PAGES
← all tools
◆ Exploitation & C2

gsocket

v1.4.32 open-source

Toolkit enabling two users behind NAT/firewall to establish end-to-end encrypted TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections via the Global Socket Relay Network.

source ↗ rss ↗ What is a cyber toolchain?

Summary

gsocket is an open-source command-line toolkit, released under BSD 2-Clause, that lets two hosts behind separate NAT or firewalls establish a direct, end-to-end encrypted TCP connection through the Global Socket Relay Network without any port forwarding or inbound access. It runs as a set of binaries invoked from a shell, used to build reverse shells, tunnel SSH, transfer files, or hold open a persistent reverse PTY, which makes it a fit for red teamers and penetration testers needing covert remote access rather than for defenders. It sits in the tunneling and covert-channel space alongside tools like ssh reverse tunnels or netcat-based backdoors, though gsocket's own focus is NAT traversal without server-side configuration. Started in 2020 with 16 contributors, it still sees commits in the past year, though its last formal release was over two years ago.

Toolkit enabling two users behind NAT/firewall to establish end-to-end encrypted TCP connections via the Global Socket Relay Network.

How gsocket helps

How do I get an interactive shell on a machine sitting behind NAT or a firewall with no inbound ports open?

one side listens on the Global Socket Relay Network and the other connects out to the same relay-derived address, so a reverse shell forms without any port forwarding or firewall rule on either end

How do I reach an internal service like SSH from outside without opening a port on the router?

the local daemon binds normally and gsocket relays connections to it through the network's rendezvous point, so a remote peer connecting through the relay lands on that service

How do I move files between two machines that are each behind their own NAT?

a receiving instance waits on the relay while the sending side pushes the file through the same encrypted tunnel, with no shared server or exposed port needed on either box

How do I keep working with a remote filesystem as if it were local when I can't SSH in directly?

the toolkit can mount the remote filesystem over the same relay tunnel, giving normal file access without a direct network path between the two hosts

How do I make sure the tunnel between two hosts can't be read or hijacked by whoever runs the relay in the middle?

the connection is end-to-end encrypted between the two endpoints, and a generated secret derived via the key-derivation scheme is what the two sides use to find and authenticate each other on the relay

How do I know if my listener is actually reachable before I try to connect to it?

a check flag reports whether a peer is currently listening on the relay before a connection attempt is made

all 4 features, with the evidence for each →

Languages

Not documented

Features

4 capabilities

Built from gsocket's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What gsocket offers you

  • Command-line interface1
All capabilities 4 capabilities
Interactive shell management shipped Establish and manage interactive reverse shells by listening for incoming connections or connecting to existing listeners. 4 releases · 3 other sources · first seen Jun 2021

Also counts toward: Command-line interface

release

  • Enables auto-reconnect for the -l server flag when DNS fails v1.4.32 · Jun 2021 · source · release history
  • Adds -v, -vv, and -vvv flags for verboser logging output v1.4.32 · Jun 2021 · source · release history
  • Adds -v, -vv, and -vvv flags to control verbosity levels. 1.4.31 · Jun 2021 · source · release history
  • Enables automatic reconnection for the -l (server/listener) mode when DNS failures occur. 1.4.31 · Jun 2021 · source · release history

example

  • Run a listener that automatically attempts to reconnect if DNS resolution fails, avoiding manual restarts. gsocket -l -vv listen 0.0.0.0:9090 1.4.31 · Jun 2021 · source
  • Connect interactive shell to listener gs-netcat -i
  • Listen for interactive reverse shell gs-netcat -l -i
Encrypted peer-to-peer networking shipped Enable direct TCP connections between users behind NAT or firewalls using the Global Socket Relay Network, including exposing local services like sshd. 3 releases · 2 other sources · first seen Jun 2021

release

  • Introduces new key derivation method and fixes gs secret length v1.4.32 · Jun 2021 · source · release history
  • Adds Protocol 1.3 (BREAKS BACKWARD COMPATIBILITY) v1.4.32 · Jun 2021 · source · release history
  • The underlying protocol is upgraded to version 1.3, which breaks backward compatibility with previous versions. 1.4.31 · Jun 2021 · source · release history

docs

  • Toolkit enabling two users behind NAT/firewall to establish end-to-end encrypted TCP connections via the Global Socket Relay Network.

example

  • Expose sshd through firewall via gsocket gsocket /usr/sbin/sshd
Remote filesystem access shipped Mount remote file systems locally and transfer files between workstations. 2 other sources

example

  • Mount remote filesystem locally gs-mount ~/mnt
  • Receive files on workstation A blitz -l
Password generation shipped Generate cryptographically secure random passwords. 1 other source

example

  • Generate a secure random password gs-netcat -g

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for gsocket, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail gsocket puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Website history

thc.org, every change

The Hacker's Choice's home page and 4 more pages as they looked each month from February 2022 to October 2026: 15 renders, 1 change of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

Show

2 entries

  1. June 20212
    Show

    2 entries

    1. v1.4.32 Jun 30, 2021 · release notes

      gsocket v1.4.32 adds protocol 1.3, -v/-vv/-vvv verbosity flags, and new key derivation

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4.32 https://github.com/hackerschoice/gsocket.git
# already have the repo? check out this version:
$ git checkout v1.4.32
      • Adds Protocol 1.3 (BREAKS BACKWARD COMPATIBILITY)
      • Adds -v, -vv, and -vvv flags for verboser logging output
      • Introduces new key derivation method and fixes gs secret length
      • Enables auto-reconnect for the -l server flag when DNS fails

      4 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Protocol 1.3 breaks backward compatibility with previous versions
    2. 1.4.31 Jun 8, 2021 · release notes

      Protocol 1.3 upgrade with -v verbosity flags and auto-reconnect for clients

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.4.31 https://github.com/hackerschoice/gsocket.git
# already have the repo? check out this version:
$ git checkout 1.4.31
      └──▷ USE IT
      Enable detailed logging output when running the client or server.
      shell 
      gsocket -vvv connect <host>
      Run a listener that automatically attempts to reconnect if DNS resolution fails, avoiding manual restarts.
      shell 
      gsocket -l -vv listen 0.0.0.0:9090
      • Adds -v, -vv, and -vvv flags to control verbosity levels.
      • Enables automatic reconnection for the -l (server/listener) mode when DNS failures occur.
      • Upgrades internal protocol to version 1.3, introducing a new key derivation method and fixing secret length.

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The underlying protocol is upgraded to version 1.3, which breaks backward compatibility with previous versions.

    Project health

    Issue, contributor and maintainer activity in hackerschoice/gsocket, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 −1 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 2.1 years issues closed, last 12 months
    6. Open backlog 30 of 75 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 30
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 1,922
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback