GoSpider – Hacker Tools: Enumerate the web! 👩💻
As a bug bounty hunter, you need to get a good view of all the pages and endpoints your targets host. Manually enumerating these can become labour intensive, boring and on top of that, is prone to errors. Today we’re going to look at GoSpider, a tool that can do all this for us!
Photo by Pixabay on Pexels.com
🙋♂️ What is GoSpider?
GoSpider is a tool written in Go by @j3ssiejjj that helps you to enumerate all endpoints on your target!
It takes a URL or a list of URLs and will then query them whilst scanning the responses for more URLs on the same domain. It will do this recursively and thus give you a ton of results!
🐱🏍 Our first run!
Check out the video below for an example of how you can use GoSpider!
👷♀️ Installing GoSpider
Want to install GoSpider? (On Kali)
sudo apt install gospider
🚧 Conclusion
GoSpider is a simple, yet helpful tool to find those injection points for your secretive CRLFs. Start using it today and let’s get some bounties!
If you would like to recommend a tool for us to cover next week, then be sure to let us know down below. Also be sure to check out all the previous Hacker Tools articles, such as the last one on Waybackurls.
Did you know that there is a video accompanying this article? Check out the playlist!
You may also like
October 28, 2026
Exploiting LLM prompt injection vulnerabilities
Large language models (LLMs) are quickly becoming a standard component of any modern web application nowadays, powering everything from customer support chatbots to internal knowledge assistants. For us, security researchers, this opens a whole new attack surface to explore. In this article, we'll f
September 2, 2026
Hacking AI customer service agents
As AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate that risk turns out to be. At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire, Founding Memb
August 20, 2026
Web fuzzing for hackers
Fuzzing has been around for as long as web applications have. In fact, the term itself was coined back in 1988, when Barton Miller, a professor at the University of Wisconsin, was working over a dial-up connection during a thunderstorm and noticed that the resulting line noise was consistently crash