Book Image

Security with Go

By : John Daniel Leon, Karthik Gaekwad
Book Image

Security with Go

By: John Daniel Leon, Karthik Gaekwad

Overview of this book

Go is becoming more and more popular as a language for security experts. Its wide use in server and cloud environments, its speed and ease of use, and its evident capabilities for data analysis, have made it a prime choice for developers who need to think about security. Security with Go is the first Golang security book, and it is useful for both blue team and red team applications. With this book, you will learn how to write secure software, monitor your systems, secure your data, attack systems, and extract information. Defensive topics include cryptography, forensics, packet capturing, and building secure web applications. Offensive topics include brute force, port scanning, packet injection, web scraping, social engineering, and post exploitation techniques.
Table of Contents (15 chapters)

Creating web shells

A web shell is similar to a bind shell, but, instead of listening as a raw TCP socket, it listens and communicates as an HTTP server. It is a useful method of creating persistent access to a machine.

One reason a web shell may be necessary, is because of firewalls or other network restrictions. HTTP traffic may be treated differently than other traffic. Sometimes the 80 and 443 ports are the only ports allowed through a firewall. Some networks may inspect the traffic to ensure that only HTTP formatted requests are allowed through.

Keep in mind that using plain HTTP means the traffic can be logged in plaintext. HTTPS can be used to encrypt the traffic, but the SSL certificate and key are going to reside on the server so that a server admin will have access to it. All you need to do to make this example use SSL is to change http.ListenAndServe() to http.ListenAndServeTLS...