Gograbber

Gograbber Execution Skill

This skill provides instructions for AI agents on how to construct commands and execute the gograbber CLI tool effectively.

Core Directives

1. Understand Input Types (-i vs -U):

   • Use -i <file> when you have raw IP addresses, CIDR ranges, or hostnames (e.g., 10.0.0.1, 10.0.0.0/24, example.com). These targets will be routed through the TCP port scanner first.
   • Use -U <file> when you have a list of fully qualified URLs (e.g., https://example.com:8443/admin). This completely bypasses the port scanner.
   • For single targets, use -u <url> (e.g., -u http://example.com).

2. Always Output Structured Formats:

   • By default, gograbber outputs Markdown. When acting as an agent, always append -f json or -f csv to generate machine-readable output that you can easily parse later.
   • Example: -f md,json,csv

3. Concurrency Safety:

   • gograbber is highly concurrent. The default threads are 500 (-t 500). For smaller networks or to avoid rate limits, lower this value (-t 50).
   • Limit the screenshot workers to avoid CPU/memory spikes. Default is 5 (-p_procs 5). Do not increase this excessively unless running on a high-resource server.

Recommended Workflows

1. The "Easy" Discovery Mode

If a user just wants a general scan of a target with standard web ports (80, 443, 8080, 8443) and screenshots, use -easy:

./gograbber -i targets.txt -w wordlist.txt -easy -f md,json

2. Comprehensive Subnet Scanning

To discover web services across a large CIDR range, specify the ports explicitly and enable all phases:

./gograbber -i 10.0.0.0/24 -p 80,443,8000,8080,8443 -scan -dirbust -w paths.txt -screenshot -f json,csv

3. Fast Screenshotting of Existing URLs

If you already possess a list of valid URLs (e.g., output from httpx), skip scanning and dirbusting, and go straight to screenshots:

./gograbber -U discovered_urls.txt -screenshot -f json

4. Bypassing WAFs / Rate Limits

When running against protected targets, slow down the requests (-j), add custom Host headers (-H), and supply a session cookie (-C):

./gograbber -i hosts.txt -dirbust -w paths.txt -screenshot -H vhosts.txt -C "sessionid=xyz123" -j 500

Parsing the Output

Once gograbber completes, it will write files to gograbber_output/report/. To read the results programmatically, load the JSON report:

cat gograbber_output/report/hack_*_Report.json | jq .

Each JSON object represents a Host and contains:

• protocol, host_addr, port, path
• screenshot_filename (path to the PNG/JPG file)
• response_body_filename (path to the raw HTML response)

Source: bonzitechnology/gograbber — distributed by TomeVault.