View Issue Details

IDProjectCategoryView StatusLast Update
0008805Kali LinuxNew Tool Requestspublic2024-07-11 13:15
Reporterc1sc0 Assigned To 
PrioritynormalSeverityminorReproducibilityhave not tried
Status newResolutionopen 
Summary0008805: goshs - a simple HTTP Webserver with advanced capability like basic auth, webdav and TLS encryption

[Name] - goshs
[Version] - v0.3.9
[Homepage] -
[Download] -
[Author] - Patrick Hener
[Licence] - MIT (
[Description] - It is a simple HTTP server with advanced capabilities. The feature list reads like:

  • Download or view files
    • Bulk download as .zip file
  • Upload files (Drag & Drop)
  • Delete files
    • Individually
    • Bulk delete
  • Basic Authentication
  • Transport Layer Security (HTTPS)
    • self-signed
    • let's encrypt
    • provide own certificate
  • Non persistent clipboard
    • Download clipboard entries as .json file
  • WebDAV support
  • Read-Only and Upload-Only mode
  • Silent mode (no webserver output)
  • Retrieve json on cli
  • Drop user privileges before execution (Unix only)
    • Example: Run on port 80, but process is "www-data"
  • Themes
    • Dark Mode
    • Light Mode
  • Command Line
    • Run Commands on the system hosting goshs
  • File Based ACLs
    • You can place a .goshs in any folder to apply custom ACLs
    • You can apply custom basic auth per folder
    • You can restrict access to specific files completely
  • Embed files on compile time

[Dependencies] - It is a golang tool and needs at least go 1.21.8 to be compiled. There are pre-compiled releases available
[Similar tools] - python3 -m http.server or updog. But those are not even remotely that feature rich.
[Activity] - The project started years ago and is still being actively maintained.
[How to install] - Either clone and use the Makefile or do like go install
[How to use] - See the examples given in the
[Packaged] - This tool is not packaged as a Debian package.




2024-06-28 06:31

reporter   ~0019484

Last edited: 2024-06-28 06:37

@kali-team could you package it up? If it helps I could read into how to package a go binary as .deb package. I never did anything like this. But if you would merge the tool quicker then it might be worth the effort. Also the tool builds for virtually any architecture as it is written in golang. So it could be build and packed for arm based as well. It would at least fit kali 32 bit, kali 64 bit, kali apple silicon arm64, kali pi like images. I assume it would even be harder to package multiple architectures, right?



2024-06-28 07:26

reporter   ~0019485

I just realized if you were to compile it using the Makefile to minify the javascript and to compile sass you would need uglifyjs and sass cli tools. Those both have debian packages though and would be a dependency in this scenario then. Otherwise if you use the release binaries you will not need those tools.



2024-07-05 18:10

reporter   ~0019508

I did a little makeover to make it even more attractive to you to integrate into kali. The new version v0.4.0 does look and feel a little bit better. Also I created a comprehensive documentation at
I hope to hear from you soon.



2024-07-11 13:15

reporter   ~0019518

And a new feature strikes again. Now goshs can be used with certificate based authentication. The most current version is now v0.4.1. @kali-team: any idea on the timeline when you would review the tool?

Issue History

Date Modified Username Field Change
2024-06-27 13:42 c1sc0 New Issue
2024-06-28 06:31 c1sc0 Note Added: 0019484
2024-06-28 06:37 c1sc0 Note Edited: 0019484
2024-06-28 07:26 c1sc0 Note Added: 0019485
2024-07-05 18:10 c1sc0 Note Added: 0019508
2024-07-11 13:15 c1sc0 Note Added: 0019518