# burterm

A terminal-based tool for web pentesting, bug bounty, and CTF work. A single
static Go binary, 13 TUI tabs (Dashboard, Request Builder, Results, Proxy,
Repeater, Spider, Target/Site Map, Decoder, Comparer, Sequencer, Scanner,
Project, Fuzzer), plus a headless CLI mode for scripts and CI.

- Detailed architecture: [ARCHITECTURE.md](ARCHITECTURE.md)
- Design history, bugs found, reliability caveats (Russian only): [NOTES.md](NOTES.md)
- Русская версия: [README.ru.md](README.ru.md)

Steganography/audio forensics (image bit-plane analysis, spectrograms,
SSTV decoding) used to live here as a 14th tab — split out into its own
project, [stegterm](https://github.com/r3g1tpr0cs/stegterm), since it has
nothing to do with web pentesting.

## Features

- **Proxy** — HTTP/HTTPS interception via a self-signed MITM CA, skips
  out-of-scope traffic from history
- **Repeater** — manual request send/edit, diff against last sent version (ctrl+d)
- **Intruder** — Sniper/Battering Ram/Pitchfork/Cluster Bomb, smart payload
  presets, recursion into discovered directories (ffuf's `-recursion`
  equivalent), extension lists (`|ext:.php,.html`), status/length/word/line/grep filters
- **Spider** — crawler with GET-form auto-submission and automatic session
  Cookie/Authorization pickup from Proxy history
- **Scanner** — SQLi/XSS/SSTI/LFI/RCE/SSRF/XXE/CORS/JWT, selectable checks
- **Project** — session persistence in SQLite with full-text search (FTS5),
  filters by host/method/status/length/color label
- **Fuzzer** — blackbox mutation fuzzer for arbitrary binaries (CTF pwn),
  crash detection via signal
- **Dashboard** — live metrics of the process itself (memory, goroutines,
  RPS), laid out as bordered panels

## Building

```sh
go mod tidy   # pulls dependencies, including modernc.org/sqlite
go build -o burterm ./cmd/burterm
```

Requires Go 1.23+. Builds without cgo.

**The code has never once gone through a compiler** — it was written in a
sandboxed environment with no network access and no Go toolchain
installed. Specific areas of uncertainty and the recommended order for
the first build are in [NOTES.md](NOTES.md) (Russian only).

## Running

No arguments — interactive TUI:

```sh
./burterm
```

With arguments — headless CLI (for scripts/CI):

```sh
./burterm -request req.txt -payload wordlist:common.txt -mode sniper
```

`req.txt` is a raw HTTP request with `§markers§` at insertion points:

```
GET /api/user?id=§1§ HTTP/1.1
Host: example.com

```

## Repository layout

```
cmd/burterm/        entry point (CLI + TUI launch)
internal/
  engine/              Intruder core: markers, attack generators, filters
  payload/             payload generators (wordlist/range/brute/preset/ext)
  cli/                 flag and payload-spec parsing
  proxy/                MITM proxy, CA, scope filter, session auto-detection
  spider/                crawler
  sitemap/                scope rules, site map tree
  scanner/                 active/passive vulnerability checks
  fuzzer/                   blackbox binary fuzzer
  project/                   SQLite+FTS5 session storage
  decoder/ comparer/ sequencer/ utilities
  tui/                         the whole interface (bubbletea)
```