{"id":26332643,"url":"https://github.com/abhinandan-khurana/go-check-http-methods","last_synced_at":"2025-11-03T19:24:30.785Z","repository":{"id":280619883,"uuid":"942595314","full_name":"Abhinandan-Khurana/go-check-http-methods","owner":"Abhinandan-Khurana","description":"A powerful, fast, and lightweight Go tool for testing HTTP method security across web applications and servers. Detect HTTP Verb Tampering vulnerabilities, dangerous methods, and server misconfigurations with ease.","archived":false,"fork":false,"pushed_at":"2025-03-04T11:25:52.000Z","size":29539,"stargazers_count":2,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-05-31T17:44:23.318Z","etag":null,"topics":["cli-tool","cybersecurity","http-methods","infosec","infosectools","pentest-tool","pentesting-tool","pentesting-tools","tampering-detection","vulnerability-scanner"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Abhinandan-Khurana.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-03-04T10:58:52.000Z","updated_at":"2025-05-27T19:50:52.000Z","dependencies_parsed_at":"2025-03-04T12:34:45.278Z","dependency_job_id":null,"html_url":"https://github.com/Abhinandan-Khurana/go-check-http-methods","commit_stats":null,"previous_names":["abhinandan-khurana/go-check-http-methods"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/Abhinandan-Khurana/go-check-http-methods","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Abhinandan-Khurana%2Fgo-check-http-methods","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Abhinandan-Khurana%2Fgo-check-http-methods/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Abhinandan-Khurana%2Fgo-check-http-methods/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Abhinandan-Khurana%2Fgo-check-http-methods/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Abhinandan-Khurana","download_url":"https://codeload.github.com/Abhinandan-Khurana/go-check-http-methods/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Abhinandan-Khurana%2Fgo-check-http-methods/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279000712,"owners_count":26082862,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-08T02:00:06.501Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli-tool","cybersecurity","http-methods","infosec","infosectools","pentest-tool","pentesting-tool","pentesting-tools","tampering-detection","vulnerability-scanner"],"created_at":"2025-03-15T23:29:53.121Z","updated_at":"2025-10-08T23:53:09.944Z","avatar_url":"https://github.com/Abhinandan-Khurana.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"./go-check-http-methods.svg\" width=\"300\" height=\"300\"\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://goreportcard.com/report/github.com/Abhinandan-Khurana/go-check-http-methods\"\u003e\u003cimg src=\"https://goreportcard.com/badge/github.com/Abhinandan-Khurana/go-check-http-methods\" alt=\"Go Report Card\"\u003e\u003c/a\u003e\n  \u003ca href=\"LICENSE\"\u003e\u003cimg src=\"https://img.shields.io/badge/license-MIT-blue.svg\" alt=\"License\"\u003e\u003c/a\u003e\n  \u003ca href=\"https://golang.org/doc/devel/release.html\"\u003e\u003cimg src=\"https://img.shields.io/badge/Go-1.23+-00ADD8.svg\" alt=\"Go Version\"\u003e\u003c/a\u003e\n\u003cimg src=\"https://img.shields.io/badge/version-v1.0.0-blue.svg\" alt=\"Version\"\u003e\n\u003c/p\u003e\n\nA powerful, fast, and lightweight Go tool for testing HTTP method security across web applications and servers. Detect HTTP Verb Tampering vulnerabilities, dangerous methods, and server misconfigurations with ease.\n\n## 🚀 Features\n\n- 🔥 **Comprehensive Method Testing** - Tests a wide range of HTTP methods including standard and non-standard methods\n- 🔍 **Vulnerability Detection** - Identifies potential HTTP verb tampering vulnerabilities and dangerous method configurations\n- 🌍 **Multiple URL Support** - Test individual URLs or bulk test from a file\n- 📊 **Flexible Output Formats** - Results in plain text, JSON, or XML format\n- 🔒 **Custom Authentication** - Support for basic auth, custom headers, and cookies\n- 🚦 **Concurrent Testing** - Configurable concurrency for faster scanning\n- 🎨 **Colorized Output** - Easy-to-read color-coded results (with no-color option)\n- 🔄 **Proxy Support** - Route requests through a proxy for anonymity or testing internal networks\n- 📱 **Cross-Platform** - Works on Windows, macOS, and Linux (both amd64 and arm64)\n\n## 📥 Installation\n\n### Pre-compiled Binaries\n\nDownload the latest release for your platform from the [releases page](https://github.com/Abhinandan-Khurana/go-check-http-methods/releases).\n\n### From Source\n\nMake sure you have Go 1.23+ installed, then run:\n\n```bash\n# Clone the repository\ngit clone https://github.com/Abhinandan-Khurana/go-check-http-methods.git\ncd go-check-http-methods\n\n# Build for your platform\nmake install\n\n# Or build for all platforms\nmake all\n```\n\n### Using Go Install\n\n```bash\ngo install github.com/Abhinandan-Khurana/go-check-http-methods@latest\n```\n\n## 📚 Usage\n\n### Basic Usage\n\n```bash\n# Test a single URL\n\ngo-check-http-methods -u \u003chttps://example.com\u003e\n\n# Test URLs from a file\n\ngo-check-http-methods -f urls.txt\n\n# Output results in JSON format\n\ngo-check-http-methods -u \u003chttps://example.com\u003e -format json\n\n# Save results to a file\n\ngo-check-http-methods -u \u003chttps://example.com\u003e -o results.txt\n```\n\n### Advanced Usage\n\n```bash\n# Test with custom HTTP methods\n\ngo-check-http-methods -u \u003chttps://example.com\u003e -m methods.txt\n\n# Increase concurrency for faster scanning\n\ngo-check-http-methods -u \u003chttps://example.com\u003e -c 20\n\n# Use silent mode (no banner, only results)\n\ngo-check-http-methods -u \u003chttps://example.com\u003e -silent\n\n# Disable color output\n\ngo-check-http-methods -u \u003chttps://example.com\u003e -nc\n\n# Add custom headers and authentication\n\ngo-check-http-methods -u \u003chttps://example.com\u003e -H \"Authorization: Bearer token\" -H \"X-Custom: Value\"\n\n# Use a proxy\n\ngo-check-http-methods -u \u003chttps://example.com\u003e -proxy \u003chttp://127.0.0.1:8080\u003e\n```\n\n### Command-Line Options\n\n```bash\n-u string\nSingle URL to test\n-f string\nFile containing URLs to test (one per line)\n-o string\nOutput file for results\n-format string\nOutput format: txt, json, or xml (default \"txt\")\n-m string\nFile containing HTTP methods to test\n-c int\nNumber of concurrent requests (default 10)\n-t int\nRequest timeout in seconds (default 10)\n-L Follow redirects\n-k Allow insecure TLS connections\n-v Verbose output\n-q Quiet mode, no output except results\n-silent\nSilent mode, no banner but show results\n-nc No color output\n-view string\nView mode: all, enabled, vulnerable (default \"all\")\n-proxy string\nUse proxy (format: \u003chttp://host:port\u003e)\n-ua string\nUser agent string\n-H string\nCustom header (can be used multiple times, format: 'Name: Value')\n-cookie string\nCookie to include (can be used multiple times, format: 'name=value')\n-auth string\nBasic authentication (format: username:password)\n```\n\n## 🔍 Examples\n\n### Testing for Verb Tampering Vulnerabilities\n\n```bash\ngo-check-http-methods -u \u003chttps://example.com\u003e -view vulnerable -v\n```\n\nThis command will:\n\n- Test the URL with all supported HTTP methods\n- Show only vulnerable methods in the results\n- Display verbose output during scanning\n\n### Sample Output\n\n```bash\n                         _               _         _     _   _                              _   _               _\n   __ _  ___         ___| |__   ___  ___| | __    | |__ | |_| |_ _ __        _ __ ___   ___| |_| |__   ___   __| |___\n  / _' |/ _ \\ _____ / __| '_ \\ / _ \\/ __| |/ /____| '_ \\| __| __| '_ \\ _____| '_ ' _ \\ / _ \\ __| '_ \\ / _ \\ / _' / __|\n | (_| | (_) |_____| (__| | | |  __/ (__|   \u003c_____| | | | |_| |_| |_) |_____| | | | | |  __/ |_| | | | (_) | (_| \\__ \\\n  \\__, |\\___/       \\___|_| |_|\\___|\\___|_|\\_\\    |_| |_|\\__|\\__| .__/      |_| |_| |_|\\___|\\__|_| |_|\\___/ \\__,_|___/\n  |___/                                                         |_|\n\nAuthor: Abhinandan Khurana aka @l0u51f3r007\ngo-check-http-methods v1.0.0 - Results\nTimestamp: 2025-03-04T16:41:01+05:30\n\nURL: https://example.com\nMETHOD     CODE     STATUS                                   RESPONSE_TIME  VULNERABILITY\n----------------------------------------------------------------------------------------------------\nPOST        403       403 Forbidden                             928\n----------------------------------------------------------------------------------------------------\nPROPFIND    501       501 Not Implemented                       928           DANGEROUS\n----------------------------------------------------------------------------------------------------\nHEAD        200       200 OK                                    929\n----------------------------------------------------------------------------------------------------\nPATCH       501       501 Not Implemented                       929\n----------------------------------------------------------------------------------------------------\nDELETE      501       501 Not Implemented                       939           DANGEROUS\n----------------------------------------------------------------------------------------------------\nGET         200       200 OK                                    939\n----------------------------------------------------------------------------------------------------\nCONNECT     400       400 Bad Request                           946\n----------------------------------------------------------------------------------------------------\nTRACE       403       403 Forbidden                             960           DANGEROUS\n----------------------------------------------------------------------------------------------------\nPUT         501       501 Not Implemented                       963           DANGEROUS\n----------------------------------------------------------------------------------------------------\nOPTIONS     501       501 Not Implemented                       1027\n----------------------------------------------------------------------------------------------------\nMKCOL       501       501 Not Implemented                       227           DANGEROUS\n----------------------------------------------------------------------------------------------------\nCOPY        501       501 Not Implemented                       245           DANGEROUS\n----------------------------------------------------------------------------------------------------\nMOVE        501       501 Not Implemented                       283           DANGEROUS\n----------------------------------------------------------------------------------------------------\nPROPPATCH   501       501 Not Implemented                       348           DANGEROUS\n----------------------------------------------------------------------------------------------------\nLOCK        501       501 Not Implemented                       810           DANGEROUS\n----------------------------------------------------------------------------------------------------\nUNLINK      400       400 Bad Request                           785\n----------------------------------------------------------------------------------------------------\nLINK        400       400 Bad Request                           789\n----------------------------------------------------------------------------------------------------\nPURGE       400       400 Bad Request                           803\n----------------------------------------------------------------------------------------------------\nUNLOCK      501       501 Not Implemented                       809           DANGEROUS\n----------------------------------------------------------------------------------------------------\n```\n\n### Sample JSON output\n\n```json\n{\n  \"tool_name\": \"go-check-http-methods\",\n  \"tool_version\": \"1.0.0\",\n  \"tool_author\": \"Abhinandan Khurana aka @l0u51f3r007\",\n  \"timestamp\": \"2025-03-04T16:41:57+05:30\",\n  \"results\": [\n    {\n      \"url\": \"https://example.com\",\n      \"results\": [\n        {\n          \"method\": \"CONNECT\",\n          \"status_code\": 400,\n          \"status\": \"400 Bad Request\",\n          \"response_time_ms\": 810,\n          \"content_length\": 312,\n          \"is_dangerous\": false,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"TRACE\",\n          \"status_code\": 403,\n          \"status\": \"403 Forbidden\",\n          \"response_time_ms\": 810,\n          \"content_length\": 359,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"PATCH\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 811,\n          \"content_length\": 336,\n          \"is_dangerous\": false,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"POST\",\n          \"status_code\": 403,\n          \"status\": \"403 Forbidden\",\n          \"response_time_ms\": 813,\n          \"content_length\": 359,\n          \"is_dangerous\": false,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"OPTIONS\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 813,\n          \"content_length\": 19,\n          \"is_dangerous\": false,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"DELETE\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 810,\n          \"content_length\": 339,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"PUT\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 810,\n          \"content_length\": 334,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"HEAD\",\n          \"status_code\": 200,\n          \"status\": \"200 OK\",\n          \"response_time_ms\": 810,\n          \"content_length\": 0,\n          \"is_dangerous\": false,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"GET\",\n          \"status_code\": 200,\n          \"status\": \"200 OK\",\n          \"response_time_ms\": 810,\n          \"content_length\": 1256,\n          \"is_dangerous\": false,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"PROPFIND\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 810,\n          \"content_length\": 339,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"LOCK\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 299,\n          \"content_length\": 337,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"MKCOL\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 300,\n          \"content_length\": 336,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"LINK\",\n          \"status_code\": 400,\n          \"status\": \"400 Bad Request\",\n          \"response_time_ms\": 762,\n          \"content_length\": 312,\n          \"is_dangerous\": false,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"UNLOCK\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 764,\n          \"content_length\": 339,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"MOVE\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 790,\n          \"content_length\": 335,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"PURGE\",\n          \"status_code\": 400,\n          \"status\": \"400 Bad Request\",\n          \"response_time_ms\": 789,\n          \"content_length\": 312,\n          \"is_dangerous\": false,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"PROPPATCH\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 791,\n          \"content_length\": 342,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"COPY\",\n          \"status_code\": 501,\n          \"status\": \"501 Not Implemented\",\n          \"response_time_ms\": 793,\n          \"content_length\": 335,\n          \"is_dangerous\": true,\n          \"is_vulnerable\": false\n        },\n        {\n          \"method\": \"UNLINK\",\n          \"status_code\": 400,\n          \"status\": \"400 Bad Request\",\n          \"response_time_ms\": 799,\n          \"content_length\": 312,\n          \"is_dangerous\": false,\n          \"is_vulnerable\": false\n        }\n      ]\n    }\n  ]\n}\n```\n\n## 🏗️ Building from Source\n\nYou can build this tool for multiple platforms using the included Makefile:\n\n```bash\n# Build for all platforms\n\nmake all\n\n# Build for specific platform\n\nmake linux-amd64\n\n# Clean build artifacts\n\nmake clean\n\n# Package builds into zip files\n\nmake package\n```\n\n## 📋 HTTP Method Descriptions\n\n| Method    | Description                                      | Potential Risk |\n| --------- | ------------------------------------------------ | -------------- |\n| GET       | Retrieve a resource                              | Low            |\n| POST      | Create a new resource                            | Medium         |\n| PUT       | Update a resource                                | High           |\n| DELETE    | Delete a resource                                | High           |\n| HEAD      | Similar to GET but returns only headers          | Low            |\n| OPTIONS   | Returns the HTTP methods supported by the server | Low            |\n| PATCH     | Partial update of a resource                     | Medium         |\n| TRACE     | Echo the received request                        | High           |\n| CONNECT   | Establish a network connection                   | Medium         |\n| PROPFIND  | WebDAV method to retrieve properties             | High           |\n| PROPPATCH | WebDAV method to change properties               | High           |\n| MKCOL     | WebDAV method to create collections              | High           |\n| COPY      | WebDAV method to copy a resource                 | High           |\n| MOVE      | WebDAV method to move a resource                 | High           |\n| LOCK      | WebDAV method to lock a resource                 | High           |\n| UNLOCK    | WebDAV method to unlock a resource               | High           |\n\n## 🤝 Contributing\n\nContributions are welcome! Please feel free to submit a Pull Request.\n\n1. Fork the repository\n2. Create your feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add some amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📝 License\n\nThis project is licensed under the MIT License - see the LICENSE file for details.\n\n## 🙏 Acknowledgments\n\n- [Fatih Color](https://github.com/fatih/color) - For the colorized output\n\n---\n\nMade with \u003c3 by \u003ca href=\"https://x.com/l0u51f3r007\"\u003eAbhinandan Khurana\u003c/a\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fabhinandan-khurana%2Fgo-check-http-methods","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fabhinandan-khurana%2Fgo-check-http-methods","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fabhinandan-khurana%2Fgo-check-http-methods/lists"}