goshs is a single-binary file server written in Go for red teamers, CTF players, and developers who need more capability than python3 -m http.server without configuring Apache.

What it is

goshs is an MIT-licensed Go project that bundles many network services into one executable: HTTP/S, WebDAV, FTP/SFTP, SMB, LDAP/S, plus a DNS server, an SMTP server, basic auth, share links, and NTLM hash capture with cracking. It lives in the Infrastructure & Operations / Networking & Connectivity space and is positioned as a replacement for Python's SimpleHTTPServer — the README opens on the scenario of being mid-engagement and needing to transfer a file, catch an SMB hash, or stand up a quick HTTPS server when python3 -m http.server will not do.

The concrete problem it solves is tool sprawl during an engagement or a quick dev workflow: instead of configuring Apache for HTTPS, running a separate SMB listener for hash capture, and juggling another chat tool for team coordination, goshs serves files and runs the auxiliary services from one command. File operations include resumable and seekable downloads via HTTP Range, drag-and-drop upload through POST/PUT, deletion, bulk ZIP, and QR codes.

Key capabilities

• Serve files over HTTP/S, WebDAV, FTP/SFTP, SMB, and LDAP/S from one binary, with TLS from a self-signed certificate, Let's Encrypt, or a custom certificate.
• Capture SMB NTLM hashes with -smb -smb-domain CORP, and capture LDAP credentials with NTLM cracking against a wordlist such as /usr/share/wordlists/rockyou.txt, including JNDI mode for Log4Shell.
• Catch DNS callbacks and receive emails via goshs -dns -dns-ip 1.2.3.4 -smtp -smtp-domain your-domain.com.
• Render payload templates on demand, substituting {{.LHOST}} and {{.LPORT}} plus custom --tpl-var values when a file is fetched with ?tpl.
• Run server modes including read-only, upload-only, no-delete, silent, invisible, CLI command execution, and TTL self-destruct (--ttl 2h).
• Share files through token-based links with download and time limits, protected by basic auth, certificate auth, IP whitelists, and file-based ACLs.
• Use the interactive terminal dashboard (--tui) with live panes for HTTP, DNS, SMB, LDAP, SMTP, reverse shells, and team chat, with shell attach and upgrade.

Who uses it and how

• Red teamers mid-engagement who need to stand up HTTPS with basic auth (goshs -s -ss -b user:password) or serve payloads that auto-fill the callback host and port at download time (goshs -i 10.10.14.7 --template).
• CTF and capture-the-flag teams using the live team chat — shared between web and TUI — with markdown, emoji shortcodes, image paste, file upload, and optional disk persistence.
• Operators running headless SSH sessions who use --tui for an interactive full-screen dashboard and monitor reverse shells as they arrive.
• Users who want a short-lived listener that self-destructs after a set period, such as goshs --ttl 2h.
• Developers and pentesters who hook up webhooks, a JSON API, mDNS, or a tunnel via localhost.run.

Getting started

The README's quick start runs the binary directly — goshs serves the current directory on port 8000 — and releases are published via goreleaser on GitHub, with documentation at docs.goshs.de and a live demo at demo.goshs.de.

How it compares

It stands alongside python3 -m http.server, which it is explicitly designed to replace: where Python's SimpleHTTPServer offers only plain HTTP file listing, goshs adds TLS, authentication, multiple transfer protocols, hash capture, and collaboration features in one binary. Beyond Python's standard library, this registry names no comparable tool among the facts provided.

When to use it — and when not

Because it is a single binary, there is no database, storage layer, or SMTP infrastructure to operate separately — the SMTP and DNS servers are built in — but a self-hoster must still manage TLS certificates, ACL files, and wordlists for cracking. It is a poor fit for anyone who needs a hardened production web server with long-lived multi-user content, and the security-sensitive modes (NTLM capture, credential capture, reverse shell catching) are appropriate only for authorized testing. The project ships under the MIT licence with zero open issues and a recent push, though the full documentation lives off-repo at docs.goshs.de rather than in the README itself.

# Serve the current directory on port 8000
goshs

# Serve with HTTPS (self-signed) and basic auth
goshs -s -ss -b user:password

# Capture SMB hashes
goshs -smb -smb-domain CORP

# Capture LDAP credentials and NTLM hashes (with optional wordlist cracking)
goshs -ldap
goshs -ldap -ldap-wordlist /usr/share/wordlists/rockyou.txt

# Catch DNS callbacks and receive emails
goshs -dns -dns-ip 1.2.3.4 -smtp -smtp-domain your-domain.com

# Self-destruct after 2 hours
goshs --ttl 2h

# Run with the interactive terminal dashboard (great for headless SSH sessions)
goshs --tui

# Serve payloads that auto-fill your callback host/port at download time
goshs -i 10.10.14.7 --template --tpl-var LPORT=4444
# fetch rendered: curl 'http://10.10.14.7:8000/rev.ps1?tpl'

goshs --completion bash
goshs --completion fish
goshs --completion zsh

source ~/.local/share/bash-completion/completions/goshs

git clone https://github.com/goshs-labs/goshs.git
cd goshs
go build -o goshs .

make generate
go build -o goshs .