Book Image

Security with Go

By : John Daniel Leon, Karthik Gaekwad
Book Image

Security with Go

By: John Daniel Leon, Karthik Gaekwad

Overview of this book

Go is becoming more and more popular as a language for security experts. Its wide use in server and cloud environments, its speed and ease of use, and its evident capabilities for data analysis, have made it a prime choice for developers who need to think about security. Security with Go is the first Golang security book, and it is useful for both blue team and red team applications. With this book, you will learn how to write secure software, monitor your systems, secure your data, attack systems, and extract information. Defensive topics include cryptography, forensics, packet capturing, and building secure web applications. Offensive topics include brute force, port scanning, packet injection, web scraping, social engineering, and post exploitation techniques.
Table of Contents (15 chapters)

Development environment

All of the examples in this book will run across major platforms, Windows, macOS, and Linux. Having said that, the examples were primarily written and developed on Ubuntu Linux, and this is the recommended platform for the following examples.

Ubuntu Linux is available for free at https://www.ubuntu.com/download/desktop. The download page may ask for a donation, but you can choose to download for free. Ubuntu is not required, but the book will be easier to follow if you have the same environment. Other Linux distributions should work equally well, but I strongly recommend that you use a Debian-based distribution. Most of the Go code examples in this book will work on Windows, Linux, and Mac without any modification. Certain examples may be Linux- and Mac-specific, such as file permissions, which are not treated similarly in Windows. Any example that is specific to a platform is mentioned.

You can install Ubuntu for free inside a virtual machine or as your primary operating system. As long as your system has enough CPU, RAM, and disk space, I recommend that you use a virtual machine with Oracle VirtualBox, which is available at https://www.virtualbox.org/. VMWare Player is an alternative to VirtualBox and is available at https://www.vmware.com/products/player/playerpro-evaluation.html.

Download and install VirtualBox, and then, download the Ubuntu desktop ISO file. Create a virtual machine, have it boot the Ubuntu ISO, and choose the Install option. Once you have installed Ubuntu and logged in as your user, you can install the Go programming language. Ubuntu makes this incredibly easy by providing a package. Just open a Terminal window and run the following command:

sudo apt-get install golang-go

Using sudo elevates your privileges in order to install and may ask you for your password. If everything was successful, you will now have access to the go executable, which contains the whole toolchain. You can run go help or go by itself for usage instructions.

If you are not using Ubuntu or want to install the latest version, you can download the latest version from https://golang.org/dl. The Windows and Mac installer will take care of updating your PATH environment variable, but in Linux you will have to move the extracted contents to a desired location, such as /opt/go, and then update your PATH environment variable manually to include the location. Consider this example:

# Extract the downloaded Go tar.gz
tar xzf go1.9.linux-amd64.tar.gz
# Move the extracted directory to /opt
sudo mv go /opt
# Update PATH environment variable to include Go's binaries
echo "export PATH=$PATH:/opt/go/bin" >> ~/.bashrc

Now restart your Terminal for the changes to take effect. If you are using a shell other than Bash, you will need to update the proper RC file for your shell.

Installing Go on other platforms

If you are not using Ubuntu, you can still install Go easily. The Go website provides multiple installation formats on the Downloads page at https://golang.org/dl/.

Other Linux distributions

The first option is to use the package manager for the Linux distribution to install Go. Most major distributions have a package for Go. Names vary, so a web search may be necessary to get the exact package name. If there is no package available, you can simply download the precompiled Linux tarball and extract it. A good place to extract the contents is /opt/go. Then, add /opt/go/bin to your PATH environment variable the same way as described in the previous section.

Windows

An official Windows installer is available, which makes installation as simple as running the installer. You may need to modify the environment variables and update your %PATH% variable. In Windows 10, this can be found by navigating to Control Panel | System | Advanced System Settings | Environment Variables.

Mac

An official installer is also available for Mac. After running the installer, Go will be available in your PATH variable.

Setting up Go

At this point, your environment should have Go installed and you should be able to run go executable from your Terminal window. The go program is how you access the Go toolchain. You can test it by running this command:

go help

Now we are ready to write a first Hello World program to ensure that our environment is fully functional. Before we start coding, though, we need to create a proper workspace.

Creating your workspace

Go has a standard folder structure for a workspace. It is important to conform to certain standards for the Go toolchain to work properly. You can create a workspace directory anywhere you want and name it anything you like. For the lab environment, we will simply use the Home directory as the Go workspace. This means that source files will reside in ~/src, packages will be built in ~/pkg, and executables will be installed to ~/bin.

Setting up environment variables

In order for most of the Go toolchain to work, the GOPATH environment variable must be set. The GOPATH specifies what directory you treat as your workspace. The GOPATH environment variable must be set before you can build packages. For more help and information, call the go help command in the Terminal by running this command:

go help gopath

We need to tell Go to treat our home directory as the workspace. This is done by setting the GOPATH environment variable. You can set GOPATH in three ways:

  • The first way is to set it manually each time you run the go command. Consider this example:
      GOPATH=$HOME go build hello
  • You can also set the GOPATH variable so that it stays set until you close your Terminal and the environment variable is lost:
      export GOPATH=$HOME
  • The third option is to set the GOPATH environment variable permanently as follows:
    1. Add it to your shell startup script, .bashrc. This will set the variable every time you start the Terminal.
    2. Run this to ensure that GOPATH is set whenever you open future Terminal/shell sessions:
              echo "export GOPATH=$HOME" >> $HOME/.bashrc
    1. Restart your Terminal for the changes to take effect. If you are using Zsh or an alternative shell, you will need to update the respective RC file.
Note that Go version 1.8 and greater do not require the GOPATH environment variable to be explicitly set. If no GOPATH is set, it will use $HOME/go as a default workspace.

Editors

We're about to write our first program in our new hello directory. You will first need to choose which editor to use. Fortunately, working with Go does not require any special IDE or editor. The Go toolchain integrates easily into many editors and IDEs. Your options range from using a simple text editor, such as Notepad, to full-fledged IDEs dedicated to Go.

I recommend that you start with a simple text editor, such as nano or gedit, since these are included with Ubuntu, easy to use, and support syntax highlighting for Go out of the box. Feel free to choose another editor or IDE though.

Plugins exist for many text editors and IDEs to add Go support. For example, Visual Studio Code, Emacs, Sublime Text, JetBrains IntelliJ, Vim, Atom, NetBeans, and Eclipse all have Go plugins. There are a couple of Go-specific IDEs, namely JetBrains GoLand and LiteIDE, both of which are cross-platform.

Start with the nano or gedit command and explore other editors and IDEs after you are comfortable with Go. This book will not compare the editors or cover how to configure them.

Creating your first package

Within the ~/src directory, any directory you create is a package. The name of your directory becomes the name of the package or application. We need to first make sure that the src directory exists. Tilde (~) is a shortcut for your home directory similar to the $HOME variable. Refer to the following code block:

mkdir ~/src

Let's create a new package named hello for our first application:

cd ~/src
mkdir hello

A package is simply a directory. You can have one or more source files inside a package. Any subdirectories are treated as separate packages. A package can be an application with a main() function (package main), or it can be a library that can only be imported to other packages. This package doesn't have any files yet, but we'll write the first file in a moment. Don't worry too much about package structure for now. You can read more about package paths at https://golang.org/doc/code.html#PackagePaths.

Writing your first program

The simplest package you can have is a single file inside a directory. Create a new file, ~/src/hello/hello.go, and put the following code inside:

package main

import "fmt"

func main() {
fmt.Println("Hello, world.")
}

Running the executable file

The simplest way to execute a program is with the go run command. The following command will run the file without leaving behind an executable file:

go run ~/src/hello/hello.go

Building the executable file

To compile and build an executable file, use the go build command. When running go build you must pass a path to a package. The package path you provide is relative to $GOPATH/src. Since our package is in ~/src/hello, we would run the command as follows:

go build hello

We can actually call go build from anywhere as long as we have a $GOPATH set. The executable binary that is created will be output in the current working directory. You can then run it with this command:

./hello

Installing the executable file

The go build tool is good for generating an executable file in your current working directory, but there is a way to build and install your applications so that the executables are all collected in the same location.

When you run go install it puts the output file in a default location of $GOPATH/bin. In our case, we set $GOPATH equal to our $HOME. So the default bin directory would be $HOME/bin.

You can override the location by setting the GOBIN environment variable if you want it to install somewhere else. To install our hello program, we will run the following command:

go install hello

This will build and create an executable file, ~/bin/hello. The bin directory will get created automatically if it does not already exist. If you run the install command multiple times, it will rebuild and overwrite the executable in the bin directory. Then the application can be run with this:

~/bin/hello

You can add ~/bin to your PATH environment variable for convenience. Doing so will allow you to run the applications from any working directory. To add the bin directory to your PATH, run this in the Terminal:

echo "export PATH=$PATH:$HOME/gospace/bin" >> ~/.bashrc

Be sure to restart your Terminal after that to refresh the environment variables. After that you can run the hello application by simply typing the following into the Terminal:

hello

Installing the application is completely optional. You don't have to install programs to run or build them. You can always build and run from your current working directory when developing, but it can be convenient to install finished applications that get used.

Formatting with go fmt

The go fmt command is used to format source code files to meet Go formatting standards.

This will make sure that indentation is accurate and there are no excessive blank spaces, among other things. You can format a single Go source code file or a whole package at once. It is good practice to follow Go coding standards and run go fmt on your files so that you will have no doubt that your code follows the guidelines. Read more on formatting at https://golang.org/doc/effective_go.html#formatting.