87 lines
3.2 KiB
Markdown
87 lines
3.2 KiB
Markdown
# burterm
|
|
|
|
A terminal-based tool for web pentesting, bug bounty, and CTF work. A single
|
|
static Go binary, 13 TUI tabs (Dashboard, Request Builder, Results, Proxy,
|
|
Repeater, Spider, Target/Site Map, Decoder, Comparer, Sequencer, Scanner,
|
|
Project, Fuzzer), plus a headless CLI mode for scripts and CI.
|
|
|
|
- Detailed architecture: [ARCHITECTURE.md](ARCHITECTURE.md)
|
|
- Design history, bugs found, reliability caveats (Russian only): [NOTES.md](NOTES.md)
|
|
- Русская версия: [README.ru.md](README.ru.md)
|
|
|
|
Steganography/audio forensics (image bit-plane analysis, spectrograms,
|
|
SSTV decoding) used to live here as a 14th tab — split out into its own
|
|
project, [stegterm](https://github.com/r3g1tpr0cs/stegterm), since it has
|
|
nothing to do with web pentesting.
|
|
|
|
## Features
|
|
|
|
- **Proxy** — HTTP/HTTPS interception via a self-signed MITM CA, skips
|
|
out-of-scope traffic from history
|
|
- **Repeater** — manual request send/edit, diff against last sent version (ctrl+d)
|
|
- **Intruder** — Sniper/Battering Ram/Pitchfork/Cluster Bomb, smart payload
|
|
presets, recursion into discovered directories (ffuf's `-recursion`
|
|
equivalent), extension lists (`|ext:.php,.html`), status/length/word/line/grep filters
|
|
- **Spider** — crawler with GET-form auto-submission and automatic session
|
|
Cookie/Authorization pickup from Proxy history
|
|
- **Scanner** — SQLi/XSS/SSTI/LFI/RCE/SSRF/XXE/CORS/JWT, selectable checks
|
|
- **Project** — session persistence in SQLite with full-text search (FTS5),
|
|
filters by host/method/status/length/color label
|
|
- **Fuzzer** — blackbox mutation fuzzer for arbitrary binaries (CTF pwn),
|
|
crash detection via signal
|
|
- **Dashboard** — live metrics of the process itself (memory, goroutines,
|
|
RPS), laid out as bordered panels
|
|
|
|
## Building
|
|
|
|
```sh
|
|
go mod tidy # pulls dependencies, including modernc.org/sqlite
|
|
go build -o burterm ./cmd/burterm
|
|
```
|
|
|
|
Requires Go 1.23+. Builds without cgo.
|
|
|
|
**The code has never once gone through a compiler** — it was written in a
|
|
sandboxed environment with no network access and no Go toolchain
|
|
installed. Specific areas of uncertainty and the recommended order for
|
|
the first build are in [NOTES.md](NOTES.md) (Russian only).
|
|
|
|
## Running
|
|
|
|
No arguments — interactive TUI:
|
|
|
|
```sh
|
|
./burterm
|
|
```
|
|
|
|
With arguments — headless CLI (for scripts/CI):
|
|
|
|
```sh
|
|
./burterm -request req.txt -payload wordlist:common.txt -mode sniper
|
|
```
|
|
|
|
`req.txt` is a raw HTTP request with `§markers§` at insertion points:
|
|
|
|
```
|
|
GET /api/user?id=§1§ HTTP/1.1
|
|
Host: example.com
|
|
|
|
```
|
|
|
|
## Repository layout
|
|
|
|
```
|
|
cmd/burterm/ entry point (CLI + TUI launch)
|
|
internal/
|
|
engine/ Intruder core: markers, attack generators, filters
|
|
payload/ payload generators (wordlist/range/brute/preset/ext)
|
|
cli/ flag and payload-spec parsing
|
|
proxy/ MITM proxy, CA, scope filter, session auto-detection
|
|
spider/ crawler
|
|
sitemap/ scope rules, site map tree
|
|
scanner/ active/passive vulnerability checks
|
|
fuzzer/ blackbox binary fuzzer
|
|
project/ SQLite+FTS5 session storage
|
|
decoder/ comparer/ sequencer/ utilities
|
|
tui/ the whole interface (bubbletea)
|
|
```
|