, nil
27 | }
28 |
29 | // Write JSON lines to a file
30 | func (jw *JsonWriter) Write(result *models.Result) error {
31 | j, err := json.Marshal(result)
32 | if err != nil {
33 | return err
34 | }
35 |
36 | // Open the file in append mode, create it if it doesn't exist
37 | file, err := os.OpenFile(jw.FilePath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
38 | if err != nil {
39 | return err
40 | }
41 | defer file.Close()
42 |
43 | // Append the JSON data as a new line
44 | if _, err := file.Write(append(j, '\n')); err != nil {
45 | return err
46 | }
47 |
48 | return nil
49 | }
50 |
--------------------------------------------------------------------------------
/web/ui/src/pages/App.tsx:
--------------------------------------------------------------------------------
1 | import Navigation from "@/components/navigation";
2 | import { ThemeProvider } from "@/components/theme-provider";
3 | import { Toaster } from "@/components/ui/toaster";
4 | import { Outlet } from "react-router-dom";
5 |
6 | const App = () => {
7 | return (
8 |
23 |
26 |
10 |
14 |
16 |
25 |
26 |
11 |
13 | {children}
51 |
24 |
25 |
26 |
27 |
30 |
31 | We encountered an error while processing your request
32 |
33 |
34 |
35 |
56 |
57 |
58 | );
59 | };
60 |
61 | export default ErrorPage;
--------------------------------------------------------------------------------
/web/ui/src/index.css:
--------------------------------------------------------------------------------
1 | @tailwind base;
2 | @tailwind components;
3 | @tailwind utilities;
4 |
5 | @layer base {
6 | :root {
7 | --background: 0 0% 100%;
8 | --foreground: 240 10% 3.9%;
9 | --card: 0 0% 100%;
10 | --card-foreground: 240 10% 3.9%;
11 | --popover: 0 0% 100%;
12 | --popover-foreground: 240 10% 3.9%;
13 | --primary: 240 5.9% 10%;
14 | --primary-foreground: 0 0% 98%;
15 | --secondary: 240 4.8% 95.9%;
16 | --secondary-foreground: 240 5.9% 10%;
17 | --muted: 240 4.8% 95.9%;
18 | --muted-foreground: 240 3.8% 46.1%;
19 | --accent: 240 4.8% 95.9%;
20 | --accent-foreground: 240 5.9% 10%;
21 | --destructive: 0 84.2% 60.2%;
22 | --destructive-foreground: 0 0% 98%;
23 | --border: 240 5.9% 90%;
24 | --input: 240 5.9% 90%;
25 | --ring: 240 5.9% 10%;
26 | --radius: 0.5rem;
27 | --chart-1: 12 76% 61%;
28 | --chart-2: 173 58% 39%;
29 | --chart-3: 197 37% 24%;
30 | --chart-4: 43 74% 66%;
31 | --chart-5: 27 87% 67%;
32 | }
33 |
34 | .dark {
35 | --background: 240 10% 3.9%;
36 | --foreground: 0 0% 98%;
37 | --card: 240 10% 3.9%;
38 | --card-foreground: 0 0% 98%;
39 | --popover: 240 10% 3.9%;
40 | --popover-foreground: 0 0% 98%;
41 | --primary: 0 0% 98%;
42 | --primary-foreground: 240 5.9% 10%;
43 | --secondary: 240 3.7% 15.9%;
44 | --secondary-foreground: 0 0% 98%;
45 | --muted: 240 3.7% 15.9%;
46 | --muted-foreground: 240 5% 64.9%;
47 | --accent: 240 3.7% 15.9%;
48 | --accent-foreground: 0 0% 98%;
49 | --destructive: 0 62.8% 30.6%;
50 | --destructive-foreground: 0 0% 98%;
51 | --border: 240 3.7% 15.9%;
52 | --input: 240 3.7% 15.9%;
53 | --ring: 240 4.9% 83.9%;
54 | --chart-1: 220 70% 50%;
55 | --chart-2: 160 60% 45%;
56 | --chart-3: 30 80% 55%;
57 | --chart-4: 280 65% 60%;
58 | --chart-5: 340 75% 55%;
59 | }
60 | }
61 |
62 | @layer base {
63 | :root {
64 | --chart-1: 12 76% 61%;
65 | --chart-2: 173 58% 39%;
66 | --chart-3: 197 37% 24%;
67 | --chart-4: 43 74% 66%;
68 | --chart-5: 27 87% 67%;
69 | }
70 |
71 | .dark {
72 | --chart-1: 220 70% 50%;
73 | --chart-2: 160 60% 45%;
74 | --chart-3: 30 80% 55%;
75 | --chart-4: 280 65% 60%;
76 | --chart-5: 340 75% 55%;
77 | }
78 | }
79 |
80 | @layer base {
81 | * {
82 | @apply border-border;
83 | }
84 |
85 | body {
86 | @apply bg-background text-foreground;
87 | }
88 | }
--------------------------------------------------------------------------------
/pkg/imagehash/perception.go:
--------------------------------------------------------------------------------
1 | package imagehash
2 |
3 | import (
4 | "errors"
5 | "image"
6 | "math"
7 | "sync"
8 |
9 | "github.com/corona10/goimagehash"
10 | "github.com/corona10/goimagehash/etcs"
11 | "github.com/corona10/goimagehash/transforms"
12 | )
13 |
14 | const (
15 | sampleSize = 64
16 | hashWidth = 8
17 | hashHeight = 8
18 | )
19 |
20 | var pixelPool = sync.Pool{
21 | New: func() interface{} {
22 | p := make([]float64, sampleSize*sampleSize)
23 | return &p
24 | },
25 | }
26 |
27 | // PerceptionHash calculates a perceptual hash for the provided image while avoiding
28 | // the heavy intermediate allocations required by github.com/nfnt/resize as implemented
29 | // in goimagehash. Essentially, this is just a small reimplemenation.
30 | func PerceptionHash(img image.Image) (string, error) {
31 | if img == nil {
32 | return "", errors.New("image is nil")
33 | }
34 |
35 | bounds := img.Bounds()
36 | if bounds.Dx() == 0 || bounds.Dy() == 0 {
37 | return "", errors.New("image has invalid bounds")
38 | }
39 |
40 | pixelsPtr := pixelPool.Get().(*[]float64)
41 | defer pixelPool.Put(pixelsPtr)
42 |
43 | fillDownsampledGrayscale(img, *pixelsPtr)
44 |
45 | transforms.DCT2DFast64(pixelsPtr)
46 | flattens := transforms.FlattenPixelsFast64(*pixelsPtr, hashWidth, hashHeight)
47 | median := etcs.MedianOfPixelsFast64(flattens)
48 |
49 | var hash uint64
50 | for idx, p := range flattens {
51 | if p > median {
52 | shift := uint(len(flattens) - idx - 1)
53 | hash |= 1 << shift
54 | }
55 | }
56 |
57 | return goimagehash.NewImageHash(hash, goimagehash.PHash).ToString(), nil
58 | }
59 |
60 | func fillDownsampledGrayscale(src image.Image, dst []float64) {
61 | bounds := src.Bounds()
62 | srcWidth := bounds.Dx()
63 | srcHeight := bounds.Dy()
64 |
65 | scaleX := float64(srcWidth) / float64(sampleSize)
66 | scaleY := float64(srcHeight) / float64(sampleSize)
67 |
68 | for y := range sampleSize {
69 | sy := bounds.Min.Y + sampleCoordinate(scaleY, srcHeight, y)
70 | for x := range sampleSize {
71 | sx := bounds.Min.X + sampleCoordinate(scaleX, srcWidth, x)
72 | r, g, b, _ := src.At(sx, sy).RGBA()
73 | dst[(y*sampleSize)+x] = toGray(r, g, b)
74 | }
75 | }
76 | }
77 |
78 | func sampleCoordinate(scale float64, max int, pos int) int {
79 | if max <= 1 {
80 | return 0
81 | }
82 |
83 | value := int(math.Floor((float64(pos) + 0.5) * scale))
84 | if value < 0 {
85 | return 0
86 | }
87 | if value >= max {
88 | return max - 1
89 | }
90 |
91 | return value
92 | }
93 |
94 | func toGray(r, g, b uint32) float64 {
95 | return 0.299*float64(r/257) + 0.587*float64(g/257) + 0.114*float64(b/256)
96 | }
97 |
--------------------------------------------------------------------------------
/pkg/writers/db.go:
--------------------------------------------------------------------------------
1 | package writers
2 |
3 | import (
4 | "sync"
5 |
6 | "github.com/sensepost/gowitness/internal/islazy"
7 | "github.com/sensepost/gowitness/pkg/database"
8 | "github.com/sensepost/gowitness/pkg/log"
9 | "github.com/sensepost/gowitness/pkg/models"
10 | "gorm.io/gorm"
11 | )
12 |
13 | var hammingThreshold = 10
14 |
15 | // DbWriter is a Database writer
16 | type DbWriter struct {
17 | URI string
18 | conn *gorm.DB
19 | mutex sync.Mutex
20 | hammingGroups []islazy.HammingGroup
21 | }
22 |
23 | // NewDbWriter initialises a database writer
24 | func NewDbWriter(uri string, debug bool) (*DbWriter, error) {
25 | c, err := database.Connection(uri, false, debug)
26 | if err != nil {
27 | return nil, err
28 | }
29 |
30 | return &DbWriter{
31 | URI: uri,
32 | conn: c,
33 | mutex: sync.Mutex{},
34 | hammingGroups: []islazy.HammingGroup{},
35 | }, nil
36 | }
37 |
38 | // Write results to the database
39 | func (dw *DbWriter) Write(result *models.Result) error {
40 | dw.mutex.Lock()
41 | defer dw.mutex.Unlock()
42 |
43 | // Assign Group ID based on PerceptionHash
44 | groupID, err := dw.AssignGroupID(result.PerceptionHash)
45 | if err == nil {
46 | result.PerceptionHashGroupId = groupID
47 | } else {
48 | // if we couldn't get a perception hash, thats okay. maybe the
49 | // screenshot failed.
50 | log.Debug("could not get group id for perception hash", "hash", result.PerceptionHash)
51 | }
52 |
53 | return dw.conn.Create(result).Error
54 | }
55 |
56 | // AssignGroupID assigns a PerceptionHashGroupId based on Hamming distance
57 | func (dw *DbWriter) AssignGroupID(perceptionHashStr string) (uint, error) {
58 | // Parse the incoming perception hash
59 | parsedHash, err := islazy.ParsePerceptionHash(perceptionHashStr)
60 | if err != nil {
61 | return 0, err
62 | }
63 |
64 | // Iterate through existing groups to find a match
65 | for _, group := range dw.hammingGroups {
66 | dist, err := islazy.HammingDistance(parsedHash, group.Hash)
67 | if err != nil {
68 | return 0, err
69 | }
70 |
71 | if dist <= hammingThreshold {
72 | return group.GroupID, nil
73 | }
74 | }
75 |
76 | // No matching group found; create a new group
77 | var maxGroupID uint
78 | err = dw.conn.Model(&models.Result{}).
79 | Select("COALESCE(MAX(perception_hash_group_id), 0)").
80 | Scan(&maxGroupID).Error
81 | if err != nil {
82 | return 0, err
83 | }
84 | nextGroupID := maxGroupID + 1
85 |
86 | // Add the new group to in-memory cache
87 | newGroup := islazy.HammingGroup{
88 | GroupID: nextGroupID,
89 | Hash: parsedHash,
90 | }
91 | dw.hammingGroups = append(dw.hammingGroups, newGroup)
92 |
93 | return nextGroupID, nil
94 | }
95 |
--------------------------------------------------------------------------------
/pkg/writers/csv.go:
--------------------------------------------------------------------------------
1 | package writers
2 |
3 | import (
4 | "encoding/csv"
5 | "fmt"
6 | "os"
7 | "reflect"
8 |
9 | "github.com/sensepost/gowitness/internal/islazy"
10 | "github.com/sensepost/gowitness/pkg/models"
11 | )
12 |
13 | // fields in the main model to ignore
14 | var csvExludedFields = []string{"HTML"}
15 |
16 | // CsvWriter writes CSV files
17 | type CsvWriter struct {
18 | FilePath string
19 | finalPath string
20 | }
21 |
22 | // NewCsvWriter gets a new CsvWriter
23 | func NewCsvWriter(destination string) (*CsvWriter, error) {
24 | p, err := islazy.CreateFileWithDir(destination)
25 | if err != nil {
26 | return nil, err
27 | }
28 |
29 | // open the file and write the CSV headers to it
30 | file, err := os.OpenFile(p, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
31 | if err != nil {
32 | return nil, err
33 | }
34 |
35 | writer := csv.NewWriter(file)
36 | defer writer.Flush()
37 |
38 | if err := writer.Write(csvHeaders()); err != nil {
39 | return nil, err
40 | }
41 |
42 | return &CsvWriter{
43 | FilePath: destination,
44 | finalPath: p,
45 | }, nil
46 | }
47 |
48 | // Write a CSV line
49 | func (cw *CsvWriter) Write(result *models.Result) error {
50 | file, err := os.OpenFile(cw.finalPath, os.O_WRONLY|os.O_APPEND|os.O_CREATE, 0644)
51 | if err != nil {
52 | return err
53 | }
54 | defer file.Close()
55 |
56 | writer := csv.NewWriter(file)
57 | defer writer.Flush()
58 |
59 | // get values from the result
60 | val := reflect.ValueOf(*result)
61 | numField := val.NumField()
62 |
63 | var values []string
64 | for i := 0; i < numField; i++ {
65 | // skip excluded fields
66 | if islazy.SliceHasStr(csvExludedFields, val.Type().Field(i).Name) {
67 | continue
68 | }
69 |
70 | // skip slices
71 | if val.Field(i).Kind() == reflect.Slice {
72 | continue // Optionally skip slice fields, or handle them differently
73 | }
74 |
75 | values = append(values, fmt.Sprintf("%v", val.Field(i).Interface()))
76 | }
77 |
78 | return writer.Write(values)
79 | }
80 |
81 | // headers returns the headers a CSV file should have.
82 | func csvHeaders() []string {
83 | val := reflect.ValueOf(models.Result{})
84 | numField := val.NumField()
85 |
86 | var fieldNames []string
87 | for i := 0; i < numField; i++ {
88 | // skip excluded fields
89 | if islazy.SliceHasStr(csvExludedFields, val.Type().Field(i).Name) {
90 | continue
91 | }
92 |
93 | // skip slices
94 | if val.Field(i).Kind() == reflect.Slice {
95 | continue // Optionally skip slice fields, or handle them differently
96 | }
97 |
98 | fieldNames = append(fieldNames, val.Type().Field(i).Name)
99 | }
100 |
101 | return fieldNames
102 | }
103 |
--------------------------------------------------------------------------------
/internal/islazy/fs.go:
--------------------------------------------------------------------------------
1 | package islazy
2 |
3 | import (
4 | "fmt"
5 | "io"
6 | "os"
7 | "path/filepath"
8 | "strings"
9 | "unicode"
10 | )
11 |
12 | // CreateDir creates a directory if it does not exist, returning the final
13 | // normalized directory as a result.
14 | func CreateDir(dir string) (string, error) {
15 | var err error
16 |
17 | if strings.HasPrefix(dir, "~") {
18 | homeDir, err := os.UserHomeDir()
19 | if err != nil {
20 | return "", err
21 | }
22 | dir = filepath.Join(homeDir, dir[1:])
23 | }
24 |
25 | dir, err = filepath.Abs(dir)
26 | if err != nil {
27 | return "", err
28 | }
29 |
30 | if err := os.MkdirAll(dir, 0755); err != nil {
31 | return "", err
32 | }
33 |
34 | return dir, nil
35 | }
36 |
37 | // CreateFileWithDir creates a file, relative to a directory, returning the
38 | // final normalized path as a result.
39 | func CreateFileWithDir(destination string) (string, error) {
40 | dir := filepath.Dir(destination)
41 | file := filepath.Base(destination)
42 |
43 | if file == "." || file == "/" {
44 | return "", fmt.Errorf("destination does not appear to be a valid file path: %s", destination)
45 | }
46 |
47 | absDir, err := CreateDir(dir)
48 | if err != nil {
49 | return "", err
50 | }
51 |
52 | absPath := filepath.Join(absDir, file)
53 | fileHandle, err := os.Create(absPath)
54 | if err != nil {
55 | return "", err
56 | }
57 | defer fileHandle.Close()
58 |
59 | return absPath, nil
60 | }
61 |
62 | // SafeFileName takes a string and returns a string safe to use as
63 | // a file name.
64 | func SafeFileName(s string) string {
65 | var builder strings.Builder
66 |
67 | for _, r := range s {
68 | if unicode.IsLetter(r) || unicode.IsDigit(r) || r == '.' {
69 | builder.WriteRune(r)
70 | } else {
71 | builder.WriteRune('-')
72 | }
73 | }
74 |
75 | return builder.String()
76 | }
77 |
78 | // FileExists returns true if a path exists
79 | func FileExists(path string) bool {
80 | _, err := os.Stat(path)
81 |
82 | return !os.IsNotExist(err)
83 | }
84 |
85 | // MoveFile moves a file from a to b
86 | func MoveFile(sourcePath, destPath string) error {
87 | if err := os.Rename(sourcePath, destPath); err == nil {
88 | return nil
89 | }
90 |
91 | sourceFile, err := os.Open(sourcePath)
92 | if err != nil {
93 | return err
94 | }
95 | defer sourceFile.Close()
96 |
97 | destFile, err := os.Create(destPath)
98 | if err != nil {
99 | return err
100 | }
101 | defer destFile.Close()
102 |
103 | _, err = io.Copy(destFile, sourceFile)
104 | if err != nil {
105 | return err
106 | }
107 |
108 | err = os.Remove(sourcePath)
109 | if err != nil {
110 | return err
111 | }
112 |
113 | return nil
114 | }
115 |
--------------------------------------------------------------------------------
/web/ui/src/pages/search/Search.tsx:
--------------------------------------------------------------------------------
1 | import { Link, useLoaderData, useNavigation } from "react-router-dom";
2 | import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
3 | import { Badge } from "@/components/ui/badge";
4 | import * as api from "@/lib/api/api";
5 | import * as apitypes from "@/lib/api/types";
6 | import { WideSkeleton } from "@/components/loading";
7 | import { getStatusColor } from "@/lib/common";
8 |
9 |
10 | export default function SearchResultsPage() {
11 | const data = useLoaderData() as apitypes.searchresult[] | undefined;
12 | const navigation = useNavigation();
13 |
14 | if (!data || data.length === 0) {
15 | return
36 | Error: {errorMessage}
37 |
38 | {errorDetails && (
39 |
40 | Details:
41 |
45 | )}
46 |
42 | {errorDetails}
43 |
44 |
47 |
50 |
54 |
55 | No results found.
;
16 | }
17 |
18 | if (navigation.state === 'loading') return
22 |
64 | );
65 | }
--------------------------------------------------------------------------------
/pkg/readers/file_test.go:
--------------------------------------------------------------------------------
1 | package readers
2 |
3 | import (
4 | "reflect"
5 | "testing"
6 | )
7 |
8 | func TestUrlsFor(t *testing.T) {
9 | fr := FileReader{
10 | Options: &FileReaderOptions{},
11 | }
12 |
13 | tests := []struct {
14 | name string
15 | candidate string
16 | ports []int
17 | want []string
18 | }{
19 | {
20 | name: "Test with IP",
21 | candidate: "192.168.1.1",
22 | ports: []int{80, 443, 8443},
23 | want: []string{
24 | "http://192.168.1.1:80",
25 | "http://192.168.1.1:443",
26 | "http://192.168.1.1:8443",
27 | "https://192.168.1.1:80",
28 | "https://192.168.1.1:443",
29 | "https://192.168.1.1:8443",
30 | },
31 | },
32 | {
33 | name: "Test with IP and port",
34 | candidate: "192.168.1.1:8080",
35 | ports: []int{80, 443, 8443},
36 | want: []string{
37 | "http://192.168.1.1:8080",
38 | "https://192.168.1.1:8080",
39 | },
40 | },
41 | {
42 | name: "Test with IP and port with spaces",
43 | candidate: " 192.168.1.1:8080 ",
44 | ports: []int{80, 443, 8443},
45 | want: []string{
46 | "http://192.168.1.1:8080",
47 | "https://192.168.1.1:8080",
48 | },
49 | },
50 | {
51 | name: "Test with scheme, IP and port",
52 | candidate: "http://192.168.1.1:8080",
53 | ports: []int{80, 443, 8443},
54 | want: []string{
55 | "http://192.168.1.1:8080",
56 | },
57 | },
58 | {
59 | name: "Test with scheme and IP",
60 | candidate: "https://192.168.1.1",
61 | ports: []int{80, 443, 8443},
62 | want: []string{
63 | "https://192.168.1.1:80",
64 | "https://192.168.1.1:443",
65 | "https://192.168.1.1:8443",
66 | },
67 | },
68 | {
69 | name: "Test with IP and path",
70 | candidate: "192.168.1.1/path",
71 | ports: []int{80, 443, 8443},
72 | want: []string{
73 | "http://192.168.1.1:80/path",
74 | "http://192.168.1.1:443/path",
75 | "http://192.168.1.1:8443/path",
76 | "https://192.168.1.1:80/path",
77 | "https://192.168.1.1:443/path",
78 | "https://192.168.1.1:8443/path",
79 | },
80 | },
81 | {
82 | name: "Test with scheme, IP, port and path",
83 | candidate: "http://192.168.1.1:8080/path",
84 | ports: []int{80, 443, 8443},
85 | want: []string{
86 | "http://192.168.1.1:8080/path",
87 | },
88 | },
89 | {
90 | name: "Test with IP, port and path",
91 | candidate: "192.168.1.1:8080/path",
92 | ports: []int{80, 443, 8443},
93 | want: []string{
94 | "http://192.168.1.1:8080/path",
95 | "https://192.168.1.1:8080/path",
96 | },
97 | },
98 | }
99 |
100 | for _, tt := range tests {
101 | t.Run(tt.name, func(t *testing.T) {
102 | got := fr.urlsFor(tt.candidate, tt.ports)
103 | if !reflect.DeepEqual(got, tt.want) {
104 | t.Errorf("urlsFor() =>\n\nhave: %v\nwant %v", got, tt.want)
105 | }
106 | })
107 | }
108 | }
109 |
--------------------------------------------------------------------------------
/web/server.go:
--------------------------------------------------------------------------------
1 | package web
2 |
3 | import (
4 | "net/http"
5 | "strconv"
6 |
7 | "github.com/sensepost/gowitness/web/docs"
8 | httpSwagger "github.com/swaggo/http-swagger"
9 |
10 | "github.com/go-chi/chi/v5"
11 | "github.com/go-chi/chi/v5/middleware"
12 | "github.com/go-chi/cors"
13 | "github.com/sensepost/gowitness/pkg/log"
14 | "github.com/sensepost/gowitness/web/api"
15 | )
16 |
17 | // Server is a web server
18 | type Server struct {
19 | Host string
20 | Port int
21 | DbUri string
22 | ScreenshotPath string
23 | }
24 |
25 | // NewServer returns a new server intance
26 | func NewServer(host string, port int, dburi string, screenshotpath string) *Server {
27 | return &Server{
28 | Host: host,
29 | Port: port,
30 | DbUri: dburi,
31 | ScreenshotPath: screenshotpath,
32 | }
33 | }
34 |
35 | // isJSON sets the Content-Type header to application/json
36 | func isJSON(next http.Handler) http.Handler {
37 | return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
38 | w.Header().Set("Content-Type", "application/json")
39 | next.ServeHTTP(w, r)
40 | })
41 | }
42 |
43 | // Run a server
44 | func (s *Server) Run() {
45 |
46 | // configure our swagger docs
47 | docs.SwaggerInfo.Title = "gowitness v3 api"
48 | docs.SwaggerInfo.Description = "API documentation for gowitness v3"
49 | docs.SwaggerInfo.Version = "1.0"
50 | docs.SwaggerInfo.BasePath = "/api"
51 |
52 | // get the router ready
53 | r := chi.NewRouter()
54 |
55 | r.Use(middleware.Logger)
56 | r.Use(middleware.CleanPath)
57 | r.Use(middleware.RealIP)
58 | r.Use(middleware.Recoverer)
59 |
60 | apih, err := api.NewApiHandler(s.DbUri, s.ScreenshotPath)
61 | if err != nil {
62 | log.Error("could not get api handler up", "err", err)
63 | return
64 | }
65 |
66 | r.Route("/api", func(r chi.Router) {
67 | r.Use(isJSON)
68 | r.Use(cors.Handler(cors.Options{
69 | AllowedOrigins: []string{"*"}, // TODO: flag this
70 | }))
71 |
72 | r.Get("/ping", apih.PingHandler)
73 | r.Get("/statistics", apih.StatisticsHandler)
74 | r.Get("/wappalyzer", apih.WappalyzerHandler)
75 | r.Post("/search", apih.SearchHandler)
76 | r.Post("/submit", apih.SubmitHandler)
77 | r.Post("/submit/single", apih.SubmitSingleHandler)
78 |
79 | r.Get("/results/gallery", apih.GalleryHandler)
80 | r.Get("/results/list", apih.ListHandler)
81 | r.Get("/results/detail/{id}", apih.DetailHandler)
82 | r.Post("/results/delete", apih.DeleteResultHandler)
83 | r.Get("/results/technology", apih.TechnologyListHandler)
84 | })
85 |
86 | // screenshot files
87 | r.Mount("/screenshots", http.StripPrefix("/screenshots/", http.FileServer(http.Dir(s.ScreenshotPath))))
88 |
89 | // swagger documentation
90 | r.Get("/swagger/*", httpSwagger.Handler(httpSwagger.URL("/swagger/doc.json")))
91 |
92 | // the spa
93 | r.Handle("/*", SpaHandler())
94 |
95 | log.Info("starting web server", "host", s.Host, "port", s.Port)
96 | if err := http.ListenAndServe(s.Host+":"+strconv.Itoa(s.Port), r); err != nil {
97 | log.Error("server listen error", "err", err)
98 | }
99 | }
100 |
--------------------------------------------------------------------------------
/pkg/readers/cidr.go:
--------------------------------------------------------------------------------
1 | package readers
2 |
3 | import (
4 | "bufio"
5 | "fmt"
6 | "os"
7 | "strings"
8 |
9 | "github.com/sensepost/gowitness/internal/islazy"
10 | "github.com/sensepost/gowitness/pkg/log"
11 | )
12 |
13 | type CidrReader struct {
14 | Options *CidrReaderOptions
15 | }
16 |
17 | type CidrReaderOptions struct {
18 | NoHTTP bool
19 | NoHTTPS bool
20 | Cidrs []string
21 | Source string
22 | Ports []int
23 | PortsSmall bool
24 | PortsMedium bool
25 | PortsLarge bool
26 | Random bool
27 | }
28 |
29 | func NewCidrReader(opts *CidrReaderOptions) *CidrReader {
30 | return &CidrReader{
31 | Options: opts,
32 | }
33 | }
34 |
35 | func (cr *CidrReader) Read(ch chan<- string) error {
36 | defer close(ch)
37 |
38 | candidates, err := cr.candidates()
39 | if err != nil {
40 | return err
41 | }
42 |
43 | log.Debug("total candidates to scan", "total", len(candidates))
44 |
45 | for _, target := range candidates {
46 | ch <- target
47 | }
48 |
49 | return nil
50 | }
51 |
52 | // candidates creates url candidates from ports and ips
53 | func (cr *CidrReader) candidates() ([]string, error) {
54 | var candidates []string
55 |
56 | ports := cr.ports()
57 | ips, err := cr.ips()
58 | if err != nil {
59 | return nil, err
60 | }
61 |
62 | for _, ip := range ips {
63 | for _, port := range ports {
64 | partial := fmt.Sprintf("%s:%d", ip, port)
65 |
66 | if !cr.Options.NoHTTP {
67 | candidates = append(candidates, fmt.Sprintf("http://%s", partial))
68 | }
69 |
70 | if !cr.Options.NoHTTPS {
71 | candidates = append(candidates, fmt.Sprintf("https://%s", partial))
72 | }
73 | }
74 | }
75 |
76 | if cr.Options.Random {
77 | islazy.ShuffleStr(candidates)
78 | }
79 |
80 | return candidates, nil
81 | }
82 |
83 | // ports returns all of the ports to scan
84 | func (cr *CidrReader) ports() []int {
85 | var ports = cr.Options.Ports
86 |
87 | if cr.Options.PortsSmall {
88 | ports = append(ports, small...)
89 | }
90 |
91 | if cr.Options.PortsMedium {
92 | ports = append(ports, medium...)
93 | }
94 |
95 | if cr.Options.PortsLarge {
96 | ports = append(ports, large...)
97 | }
98 |
99 | return islazy.UniqueIntSlice(ports)
100 | }
101 |
102 | // ips gets ips from a file and cidr agruments
103 | func (cr *CidrReader) ips() ([]string, error) {
104 | var cidrs = cr.Options.Cidrs
105 | var ips []string
106 |
107 | // Slurp a file if we have one
108 | if cr.Options.Source != "" {
109 | var file *os.File
110 | var err error
111 | if cr.Options.Source == "-" {
112 | file = os.Stdin
113 | } else {
114 | file, err = os.Open(cr.Options.Source)
115 | if err != nil {
116 | return nil, err
117 | }
118 | defer file.Close()
119 | }
120 |
121 | scanner := bufio.NewScanner(file)
122 | for scanner.Scan() {
123 | cidrs = append(cidrs, strings.TrimSpace(scanner.Text()))
124 | }
125 | }
126 |
127 | // populate ips from the collected cidrs to return
128 | for _, cidr := range cidrs {
129 | if !strings.Contains(cidr, "/") {
130 | cidr += "/32"
131 | }
132 |
133 | ip, err := islazy.IpsInCIDR(cidr)
134 | if err != nil {
135 | return nil, err
136 | }
137 |
138 | ips = append(ips, ip...)
139 | }
140 |
141 | return ips, nil
142 | }
143 |
--------------------------------------------------------------------------------
/web/api/submit_single.go:
--------------------------------------------------------------------------------
1 | package api
2 |
3 | import (
4 | "encoding/json"
5 | "log/slog"
6 | "net/http"
7 |
8 | "github.com/sensepost/gowitness/pkg/log"
9 | "github.com/sensepost/gowitness/pkg/runner"
10 | driver "github.com/sensepost/gowitness/pkg/runner/drivers"
11 | "github.com/sensepost/gowitness/pkg/writers"
12 | )
13 |
14 | type submitSingleRequest struct {
15 | URL string `json:"url"`
16 | Options *submitRequestOptions `json:"options"`
17 | }
18 |
19 | // SubmitSingleHandler submits a URL to scan, returning the result.
20 | //
21 | // @Summary Submit a single URL for probing
22 | // @Description Starts a new probing routine for a URL and options, returning the results when done.
23 | // @Tags Results
24 | // @Accept json
25 | // @Produce json
26 | // @Param query body submitSingleRequest true "The URL scanning request object"
27 | // @Success 200 {object} models.Result "The URL Result object"
28 | // @Router /submit/single [post]
29 | func (h *ApiHandler) SubmitSingleHandler(w http.ResponseWriter, r *http.Request) {
30 | var request submitSingleRequest
31 | if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
32 | log.Error("failed to read json request", "err", err)
33 | http.Error(w, "Error reading JSON request", http.StatusInternalServerError)
34 | return
35 | }
36 |
37 | if request.URL == "" {
38 | http.Error(w, "No URL provided", http.StatusBadRequest)
39 | return
40 | }
41 |
42 | options := runner.NewDefaultOptions()
43 | options.Scan.ScreenshotToWriter = true
44 | options.Scan.ScreenshotSkipSave = true
45 |
46 | // Override default values with request options
47 | if request.Options != nil {
48 | if request.Options.X != 0 {
49 | options.Chrome.WindowX = request.Options.X
50 | }
51 | if request.Options.Y != 0 {
52 | options.Chrome.WindowY = request.Options.Y
53 | }
54 | if request.Options.UserAgent != "" {
55 | options.Chrome.UserAgent = request.Options.UserAgent
56 | }
57 | if request.Options.Timeout != 0 {
58 | options.Scan.Timeout = request.Options.Timeout
59 | }
60 | if request.Options.Delay != 0 {
61 | options.Scan.Delay = request.Options.Delay
62 | }
63 | if request.Options.Format != "" {
64 | options.Scan.ScreenshotFormat = request.Options.Format
65 | }
66 | }
67 |
68 | writer, err := writers.NewMemoryWriter(1)
69 | if err != nil {
70 | http.Error(w, "Error getting a memory writer", http.StatusInternalServerError)
71 | return
72 | }
73 |
74 | logger := slog.New(log.Logger)
75 |
76 | driver, err := driver.NewChromedp(logger, *options)
77 | if err != nil {
78 | http.Error(w, "Error sarting driver", http.StatusInternalServerError)
79 | return
80 | }
81 |
82 | runner, err := runner.NewRunner(logger, driver, *options, []writers.Writer{writer})
83 | if err != nil {
84 | log.Error("error starting runner", "err", err)
85 | http.Error(w, "Error starting runner", http.StatusInternalServerError)
86 | return
87 | }
88 |
89 | go func() {
90 | runner.Targets <- request.URL
91 | close(runner.Targets)
92 | }()
93 |
94 | runner.Run()
95 | runner.Close()
96 |
97 | jsonData, err := json.Marshal(writer.GetLatest())
98 | if err != nil {
99 | http.Error(w, "Error creating JSON response", http.StatusInternalServerError)
100 | return
101 | }
102 |
103 | w.Write(jsonData)
104 | }
105 |
--------------------------------------------------------------------------------
/cmd/scan_file.go:
--------------------------------------------------------------------------------
1 | package cmd
2 |
3 | import (
4 | "errors"
5 |
6 | "github.com/sensepost/gowitness/internal/ascii"
7 | "github.com/sensepost/gowitness/internal/islazy"
8 | "github.com/sensepost/gowitness/pkg/log"
9 | "github.com/sensepost/gowitness/pkg/readers"
10 | "github.com/spf13/cobra"
11 | )
12 |
13 | var fileCmdOptions = &readers.FileReaderOptions{}
14 | var fileCmd = &cobra.Command{
15 | Use: "file",
16 | Short: "Scan targets sourced from a file or stdin",
17 | Long: ascii.LogoHelp(ascii.Markdown(`
18 | # scan file
19 |
20 | Scan targets sourced from a file or stdin.
21 |
22 | ## description
23 |
24 | This command will check the structure of a target URL to ensure that a protocol
25 | is defined. If it is not set, it will prepend 'http://' and 'https://'. You can
26 | disable either using the --no-http / --no-https flags.
27 |
28 | URLs in the source file should be newline-separated. Invalid URLs are simply
29 | ignored.
30 |
31 | If any ports are added (via --port or one of the ports collections), then URL
32 | candidates will also be generated with the port section specified.
33 |
34 | **Note**: By default, no metadata is saved except for screenshots that are
35 | stored in the configured --screenshot-path. For later parsing (i.e., using the
36 | gowitness reporting feature), you need to specify where to write results (db,
37 | csv, jsonl) using the _--write-*_ set of flags. See _--help_ for available
38 | flags.`)),
39 | Example: ascii.Markdown(`
40 | - gowitness scan file -f ~/Desktop/targets.txt --write-jsonl
41 | - gowitness scan file -f targets.txt --threads 50 --write-db
42 | - cat urls.txt | gowitness scan file -f - --write-csv
43 | - gowitness scan file -f <( shuf domains.txt ) --no-http
44 | `),
45 | PreRunE: func(cmd *cobra.Command, args []string) error {
46 | if fileCmdOptions.Source == "" {
47 | return errors.New("a source must be specified")
48 | }
49 |
50 | if fileCmdOptions.Source != "-" && !islazy.FileExists(fileCmdOptions.Source) {
51 | return errors.New("source is not readable")
52 | }
53 |
54 | return nil
55 | },
56 | Run: func(cmd *cobra.Command, args []string) {
57 | log.Debug("starting file scanning", "file", fileCmdOptions.Source)
58 |
59 | reader := readers.NewFileReader(fileCmdOptions)
60 | go func() {
61 | if err := reader.Read(scanRunner.Targets); err != nil {
62 | log.Error("error in reader.Read", "err", err)
63 | return
64 | }
65 | }()
66 |
67 | scanRunner.Run()
68 | scanRunner.Close()
69 | },
70 | }
71 |
72 | func init() {
73 | scanCmd.AddCommand(fileCmd)
74 |
75 | fileCmd.Flags().StringVarP(&fileCmdOptions.Source, "file", "f", "", "A file with targets to scan. Use - for stdin")
76 | fileCmd.Flags().BoolVar(&fileCmdOptions.NoHTTP, "no-http", false, "Do not add 'http://' to targets where missing")
77 | fileCmd.Flags().BoolVar(&fileCmdOptions.NoHTTPS, "no-https", false, "Do not add 'https://' to targets where missing")
78 | fileCmd.Flags().IntSliceVarP(&fileCmdOptions.Ports, "port", "p", []int{80, 443}, "Ports on targets to scan. Supports multiple --port flags")
79 | fileCmd.Flags().BoolVar(&fileCmdOptions.PortsSmall, "ports-small", false, "Include a small ports list when scanning targets")
80 | fileCmd.Flags().BoolVar(&fileCmdOptions.PortsMedium, "ports-medium", false, "Include a medium ports list when scanning targets")
81 | fileCmd.Flags().BoolVar(&fileCmdOptions.PortsLarge, "ports-large", false, "Include a large ports list when scanning targets")
82 | }
83 |
--------------------------------------------------------------------------------
/web/api/statistics.go:
--------------------------------------------------------------------------------
1 | package api
2 |
3 | import (
4 | "encoding/json"
5 | "net/http"
6 |
7 | "github.com/sensepost/gowitness/pkg/log"
8 | "github.com/sensepost/gowitness/pkg/models"
9 | )
10 |
11 | type statisticsResponse struct {
12 | DbSize int64 `json:"dbsize"`
13 | Results int64 `json:"results"`
14 | Headers int64 `json:"headers"`
15 | NetworkLogs int64 `json:"networklogs"`
16 | ConsoleLogs int64 `json:"consolelogs"`
17 | ResponseCodes []*statisticsResponseCode `json:"response_code_stats"`
18 | }
19 |
20 | type statisticsResponseCode struct {
21 | Code int `json:"code"`
22 | Count int64 `json:"count"`
23 | }
24 |
25 | // StatisticsHandler returns database statistics
26 | //
27 | // @Summary Database statistics
28 | // @Description Get database statistics.
29 | // @Tags Results
30 | // @Accept json
31 | // @Produce json
32 | // @Success 200 {object} statisticsResponse
33 | // @Router /statistics [get]
34 | func (h *ApiHandler) StatisticsHandler(w http.ResponseWriter, r *http.Request) {
35 | response := &statisticsResponse{}
36 |
37 | var dbSizeQuery string
38 | switch {
39 | case len(h.DbURI) >= 9 && h.DbURI[:9] == "sqlite://":
40 | dbSizeQuery = "SELECT page_count * page_size as size FROM pragma_page_count(), pragma_page_size()"
41 | case len(h.DbURI) >= 8 && h.DbURI[:8] == "mysql://":
42 | dbSizeQuery = "SELECT SUM(data_length + index_length) AS size FROM information_schema.tables WHERE table_schema = DATABASE()"
43 | case len(h.DbURI) >= 11 && h.DbURI[:11] == "postgres://":
44 | dbSizeQuery = "SELECT SUM(pg_total_relation_size(quote_ident(schemaname) || '.' || quote_ident(tablename))) AS size FROM pg_tables WHERE schemaname = 'public'"
45 | default:
46 | dbSizeQuery = ""
47 | }
48 |
49 | if dbSizeQuery != "" {
50 | if err := h.DB.Raw(dbSizeQuery).Take(&response.DbSize).Error; err != nil {
51 | log.Error("an error occured getting database size", "err", err)
52 | response.DbSize = -1
53 | }
54 | } else {
55 | log.Error("unsupported database type for statistics", "dburi", h.DbURI)
56 | response.DbSize = -1
57 | }
58 |
59 | if err := h.DB.Model(&models.Result{}).Count(&response.Results).Error; err != nil {
60 | log.Error("an error occured counting results", "err", err)
61 | return
62 | }
63 |
64 | if err := h.DB.Model(&models.Header{}).Count(&response.Headers).Error; err != nil {
65 | log.Error("an error occured counting headers", "err", err)
66 | return
67 | }
68 |
69 | if err := h.DB.Model(&models.NetworkLog{}).Count(&response.NetworkLogs).Error; err != nil {
70 | log.Error("an error occured counting network logs", "err", err)
71 | return
72 | }
73 |
74 | if err := h.DB.Model(&models.ConsoleLog{}).Count(&response.ConsoleLogs).Error; err != nil {
75 | log.Error("an error occured counting console logs", "err", err)
76 | return
77 | }
78 |
79 | var counts []*statisticsResponseCode
80 | if err := h.DB.Model(&models.Result{}).
81 | Select("response_code as code, count(*) as count").
82 | Group("response_code").Scan(&counts).Error; err != nil {
83 | log.Error("failed counting response codes", "err", err)
84 | return
85 | }
86 |
87 | response.ResponseCodes = counts
88 |
89 | jsonData, err := json.Marshal(response)
90 | if err != nil {
91 | http.Error(w, err.Error(), http.StatusInternalServerError)
92 | return
93 | }
94 |
95 | w.Write(jsonData)
96 | }
97 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | 23 | Search Results ({data.length}) 24 |
25 |
26 | {data.map((result) => (
27 |
28 |
29 |
30 | 
39 |
42 | {result.response_code}
43 |
44 |
45 |
46 | {result.title}
47 |
59 |
60 |
61 | ))}
62 |
63 | {result.final_url}
48 |
49 |
58 |
50 |
53 | {field}
54 |
55 | ))}
56 |
57 | Matched Fields:
51 | {result.matched_fields.map((field) => ( 52 |
2 |
3 | gowitness
4 |
5 |
6 |
7 |
8 | A golang, web screenshot utility using Chrome Headless.
9 |
10 | 
11 |
12 |
13 |
15 | 16 | ## introduction 17 | 18 | `gowitness` is a website screenshot utility written in Golang, that uses Chrome Headless to generate screenshots of web interfaces using the command line, with a handy report viewer to process results. Both Linux and macOS is supported, with Windows support mostly working. 19 | 20 | ## features 21 | 22 | The main goal of `gowitness` is to take website screenshots (**and do that well!**), while optionally saving any information it gathered along the way. That said, a short list of features include: 23 | 24 | - Take website screenshots, obviously..., but fast and accurate! 25 | - Scan a list of URLs, CIDRs, Nmap Results, Nessus Results and more. 26 | - Ability to grab and save data (i.e., a request log, console logs, headers, cookies, etc.) 27 | - Write data to many formats (sqlite database, jsonlines, csv, etc.) 28 | - An epic web-based results viewer (if you saved data to SQLite) including a fully featured API! 29 | - And many, many more! 30 | 31 | ## quick start 32 | 33 | There are a few ways to get gowitness, the simplest (assuming your `$GOBIN` path is in your shell `$PATH`) will be to use `go install`: 34 | 35 | ```text 36 | go install github.com/sensepost/gowitness@latest 37 | ``` 38 | 39 | Otherwise, grab a platform specific release binary or compile from source. Then, scan your first target writing the results to a SQLite database and the screenshot to `./screenshots` with: 40 | 41 | ```text 42 | gowitness scan single --url "https://sensepost.com" --write-db 43 | ``` 44 | 45 | There are many, *many* flags and scan types in `gowitness`. Just add `-h` anywhere and read all about it! 46 | 47 | ## documentation 48 | 49 | For advanced installation information and other documentation, please refer to the wiki [here](https://github.com/sensepost/gowitness/wiki). 50 | 51 | ## screenshots 52 | 53 |  54 | 55 |  56 | 57 |  58 | 59 | ## credits 60 | 61 | `gowitness` would not have been possible without some of [these amazing projects](./go.mod): [chi](https://github.com/go-chi/chi), [chromedp](https://github.com/chromedp/chromedp), [go-rod](https://github.com/go-rod/rod), [cobra](https://github.com/spf13/cobra), [gorm](https://github.com/go-gorm/gorm), [glamour](https://github.com/charmbracelet/glamour), [go-nmap](https://github.com/lair-framework/go-nmap), [wappalyzergo](https://github.com/projectdiscovery/wappalyzergo), [goimagehash](https://github.com/corona10/goimagehash). 62 | 63 | ## license 64 | 65 | `gowitness` is licensed under a [GNU General Public v3 License](https://www.gnu.org/licenses/gpl-3.0.en.html). Permissions beyond the scope of this license may be available at
10 |
15 |
16 | ))
17 | Table.displayName = "Table"
18 |
19 | const TableHeader = React.forwardRef<
20 | HTMLTableSectionElement,
21 | React.HTMLAttributes{value}
29 |
45 |
74 |
75 | HTTP Status Code Distribution
76 |
77 |
78 |
79 |
80 |
81 | `${value}%`}
91 | />
92 |
96 |
97 |
98 |
99 |
100 |
101 | );
102 | }
--------------------------------------------------------------------------------
/pkg/runner/options.go:
--------------------------------------------------------------------------------
1 | package runner
2 |
3 | // Options are global gowitness options
4 | type Options struct {
5 | // Logging is logging options
6 | Logging Logging
7 | // Chrome is Chrome related options
8 | Chrome Chrome
9 | // Writer is output options
10 | Writer Writer
11 | // Scan is typically Scan options
12 | Scan Scan
13 | }
14 |
15 | // Logging is log related options
16 | type Logging struct {
17 | // Debug display debug level logging
18 | Debug bool
19 | // LogScanErrors log errors related to scanning
20 | LogScanErrors bool
21 | // Silence all logging
22 | Silence bool
23 | }
24 |
25 | // Chrome is Google Chrome related options
26 | type Chrome struct {
27 | // Path to the Chrome binary. An empty value implies that
28 | // go-rod will auto download a platform appropriate binary
29 | // to use.
30 | Path string
31 | // WSS is a websocket URL. Setting this will prevent gowitness
32 | // form launching Chrome, but rather use the remote instance.
33 | WSS string
34 | // Proxy server to use
35 | Proxy string
36 | // UserAgent is the user-agent string to set for Chrome
37 | UserAgent string
38 | // Headers to add to every request
39 | Headers []string
40 | // WindowSize, in pixels. Eg; X=1920,Y=1080
41 | WindowX int
42 | WindowY int
43 | }
44 |
45 | // Writer options
46 | type Writer struct {
47 | Db bool
48 | DbURI string
49 | DbDebug bool // enables verbose database logs
50 | Csv bool
51 | CsvFile string
52 | Jsonl bool
53 | JsonlFile string
54 | Stdout bool
55 | None bool
56 | }
57 |
58 | // Scan is scanning related options
59 | type Scan struct {
60 | // The scan driver to use. Can be one of [gorod, chromedp]
61 | Driver string
62 | // Threads (not really) are the number of goroutines to use.
63 | // More soecifically, its the go-rod page pool well use.
64 | Threads int
65 | // Timeout is the maximum time to wait for a page load before timing out.
66 | Timeout int
67 | // Number of seconds of delay between navigation and screenshotting
68 | Delay int
69 | // UriFilter are URI's that are okay to process. This should normally
70 | // be http and https
71 | UriFilter []string
72 | // Don't write HTML response content
73 | SkipHTML bool
74 | // SkipNetworkLogs stops recording individual request/response entries
75 | SkipNetworkLogs bool
76 | // ScreenshotPath is the path where screenshot images will be stored.
77 | // An empty value means drivers will not write screenshots to disk. In
78 | // that case, you'd need to specify writer saves.
79 | ScreenshotPath string
80 | // ScreenshotFormat to save as
81 | ScreenshotFormat string
82 | // ScreenshotJpegQuality is the quality of the JPEG screenshot (1-100)
83 | ScreenshotJpegQuality int
84 | // ScreenshotFullPage saves full, scrolled web pages
85 | ScreenshotFullPage bool
86 | // ScreenshotToWriter passes screenshots as a model property to writers
87 | ScreenshotToWriter bool
88 | // ScreenshotSkipSave skips saving screenshots to disk
89 | ScreenshotSkipSave bool
90 | // JavaScript to evaluate on every page
91 | JavaScript string
92 | JavaScriptFile string
93 | // Save content stores content from network requests (warning) this
94 | // could make written artefacts huge
95 | SaveContent bool
96 | // HttpCodeFilter are http response codes to screenshot. this is a filter.
97 | // by default all codes are screenshotted
98 | HttpCodeFilter []int
99 | }
100 |
101 | // NewDefaultOptions returns Options with some default values
102 | func NewDefaultOptions() *Options {
103 | return &Options{
104 | Chrome: Chrome{
105 | UserAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36",
106 | WindowX: 1920,
107 | WindowY: 1080,
108 | },
109 | Scan: Scan{
110 | Driver: "chromedp",
111 | Threads: 6,
112 | Timeout: 60,
113 | UriFilter: []string{"http", "https"},
114 | ScreenshotFormat: "jpeg",
115 | HttpCodeFilter: []int{},
116 | },
117 | Logging: Logging{
118 | Debug: true,
119 | LogScanErrors: true,
120 | },
121 | }
122 | }
123 |
--------------------------------------------------------------------------------
/pkg/models/oldv2/models.go:
--------------------------------------------------------------------------------
1 | package oldv2
2 |
3 | import (
4 | "encoding/json"
5 | "strconv"
6 | "time"
7 |
8 | "gorm.io/gorm"
9 | )
10 |
11 | // URL contains information about a URL
12 | type URL struct {
13 | gorm.Model
14 |
15 | URL string
16 | FinalURL string
17 | ResponseCode int
18 | ResponseReason string
19 | Proto string
20 | ContentLength int64
21 | Title string
22 | Filename string
23 | IsPDF bool
24 | PerceptionHash string
25 | DOM string
26 | Screenshot string
27 |
28 | TLS TLS
29 |
30 | Headers []Header
31 | Technologies []Technologie
32 | Console []ConsoleLog
33 | Network []NetworkLog
34 | }
35 |
36 | // AddHeader adds a new header to a URL
37 | func (url *URL) AddHeader(key string, value string) {
38 | url.Headers = append(url.Headers, Header{
39 | Key: key,
40 | Value: value,
41 | })
42 | }
43 |
44 | // AddTechnlogies adds a new technologies to a URL
45 | func (url *URL) AddTechnologie(value string) {
46 | url.Technologies = append(url.Technologies, Technologie{
47 | Value: value,
48 | })
49 | }
50 |
51 | // MarshallCSV returns values as a slice
52 | func (url *URL) MarshallCSV() (res []string) {
53 | return []string{url.URL,
54 | url.FinalURL,
55 | strconv.Itoa(url.ResponseCode),
56 | url.ResponseReason,
57 | url.Proto,
58 | strconv.Itoa(int(url.ContentLength)),
59 | url.Title,
60 | url.Filename}
61 | }
62 |
63 | // MarshalJSON returns JSON encoding of url. Implements json.Marshaler.
64 | func (url *URL) MarshalJSON() ([]byte, error) {
65 | var tmp struct {
66 | URL string
67 | FinalURL string
68 | ResponseCode int
69 | ResponseReason string
70 | Proto string
71 | ContentLength int64
72 | Title string
73 | Filename string
74 | }
75 |
76 | tmp.URL = url.URL
77 | tmp.FinalURL = url.FinalURL
78 | tmp.ResponseCode = url.ResponseCode
79 | tmp.ResponseReason = url.ResponseReason
80 | tmp.Proto = url.Proto
81 | tmp.ContentLength = url.ContentLength
82 | tmp.Title = url.Title
83 | tmp.Filename = url.Filename
84 |
85 | return json.Marshal(&tmp)
86 | }
87 |
88 | // Header contains an HTTP header
89 | type Header struct {
90 | gorm.Model
91 |
92 | URLID uint
93 |
94 | Key string
95 | Value string
96 | }
97 |
98 | // Technologie contains a technologie
99 | type Technologie struct {
100 | gorm.Model
101 |
102 | URLID uint
103 |
104 | Value string
105 | }
106 |
107 | // TLS contains TLS information for a URL
108 | type TLS struct {
109 | gorm.Model
110 |
111 | URLID uint
112 |
113 | Version uint16
114 | ServerName string
115 | TLSCertificates []TLSCertificate
116 | }
117 |
118 | // TLSCertificate contain TLS Certificate information
119 | type TLSCertificate struct {
120 | gorm.Model
121 |
122 | TLSID uint
123 |
124 | Raw []byte
125 | DNSNames []TLSCertificateDNSName
126 | SubjectCommonName string
127 | IssuerCommonName string
128 | SignatureAlgorithm string
129 | PubkeyAlgorithm string
130 | }
131 |
132 | // AddDNSName adds a new DNS Name to a Certificate
133 | func (tlsCert *TLSCertificate) AddDNSName(name string) {
134 | tlsCert.DNSNames = append(tlsCert.DNSNames, TLSCertificateDNSName{Name: name})
135 | }
136 |
137 | // TLSCertificateDNSName has DNS names for a TLS certificate
138 | type TLSCertificateDNSName struct {
139 | gorm.Model
140 |
141 | TLSCertificateID uint
142 | Name string
143 | }
144 |
145 | // ConsoleLog contains the console log, and exceptions emitted
146 | type ConsoleLog struct {
147 | gorm.Model
148 |
149 | URLID uint
150 |
151 | Time time.Time
152 | Type string
153 | Value string
154 | }
155 |
156 | // RequestType are network log types
157 | type RequestType int
158 |
159 | const (
160 | HTTP RequestType = 0
161 | WS
162 | )
163 |
164 | // NetworkLog contains Chrome networks events that were emitted
165 | type NetworkLog struct {
166 | gorm.Model
167 |
168 | URLID uint
169 |
170 | RequestID string
171 | RequestType RequestType
172 | StatusCode int64
173 | URL string
174 | FinalURL string
175 | IP string
176 | Time time.Time
177 | Error string
178 | }
179 |
--------------------------------------------------------------------------------
/cmd/scan_nmap.go:
--------------------------------------------------------------------------------
1 | package cmd
2 |
3 | import (
4 | "errors"
5 |
6 | "github.com/sensepost/gowitness/internal/ascii"
7 | "github.com/sensepost/gowitness/internal/islazy"
8 | "github.com/sensepost/gowitness/pkg/log"
9 | "github.com/sensepost/gowitness/pkg/readers"
10 | "github.com/spf13/cobra"
11 | )
12 |
13 | var nmapCmdOptions = &readers.NmapReaderOptions{}
14 | var nmapCmd = &cobra.Command{
15 | Use: "nmap",
16 | Short: "Scan targets from an Nmap XML file",
17 | Long: ascii.LogoHelp(ascii.Markdown(`
18 | # scan nmap
19 |
20 | Scan targets from an Nmap XML file.
21 |
22 | When performing Nmap scans, specify the -oX nmap.xml flag to store data in an
23 | XML-formatted file that gowitness can parse.
24 |
25 | By default, this command will try and screenshot all ports specified in an
26 | nmap.xml results file. That means it will try and do silly things like
27 | screenshot SSH services, which obviously won't work. It's for this reason that
28 | you'd want to specify the ports or services to parse using the --port and
29 | --service / --service-contains flags. For most HTTP-based services, try:
30 | - --service http
31 | - --service http-alt
32 | - --service http-mgmt
33 | - --service http-proxy
34 | - --service https
35 | - --service https-alt
36 |
37 | On ports, when specifying --port (can be multiple), target candidates will only
38 | be generated for results that match one of the specified ports. In contrast,
39 | when --exclude-port (can also be multiple) is set, no candidates for that port
40 | will be generated.
41 |
42 | **Note**: By default, no metadata is saved except for screenshots that are
43 | stored in the configured --screenshot-path. For later parsing (i.e., using the
44 | gowitness reporting feature), you need to specify where to write results (db,
45 | csv, jsonl) using the _--write-*_ set of flags. See _--help_ for available
46 | flags.`)),
47 | Example: ascii.Markdown(`
48 | - gowitness scan nmap -f ~/Desktop/targets.xml --write-json --write-db
49 | - gowitness scan nmap -f targets.xml --threads 50 --no-http --service https
50 | - gowitness scan nmap -f /tmp/n.xml --open-only --port 80 --port 443 --port 8080
51 | - gowitness scan nmap -f ~/nmap.xml --open-only --service-contains http`),
52 | PreRunE: func(cmd *cobra.Command, args []string) error {
53 | if nmapCmdOptions.Source == "" {
54 | return errors.New("a source must be specified")
55 | }
56 |
57 | if !islazy.FileExists(nmapCmdOptions.Source) {
58 | return errors.New("source is not readable")
59 | }
60 |
61 | return nil
62 | },
63 | Run: func(cmd *cobra.Command, args []string) {
64 | log.Debug("starting Nmap file scanning", "file", nmapCmdOptions.Source)
65 |
66 | reader := readers.NewNmapReader(nmapCmdOptions)
67 | go func() {
68 | if err := reader.Read(scanRunner.Targets); err != nil {
69 | log.Error("error in reader.Read", "err", err)
70 | return
71 | }
72 | }()
73 |
74 | scanRunner.Run()
75 | scanRunner.Close()
76 | },
77 | }
78 |
79 | func init() {
80 | scanCmd.AddCommand(nmapCmd)
81 |
82 | nmapCmd.Flags().StringVarP(&nmapCmdOptions.Source, "file", "f", "", "A file with targets to scan. Use - for stdin")
83 | nmapCmd.Flags().BoolVar(&nmapCmdOptions.NoHTTP, "no-http", false, "Do not add 'http://' to targets where missing")
84 | nmapCmd.Flags().BoolVar(&nmapCmdOptions.NoHTTPS, "no-https", false, "Do not add 'https://' to targets where missing")
85 | nmapCmd.Flags().BoolVarP(&nmapCmdOptions.OpenOnly, "open-only", "o", false, "Only scan ports marked as open")
86 | nmapCmd.Flags().IntSliceVar(&nmapCmdOptions.Ports, "port", []int{}, "A port filter to apply. Supports multiple --port flags")
87 | nmapCmd.Flags().IntSliceVar(&nmapCmdOptions.ExcludePorts, "exclude-port", []int{}, "A port exclusion filter to apply. Supports multiple --exclude-port flags")
88 | nmapCmd.Flags().IntSliceVar(&nmapCmdOptions.SkipPorts, "skip-port", []int{}, "Do not scan these ports. Supports multiple --skip-port flags")
89 | nmapCmd.Flags().StringVar(&nmapCmdOptions.ServiceContains, "service-contains", "", "A service name filter. Will check if service 'contains' this value first")
90 | nmapCmd.Flags().StringSliceVar(&nmapCmdOptions.Services, "service", []string{}, "A service filter to apply. Supports multiple --service flags")
91 | nmapCmd.Flags().BoolVar(&nmapCmdOptions.Hostnames, "hostnames", false, "Add hostnames in URL candidates (useful for virtual hosting)")
92 | }
93 |
--------------------------------------------------------------------------------
/web/ui/src/components/ui/dialog.tsx:
--------------------------------------------------------------------------------
1 | import * as React from "react"
2 | import * as DialogPrimitive from "@radix-ui/react-dialog"
3 | import { Cross2Icon } from "@radix-ui/react-icons"
4 |
5 | import { cn } from "@/lib/utils"
6 |
7 | const Dialog = DialogPrimitive.Root
8 |
9 | const DialogTrigger = DialogPrimitive.Trigger
10 |
11 | const DialogPortal = DialogPrimitive.Portal
12 |
13 | const DialogClose = DialogPrimitive.Close
14 |
15 | const DialogOverlay = React.forwardRef<
16 | React.ElementRefDashboard
46 |
47 |
73 |