monsoon
A fast HTTP enumerator that allows you to execute a large number of HTTP requests, filter the responses and display them in real-time.
Example
Run an HTTP GET request for each entry in filenames.txt
, hide all responses with the status code 404
:
Common usage of monsoon is also covered in our blog article "Introducing monsoon - a lean and versatile HTTP enumerator".
Installation
Building from source
These instructions will get you a compiled version of the code in the main branch.
You'll need a recent version of the Go compiler, at
least version 1.17. For Debian, install the package golang-go
.
Clone the repository, then from within the checkout run the following command:
$ go build
Afterwards you'll find a monsoon
binary in the current directory. It can be
for other operating systems as follows:
$ GOOS=windows GOARCH=amd64 go build -o monsoon.exe
Unofficial Packages
For Arch Linux based distributions monsoon
is available as an unofficial
package on the AUR. Using your
AUR helper of choice such as yay:
yay -S monsoon
Getting Help
The program has several subcommands, the most important one is fuzz
which
contains the main functionality. You can display a list of commands as follows:
$ ./monsoon -h
Usage:
monsoon command [options]
Available Commands:
fuzz Execute and filter HTTP requests
help Help about any command
show Construct and display an HTTP request
test Send an HTTP request to a server and show the result
version Display version information
Options:
-h, --help help for monsoon
Use "monsoon [command] --help" for more information about a command.
For each command, calling it with --help
(e.g. monsoon fuzz --help
) will
display a description of all the options, and calling monsoon help fuzz
also shows an extensive list of examples.
Wordlists
The SecLists Project collects
wordlists that can be used with monsoon
.