GoDDos-Html is a lightweight web-page botnet controller written in Go, designed for simplicity by sending attacks to the 'Bots' / 'Servers' through a web-interface.
- User Management: Authenticate and Register.
- Command Distribution: Send distinct commands from the server to the bots.
- Secure Authentication: Utilizes password hashing and session management.
- Easy Setup: Straightforward steps to get started with minimal configuration.
The images contain a domain: *Birdo.local*, which is a local domain set up for project testing.
Misuse the ServerConfig.PublicKeyCallback callback
potential 'authorization bypass'
Go further down to read about.
This involves the misuse of ServerConfig.PublicKeyCallback
, leading to an authorization bypass in golang.org/x/crypto
. If the PublicKeyCallback
function is implemented to return nil, nil
unconditionally, it execute a successful authentication without validating the client's public key.
Although this was not an immediate issue in the project, it has been flagged for safety reasons. It's important to note that even minor vulnerabilities in code can lead to an unintended chain of issues. Therefore, it's get an update to help better security in the long term.
To deploy and use GoDDos-Html, follow these steps:
-
You will need to set up the MySQL database before running the
./web-controller
. -
Change port and IP if needed on Line 35.
git clone https://github.com/Birdo1221/GoDDos-Html.git cd GoDDos-Html go build -o web-controller ./web-controller
CREATE DATABASE IF NOT EXISTS net1;
USE net1;
CREATE TABLE IF NOT EXISTS users (
id INT AUTO_INCREMENT PRIMARY KEY,
username VARCHAR(50) UNIQUE NOT NULL,
password_hash VARCHAR(60) NOT NULL
);
CREATE TABLE IF NOT EXISTS sessions (
id INT AUTO_INCREMENT PRIMARY KEY,
user_id INT NOT NULL,
FOREIGN KEY (user_id) REFERENCES users(id),
session_key VARCHAR(60) UNIQUE NOT NULL
);
- Open your web browser and navigate to http://localhost:80. If you change the IP/PORT, just head to that.
- Go + MySQL: Ensure Go and MySQL are installed and accessible.
- Database Configuration: Configure the database connection in the
initDB()
function.
- Register a user account to access the controller dashboard.
- Login with your credentials to access the dashboard.
- Use the dashboard to send commands to connected bots.
This project is licensed under the MIT License - see the LICENSE file for details.