install

Additional install commands

macOS

Homebrewverified · 100%

brew install goshs

local Homebrew formula metadata

Linux

Alpine Linux apkverified · 92%

sudo apk add goshs

Alpine Linux edge package indexes · goshs · source: dl-cdn.alpinelinux.org

Nixverified · 92%

nix profile install nixpkgs#goshs

nixpkgs package indexes · pkgs/by-name/go/goshs/package.nix · source: api.github.com

openSUSE zypperverified · 92%

sudo zypper install goshs

openSUSE Tumbleweed package metadata · goshs · source: download.opensuse.org

Windows

Scoopverified · 92%

scoop install extras/goshs

Scoop official bucket manifest trees · bucket/goshs.json · source: api.github.com

Windows Package Managerverified · 92%

winget install --id GoshsLabs.Goshs -e

Windows Package Manager source index · GoshsLabs.Goshs · source: cdn.winget.microsoft.com

overview

Package summary

Simple, yet feature-rich web server written in Go

Project links

Commands and aliases

goshs

history

Project history and usage

goshs is a Go single-binary file server aimed at situations where Python's SimpleHTTPServer style sharing is too limited. Its project materials frame it for red-team, pentest, CTF, and quick file-transfer workflows, combining HTTP/S with protocols and security-oriented helpers such as WebDAV, FTP/SFTP, SMB, LDAP/S, DNS and SMTP callbacks, NTLM hash capture, share links, authentication, and a terminal dashboard.

Project history

The project grew from the familiar local-file-server niche into a penetration-testing utility. The README explicitly credits updog as inspiration, which places goshs in the lineage of small engagement-friendly servers that trade web-server configuration for a single command.

The 2.x documentation and release notes show a broadening scope: v2.0.0 emphasized SMB, DNS, SMTP, redirects, ACLs, and share links; later 2.1 releases added a TUI, self-destruct timers, payload templating, range downloads, TFTP, and reverse-shell payload generation. The project also moved to the goshs-labs GitHub organization during the v2.1.0 line.

Adoption history

goshs is packaged for Homebrew and is also advertised by the project for Kali/Parrot, Arch AUR, BlackArch, Alpine, Snap, Fedora/RHEL COPR, openSUSE, Nix/NixOS, Scoop, winget, Chocolatey, Docker, Go install, and GitHub Releases. That spread matches a tool meant to be dropped quickly onto operator workstations, lab VMs, and disposable engagement environments.

How it is used

Typical usage starts a web server for the working directory, then enables only the pieces needed for a task: HTTPS and basic auth for protected sharing, SMB or LDAP for credential and hash capture, DNS/SMTP callbacks for interaction tracking, WebDAV/FTP/SFTP/TFTP for protocol-specific transfer, TTL for temporary servers, or the TUI for SSH sessions without a browser.

Why package nerds care

Package maintainers care about goshs because it is a feature-dense single binary with a Go module path, release artifacts, shell completions, container images, and many optional behaviors hidden behind flags rather than separate services. It also carries security-sensitive behavior, so packaging and upgrade cadence matter more than for a plain static file server.

Timeline

2025: Security advisory GHSA-rwj2-w85g-5cmm documents a command-execution exposure tested against goshs 1.0.4 and notes the command feature was introduced in 0.3.4.
2026-05: v2.1.0 release notes record the move to github.com/goshs-labs/goshs and several security fixes.
2026-06: 2.1 releases add a TUI, TTL shutdown, payload templating, resumable downloads, TFTP, reverse-shell payload generation, and packaging/CI updates.

Related projects

updog is credited by goshs as project inspiration.
Python's SimpleHTTPServer/http.server is the baseline goshs positions itself beyond.
ConPtyShell appears in goshs release notes as an on-demand helper for Windows shell upgrades.

Sources

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for goshs. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: .goshs

executables

Installed executables

Command	Kind	Exposure	Note
`goshs`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-25

manager version2.1.4

manager updated2026-07-03

local dataok

upstreamcurrent

latest detectedv2.1.4

https://github.com/goshs-labs/goshs

okNo freshness warnings were generated.

install metadata

Package metadata

Package key	brew:goshs
Version	2.1.4
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/goshs
Homepage	https://goshs.de
Repository	https://github.com/goshs-labs/goshs
Upstream docs	https://docs.goshs.de/
License	MIT
Source archive	https://github.com/goshs-labs/goshs/archive/refs/tags/v2.1.4.tar.gz
Last updated	2026-07-03T10:38:16Z
Pulse	updated
Build dependencies	go
Bottle	available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	goshs
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

goshs

nix profile install nixpkgs#goshs

normalized package name match
Matched by: Goshs

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/go/goshs/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

apk95%

goshs 2.1.0-r0

A SimpleHTTPServer written in Go, enhanced with features and with a nice design.

https://goshs.de

sudo apk add goshs

License: MIT
Architecture: x86_64
Source Package: goshs
1 dependencies
1 provides
normalized package name match
Matched by: Goshs

Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: goshs from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz

apk95%

goshs-doc 2.1.0-r0

A SimpleHTTPServer written in Go, enhanced with features and with a nice design. (documentation)

https://goshs.de

sudo apk add goshs-doc

License: MIT
Architecture: x86_64
Source Package: goshs
normalized package name match
Matched by: Goshs

Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: goshs-doc from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz

zypper95%

goshs 2.1.0-1.1

A simple HTTP server

https://goshs.de/

sudo zypper install goshs

License: MIT
Category: Productivity/Networking/Web/Servers
Architecture: x86_64
Source Package: goshs
1 provides
normalized package name match
Matched by: Goshs

openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: goshs from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst

Scoop95%

extras/goshs

scoop install extras/goshs

normalized package name match
Matched by: Goshs

Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/goshs.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1

winget95%

GoshsLabs.Goshs

winget install --id GoshsLabs.Goshs -e

normalized package name match
Matched by: Goshs

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: GoshsLabs.Goshs from https://cdn.winget.microsoft.com/cache/source.msix

winget95%

PatrickHener.Goshs

winget install --id PatrickHener.Goshs -e

normalized package name match
Matched by: Goshs

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: PatrickHener.Goshs from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/goshs.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated configuration and credential file locations
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install goshs with Homebrew, apk, Nix, zypper, scoop, winget