gogo is a high-performance Go scanning engine for authorized red teams, combining configurable port scanning, fingerprinting, and nuclei-compatible PoC checks in one binary.
| Tool | chainreactors/gogo — a highly controllable and extensible automated scanning engine written in pure Go |
| Category | Network reconnaissance and service fingerprinting scanner |
| Primary Use | Authorized internal/external asset discovery: port scanning, active/passive fingerprinting, information extraction, and harmless PoC verification during scoped assessments |
| Safe Use | Use only on networks you are explicitly authorized to test — internal labs, engagements with written scope, and defensive asset inventory; the authors state gogo itself carries no attack capability and requires prior authorization |
| Telemetry Note | Generates heavy concurrent connection traffic (default 1000–4000 threads), which is readily visible to IDS/NetFlow monitoring; produces local .dat result files and version-bearing HTTP probes that defenders can fingerprint |
gogo from chainreactors is a scanning engine that has carved out a distinctive niche in the red-team tooling ecosystem: rather than trying to be an exploitation framework, it concentrates almost entirely on fast, information-dense reconnaissance. With roughly 2,100 stars, a GPL-3.0 license, and topics like recon and redteam, it sits in the same family as fscan, kscan, and LadonGo — tools the author explicitly credits as influences in the README. What differentiates gogo is its engineering posture: it is written in nearly dependency-free native Go, keeps memory and CPU footprint minimal, and adheres to a stated principle of extracting maximum information from the minimum number of packets sent.
The feature set reads like a checklist of what an operator actually needs during the initial mapping phase of an authorized engagement. Port configuration is free-form, supporting ranges, comma-separated combinations, and named tags such as -p common, -p top2, or -p all for preset port collections categorized by service type. Fingerprint identification works both actively and passively, and key information extraction covers obvious items like HTTP title and TLS certificates plus user-supplied regular expressions for custom extraction logic. This last point matters — the DSL-driven configuration model means teams can tailor gogo to their own target profiles rather than relying solely on upstream fingerprints.
One of the more interesting architectural choices is PoC support. gogo is compatible with nuclei PoC templates through a separate engine the author maintains, chainreactors/neutron, and pulls templates from the chainreactors/templates repository. Critically, the README emphasizes that scanning is harmless by design: every PoC that gets added is manually reviewed, and the author states plainly that gogo itself possesses no attack capability and cannot exploit any vulnerability. That positions it firmly as a detection-and-identification tool rather than a weaponization platform, which is consistent with its use in authorized assessments.
Heuristic scanning is where gogo earns its keep on large internal ranges. For subnets with masks smaller than /24, the README recommends smart modes such as -m ss (supersmart), which prune the search space intelligently before deeper probing. The --ping flag pre-filters hosts by ICMP reachability to reduce wasted packets — with the sensible caveat, noted in the docs, that a host failing to respond to ping is not necessarily dead. These modes are documented in detail on the project wiki, and the design discussion there shows deliberate thought about scan economics on /8-scale networks.
Because heuristic scan commands get verbose, gogo wraps them in a workflow system: named configuration files let an operator reproduce a complex invocation with something like gogo -w 172, which the README says expands internally to a supersmart scan of 172.16.0.0/12 with ping pre-filtering and the all port preset. Command-line arguments override workflow presets, so a quick -p top2,win,db narrows the port set without editing the file. Preset workflows like gogo -w 10 exist for common internal ranges, and stub workflows (configured but targetless) accept an explicit -i target. Anyone who has retyped the same fifty-flag nmap command across an engagement will immediately see the value here.
Output handling is unusually well considered for a scanner in this class. Results persist as deflate-compressed JSON Lines in files like .81.68.175.1_32_top1_default_dat.dat, which gogo can re-read and format into human-readable reports via -F. Export formats include -o full, -o color, -o jl (one JSON per line, pipeable to jq), -o json, and -o url for integration with downstream tooling. A filtering layer split across --filter (historical results), --output-filter (live output), and --scan-filter (early-stop deep scanning) supports match operators like :: for fuzzy matching, == for exact, != for exclusion, and !: for non-containment — effectively turning the result store into a queryable dataset.
Performance guidance in the README is refreshingly honest about the operational realities of high-concurrency scanning. Defaults are 4,000 goroutines on Linux and 1,000 on Windows, tuned for enterprise networks; the author warns that consumer routers can crash, overheat, or reboot under that load and recommends VPS deployment for external work. Tuning suggestions are given per scenario, with lower concurrency recommended for home networks and proxied pivots, and a -d timeout parameter to reduce false negatives when network latency spikes. For defenders, this is also useful telemetry knowledge: gogo traffic at default settings is loud and easily flagged by rate-based detection.
The build system reflects the portability goal. Standard compilation uses go build -tags goregexp, a tag that selects the Go standard library regex backend and is the default for release, nightly, and TinyGo builds — omitting it can route builds through go-re2/WASM and trigger wasm error: invalid table access when loading fingerprint rules. The README also documents a legacy build path using go 1.10/go 1.11 targeting GOOS=windows GOARCH=386, which preserves full fingerprint and vulnerability-detection functionality even on Windows Server 2003 — a deliberate nod to the ancient hosts that still haunt internal networks.
The goregexp distinction deserves attention from anyone building from source, because the README notes a subtle footgun: -tags is a go compiler flag, not a runtime flag, and typing gogo run -tags goregexp ... makes the scanner parse -t as its thread-count parameter instead. Small documentation details like this, along with a caution that UPX-compressed binaries may trip antivirus or fail on some machines, suggest a project maintained by someone who actually uses the tool operationally and records the failure modes.
Placement in a professional workflow is straightforward. gogo is the asset-discovery and fingerprinting stage: sweep the authorized range, extract titles, certs, frameworks, and versions, filter results down to interesting targets, and export URLs for follow-up by dedicated tools. The nuclei-template compatibility means known-vulnerable software identified during fingerprinting can be corroborated with reviewed, harmless detection templates rather than exploit code. The author's related works section — crediting ServerScan for early inspiration, fscan for workflow design, kscan for fingerprints, ladongo for special-port collection, and cube for NTLM-related gathering — maps the tool's lineage clearly.
For teams evaluating it, the trade-offs are worth weighing. The README and wiki are bilingual but Chinese-first, which is a modest barrier for English-only operators, though the command grammar itself is conventional. The concurrency defaults demand deliberate tuning in anything other than a datacenter network. And the emphasis on harmless, human-reviewed PoCs — while excellent from a safety standpoint — means it is not the tool for teams seeking aggressive validation. For authorized reconnaissance at scale, with a queryable result pipeline and sane operational guardrails, gogo is a serious piece of engineering that rewards a close read of its documentation.
chainreactors/gogo.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.