🔧 GlazGo v2.1.0
Filename: glazgo_v2.1.0.exe
SHA-256: 4F594DF00977B41ABBAAC2A135B58A96FD112B53E9709EF2F4E0B9284F2A967C
Platform: Windows 64-bit
Architecture: amd64
Build Toolchain: Go (Golang)
✨ What's New
Fuzz any part of the request. Headers and cookies are now real fuzz points — both the name and the value — alongside the URL, path, method and body. Use as many points at once as you like, each with its own keyword (FUZZ, FUZZ2, …) and its own wordlist, combined as clusterbomb (every combination) or pitchfork (in lockstep).
Raw request mode. Paste a request straight from Burp and put keywords anywhere in it. Header names keep the case you wrote them in. Preview request shows exactly what will go on the wire before you start.
Wordlists of any size. Payloads are streamed one at a time instead of being loaded into memory. A 10-million-line wordlist now runs in about 22 MB of RAM instead of ~647 MB.
Payloads generated on the fly — no file needed at all:
- Number range with step and zero padding
- Brute force over a character set within a length range
- Mutations of another list: extensions, prefixes, suffixes, case, backup suffixes (
.bak,~,.old, …), leet
Built-in wordlists, bundled inside the .exe: 403/401 bypass header names, cache-poisoning header names, and loopback/internal address representations.
Proxy support — route the whole run through Burp with http://127.0.0.1:8080. Plus skip-TLS-verification for self-signed targets, an HTTP/2 toggle, and follow-redirects.
Better control of a run:
- A Stop button — a long run no longer has to be killed from Task Manager
- Rate limit in requests per second across all workers
- Auto-pause after N consecutive failures, so a dead target doesn't burn through your wordlist
- Live progress bar, request rate and ETA
- Any HTTP method: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS
Failed requests are now visible. Timeouts and connection errors are counted and listed with a reason, so "the target is down" no longer looks like "no findings".
-host, -port, -data and -open flags. A separate build just to change the port is no longer needed.
🐛 Fixed
- Crashes during a run. Reading results while workers were writing them could kill the process with
concurrent map iteration and map write. Pause/Resume could also race or deadlock, and pressing Stop twice could panic. - Targets on a non-default port did not work at all. A URL such as
http://127.0.0.1:8099/FUZZfailed withmkdir data\127.0.0.1:8099: The directory name is invalid, because a colon isn't legal in a Windows path. - Throughput. The connection pool was left at Go's default of 2 idle connections per host, so a concurrent run spent its time reconnecting. Sizing the pool to the concurrency measured ~2.5× more requests per second.
- The timeout setting was ignored — anything under 30 seconds was silently raised to 30.
- POST bodies were sent chunked with no
Content-Length, which some targets and WAFs reject. - An explicit
Content-Typewas overwritten withapplication/x-www-form-urlencoded, so JSON APIs got the wrong type. - The "Status Codes to Log" setting did nothing. It now filters what is listed and logged; counters still cover every request.
- Payloads containing a space,
&,#or?silently corrupted the URL and the request was dropped. Each fuzz point now has its own encoding. - Cookie payloads containing
;or quotes were mangled. TheCookieheader is now written verbatim. - Header values containing
:and cookie values containing=were parsed wrongly (aHost: example.com:8080header, a base64 cookie). - A payload containing HTML executed inside the fuzzer's own page and broke the results row.
- Results are appended as they arrive instead of the whole list being re-fetched and re-rendered twice a second.
🔒 Security
The server now binds 127.0.0.1 by default instead of every interface, and rejects cross-origin POST /api/*. Previously any web page you happened to visit could have started a fuzzing job on your machine, and the API was reachable from your whole network.
If you deliberately want it reachable from elsewhere, use -host 0.0.0.0 — there is no authentication.
📌 If You Are Coming From v2.0.4
- Your timeout setting now applies. It used to be forced up to 30 seconds, so a value like
5000ms will genuinely time out at 5 s now. - "Status Codes to Log" now filters. Leave it blank to keep everything, which matches the old behaviour.
- Wordlist paths configured the old way still work.
⚠️ Important Notice About Windows Warnings
This executable is not digitally signed with a commercial code signing certificate. As a result, when you try to run it, Windows SmartScreen may display a warning such as:
"Windows protected your PC" – Microsoft Defender SmartScreen prevented an unrecognized app from starting.
This is normal behavior for unsigned applications, especially when they are new or not widely distributed. The application is safe to use if you downloaded it from this official source.
✅ How to Run the App
If you encounter the SmartScreen warning:
- Click “More info”
- Click the “Run anyway” button
This allows the app to run. You’ll only need to do this once, unless the file is updated or re-downloaded.
The .exe is fully self-contained — the interface and the built-in wordlists are inside it. Run it and open http://127.0.0.1:5000/ in your browser:
.\glazgo_v2.1.0.exeTo have it open your browser for you, or to use a different port:
.\glazgo_v2.1.0.exe -open
.\glazgo_v2.1.0.exe -port 8080 -openResult logs are written to data\<host>\<status>.txt next to wherever you run it. Use -data to put them somewhere else.
🔐 File Integrity Verification
To ensure the .exe file hasn't been altered, you can verify its SHA-256 hash.
PowerShell:
Get-FileHash glazgo_v2.1.0.exe -Algorithm SHA256Expected output: 4F594DF00977B41ABBAAC2A135B58A96FD112B53E9709EF2F4E0B9284F2A967C
If the hash matches, you can be confident the file is original and unmodified.