PAGES
← all tools
◆ Exploitation & C2

godoh

1.6 open-source

4 more tools, grouped by what they do.

Wireless & RF

Reconnaissance & OSINT

Reverse Engineering

godoh is a proof of concept Command and Control framework, written in Golang, that uses DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. as a transport medium.

source ↗ rss ↗ What is a cyber toolchain?

Summary

godoh is an open-source, GPLv3-licensed command-and-control framework, written in Golang, that tunnels an agent's traffic through DNS-over-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. instead of raw DNS, using Google or Cloudflare as the DoH provider while still supporting traditional DNS as a fallback transport. It runs from the command line, with subcommands to start a C2 server, connect an agent, or send and receive files over the channel, and is aimed at red teamers testing whether an organisation's egress filtering and DNS inspection can catch a covert channel disguised as ordinary HTTPS. It is described as a proof-of-concept rather than an operational implant, useful for demonstrating the technique in an engagement rather than running it as infrastructure. Development has been quiet, with two contributors, seven tagged releases since 2018, and no commits in the past year.

godoh is a proof of concept Command and Control framework, written in Golang, that uses DNS-over-HTTPS as a transport medium.

How godoh helps

Will an egress filter that trusts HTTPS let this traffic through unnoticed?

routes agent traffic as DNS-over-HTTPS to Google or Cloudflare, so on the wire it looks like ordinary HTTPS to a trusted resolver rather than a raw DNS or custom C2 protocol

Can data still get out if outbound DNS is blocked but HTTPS is not?

falls back to traditional DNS as a transport when DoH is unavailable, letting the same agent be tested against either egress path

What does a covert channel over DNS-over-HTTPS actually look like to a blue team, end to end?

provides a working agent and server pair that establishes the channel, sends commands, and moves files, so the whole exchange can be captured and inspected on a real network

Which DoH provider should this engagement route traffic through?

lets the operator pick Google or Cloudflare as the resolving provider, so the test can match whichever provider the target's environment is known to trust or permit

How do I move a file across the network without opening a separate channel?

sends and receives files through the same DNS-over-HTTPS tunnel the agent uses, rather than a distinct file-transfer protocol

all 5 features, with the evidence for each →

Languages

Not documented

Features

5 capabilities · 1 backed by code, an API document or a real run

Built from godoh's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What godoh offers you

  • JSON data export1
  • Command-line interface
All capabilities 5 capabilities
DoH provider SSL certificate validation verified Validates SSL certificates of DNS-over-HTTPS providers. 2 releases · 2 other sources · first seen Oct 2018

release

  • Adds a new CLI flag to configure how goDoH handles invalid SSL certificates 1.3 · Oct 2018 · source · release history
  • Disables SSL certificate validation to support corporate SSL intercepting proxies 1.1 · Oct 2018 · source · release history

command line

  • --validate-certificate — Validate DoH provider SSL certificates 1.3 · Oct 2018 · command-line history

example

  • Force use of Quad9 DNS-over-HTTPS with strict certificate validation godoh --provider quad9 <target> 1.3 · Oct 2018 · source
DNS-over-HTTPS Command & Control shipped Supports using DNS-over-HTTPS transports for command and control communications, including compatibility with major providers like Google and Cloudflare. 2 releases · 1 other source · first seen Oct 2018

release

  • Adds the googlefront provider that will domain front dns.google.com via www.google.com. 1.4 · Nov 2018 · source · release history
  • Adds support for the Quad9 DNS-over-HTTPS provider 1.3 · Oct 2018 · source · release history

docs

  • DNS-over-HTTPS Command & Control proof-of-concept framework written in Go, supporting Google, Cloudflare, and traditional DNS transports.
Data serialization format selection shipped Supports configurable data serialization formats, such as JSON, to improve client interoperability. 1 release · first seen Oct 2019

Also counts toward: JSON data export

release

  • Changed the internal serializer from msgpack to json for easier client interoperability 1.6 · Oct 2019 · source · release history
Execution mode configuration shipped Allows the cyber tool to operate in specified execution modes, such as agent mode, with configurable defaults. 1 release · first seen Feb 2019

release

  • Changes the default execution mode from client (or previous default) to agent mode 1.5 · Feb 2019 · source · release history
Hardcoded encryption key warnings shipped Issues warnings regarding hardcoded encryption keys embedded in the tool's binaries. 1 release · first seen Oct 2018

release

  • Adds warning about the hardcoded encryption key used in binaries 1.1 · Oct 2018 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for godoh, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail godoh puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

5 entries

  1. October 20191
  3. February 20191
  5. November 20181
  7. October 20182

    5 entries

    1. 1.6 Oct 23, 2019 · release notes

      godoh 1.6 changes internal serialization to JSON

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.6 https://github.com/sensepost/goDoH.git
# already have the repo? check out this version:
$ git checkout 1.6
      • Changed the internal serializer from msgpack to json for easier client interoperability

      1 detail in Everything

    2. 1.5 Feb 6, 2019 · release notes

      goDoH v1.5 switches default operating mode to agent

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.5 https://github.com/sensepost/goDoH.git
# already have the repo? check out this version:
$ git checkout 1.5
      • Changes the default execution mode from client (or previous default) to agent mode

      1 detail in Everything

    3. 1.4 Nov 6, 2018 · release notes

      Adds googlefront domain-fronting provider to bypass censorship via DNS over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.4 https://github.com/sensepost/goDoH.git
# already have the repo? check out this version:
$ git checkout 1.4
      • Adds the googlefront provider that will domain front dns.google.com via www.google.com.

      1 detail in Everything

    4. 1.3 Oct 26, 2018 · release notes

      Adds --no-check-cert flag for invalid SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. and Quad9 provider support

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.3 https://github.com/sensepost/goDoH.git
# already have the repo? check out this version:
$ git checkout 1.3
      └──▷ TRY IT
      Force use of Quad9 DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. with strict certificate validation
      $ godoh --provider quad9 <target>
      • Adds a new CLI flag to configure how goDoH handles invalid SSL certificates
      • Adds support for the Quad9 DNS-over-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. provider

      2 details in Everything

    5. 1.1 Oct 24, 2018 · release notes

      godoh v1.1 disables SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cert validation by default and adds explicit warning about hardcoded encryption key

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.1 https://github.com/sensepost/goDoH.git
# already have the repo? check out this version:
$ git checkout 1.1
      • Disables SSL certificate validation to support corporate SSL intercepting proxies
      • Adds warning about the hardcoded encryption key used in binaries

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in sensepost/goDoH, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 1 of 8 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 1
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 807
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback