{"id":17293037,"url":"https://github.com/macmod/goblob","last_synced_at":"2025-03-22T18:34:42.627Z","repository":{"id":142698120,"uuid":"613386057","full_name":"Macmod/goblob","owner":"Macmod","description":"A fast enumeration tool for publicly exposed Azure Storage blobs.","archived":false,"fork":false,"pushed_at":"2023-03-25T13:28:49.000Z","size":2646,"stargazers_count":87,"open_issues_count":1,"forks_count":3,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-03-18T14:05:49.401Z","etag":null,"topics":["azure-blob-storage","azure-storage","blob-storage","brute-force","bruteforce","bug-bounty","bugbounty","enumeration","go","golang","infosec","pentest","recon","reconnaissance","scanner","security"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Macmod.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-03-13T13:25:02.000Z","updated_at":"2025-03-18T01:56:38.000Z","dependencies_parsed_at":null,"dependency_job_id":"5ccc13ed-b248-44fc-8839-4db336e7bc18","html_url":"https://github.com/Macmod/goblob","commit_stats":null,"previous_names":[],"tags_count":12,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Macmod%2Fgoblob","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Macmod%2Fgoblob/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Macmod%2Fgoblob/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Macmod%2Fgoblob/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Macmod","download_url":"https://codeload.github.com/Macmod/goblob/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245003774,"owners_count":20545660,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure-blob-storage","azure-storage","blob-storage","brute-force","bruteforce","bug-bounty","bugbounty","enumeration","go","golang","infosec","pentest","recon","reconnaissance","scanner","security"],"created_at":"2024-10-15T10:45:03.433Z","updated_at":"2025-03-22T18:34:41.751Z","avatar_url":"https://github.com/Macmod.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Goblob 🫐\n\n![](https://img.shields.io/github/go-mod/go-version/Macmod/goblob) ![](https://img.shields.io/github/languages/code-size/Macmod/goblob) ![](https://img.shields.io/github/license/Macmod/goblob) ![](https://img.shields.io/github/actions/workflow/status/Macmod/goblob/release.yml) [![Go Report Card](https://goreportcard.com/badge/github.com/Macmod/goblob)](https://goreportcard.com/report/github.com/Macmod/goblob)\n\nGoblob is a lightweight and fast enumeration tool designed to aid in the discovery of sensitive information exposed publicy in Azure blobs, which can be useful for various research purposes such as vulnerability assessments, penetration testing, and reconnaissance.\n\n*Warning*. Goblob will issue individual goroutines for each container name to check in each storage account, only limited by the maximum number of concurrent goroutines specified in the `-goroutines` flag. This implementation can exhaust bandwidth pretty quickly in most cases with the default wordlist, or potentially cost you a lot of money if you're using the tool in a cloud environment. Make sure you understand what you are doing before running the tool.\n\n# Installation\n`go install github.com/Macmod/goblob@latest`\n\n# Usage\n\nTo use goblob simply run the following command:\n\n```bash\n$ ./goblob \u003cstorageaccountname\u003e\n```\n\nWhere `\u003cstorageaccountname\u003e` is the target storage account to enumerate public Azure blob storage URLs on.\n\nYou can also specify a list of storage account names to check:\n```bash\n$ ./goblob -accounts accounts.txt\n```\n\nBy default, the tool will use a list of common Azure Blob Storage container names to construct potential URLs. However, you can also specify a custom list of container names using the `-containers` option. For example:\n\n```bash\n$ ./goblob -accounts accounts.txt -containers wordlists/goblob-folder-names.txt\n```\n\nThe tool also supports outputting the results to a file using the `-output` option:\n```bash\n$ ./goblob -accounts accounts.txt -containers wordlists/goblob-folder-names.txt -output results.txt\n```\n\nIf you want to provide accounts to test via `stdin` you can also omit `-accounts` (or the account name) entirely:\n\n```bash\n$ cat accounts.txt | ./goblob\n```\n\n## Wordlists\n\nGoblob comes bundled with basic wordlists that can be used with the `-containers` option:\n\n- [wordlists/goblob-folder-names.txt](wordlists/goblob-folder-names.txt) (default) - Adaptation from koaj's [aws-s3-bucket-wordlist](https://github.com/koaj/aws-s3-bucket-wordlist/blob/master/list.txt) - a wordlist containing generic bucket names that are likely to be used as container names.\n- [wordlists/goblob-folder-names.small.txt](wordlists/goblob-folder-names.small.txt) - Subset of the default wordlist containing only words that have been found as container names in a real experiment with over 35k distinct storage accounts + words from the default wordlist that are part of the NLTK corpus.\n- [wordlists/goblob-folder-names.micro.txt](wordlists/goblob-folder-names.micro.txt) - Subset of the small wordlist containing only words that have been found as container names in a real experiment with over 35k distinct storage accounts.\n\n## Optional Flags\n\nGoblob provides several flags that can be tuned in order to improve the enumeration process:\n\n- `-goroutines=N` - Maximum number of concurrent goroutines to allow (default: `5000`).\n- `-blobs=true` - Report the URL of each blob instead of the URL of the containers (default: `false`).\n- `-verbose=N` - Set verbosity level (default: `1`, min: `0`, max: `3`).\n- `-maxpages=N` - Maximum of container pages to traverse looking for blobs (default: `20`, set to `-1` to disable limit or to `0` to avoid listing blobs at all and just check if the container is public)\n- `-timeout=N` - Timeout for HTTP requests (seconds, default: `90`)\n- `-maxidleconns=N` - `MaxIdleConns` transport parameter for HTTP client (default: `100`)\n- `-maxidleconnsperhost=N` - `MaxIdleConnsPerHost` transport parameter for HTTP client (default: `10`)\n- `-maxconnsperhost=N` - `MaxConnsPerHost` transport parameter for HTTP client (default: `0`)\n- `-skipssl=true` - Skip SSL verification (default: `false`)\n- `-invertsearch=true` - Enumerate accounts for each container instead of containers for each account (default: `false`)\n\nFor instance, if you just want to find publicly exposed containers using large lists of storage accounts and container names, you should use `-maxpages=0` to prevent the goroutines from paginating the results. Then run it again on the set of results you found with `-blobs=true` and `-maxpages=-1` to actually get the URLs of the blobs.\n\nIf, on the other hand, you want to test a small list of very popular container names against a large set of storage accounts, you might want to try `-invertsearch=true` with `-maxpages=0`, in order to see the public accounts for each container name instead of the container names for each storage account.\n\nYou may also want to try changing `-goroutines`, `-timeout` and `-maxidleconns`, `-maxidleconnsperhost` and `-maxconnsperhost` and `-skipssl` in order to best use your bandwidth and find results faster.\n\nExperiment with the flags to find what works best for you ;-)\n\n## Example\n\n[![asciicast](https://asciinema.org/a/568038.svg)](https://asciinema.org/a/568038)\n\n# Contributing\nContributions are welcome by [opening an issue](https://github.com/Macmod/goblob/issues/new) or by [submitting a pull request](https://github.com/Macmod/goblob/pulls).\n\n# TODO\n* Check blob domain for NXDOMAIN before trying wordlist to save bandwidth (maybe)\n* Improve default parameters for better performance\n\n# Wordcloud\n\nAn interesting visualization of popular container names found in my experiments with the tool:\n\n![wordcloud.png](wordcloud.png)\n\nIf you want to know more about my experiments and the subject in general, take a look at my article:\n\n* [FireShellSecurity Team - The Dangers of Exposed Azure Blobs](https://fireshellsecurity.team/dangers-of-exposed-blobs/)\n\n# License\nThe MIT License (MIT)\n\nCopyright (c) 2023 Artur Henrique Marzano Gonzaga\n\nPermission is hereby granted, free of charge, to any person\nobtaining a copy of this software and associated documentation\nfiles (the \"Software\"), to deal in the Software without\nrestriction, including without limitation the rights to use,\ncopy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the\nSoftware is furnished to do so, subject to the following\nconditions:\n\nThe above copyright notice and this permission notice shall be\nincluded in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES\nOF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\nNONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\nHOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,\nWHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING\nFROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR\nOTHER DEALINGS IN THE SOFTWARE.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmacmod%2Fgoblob","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmacmod%2Fgoblob","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmacmod%2Fgoblob/lists"}