Projects using Go in IndiaProjects using Go in India
Projects
People
Cover image for I am excited to share
I am excited to share a project I've been working on: the_almighty, a deterministic web-vulnerability scanner built entirely in Go. Unlike traditional black-box scanners that rely on simple payload spraying, the_almighty is designed with high signal-to-noise ratio in mind. Findings are only reported when verified by a Go oracle (e.g., verbatim reflection, error signature, time delay, or an out-of-band callback). Key Capabilities: 🔹 OOB Correlation: Captures blind/stored XSS, SSRF, and command injections via tokenized out-of-band callbacks. 🔹 Grey-box IAST: Server-side PHP and JS agents locate tainted input reaching dangerous sinks with file and line numbers. 🔹 Headless Browser Crawler: Leverages a pooled headless Chrome instance to crawl modern single-page applications. 🔹 AI-Powered Payload Widening: Uses local LLMs (via Ollama) to dynamically generate and expand test payloads, keeping validation deterministic. 🔹 Observation Engine: Correlates, deduplicates, and scores results into SQLite (WAL) for a clean, prioritized list. Engineered with a strict scope guard and per-host rate limiters to guarantee scanning stays safe and within boundaries. Stack: Go 1.26, Cobra, chromedp, SQLite, and Ollama. #ApplicationSecurity #SoftwareEngineering #GoLang #IAST #PenetrationTesting #DevSecOps
0
52