gopacket Wiki

Library Developer Guide

The pkg/ directory contains 24 reusable Go packages that can be imported independently to build custom security tooling. This wiki is a comprehensive API reference for developers building on top of gopacket's protocol libraries.

Pages

Architecture Overview - Package layout and standard tool pattern
pkg session - Target & credential management
pkg flags - Unified CLI framework
pkg smb - SMB2/3 client
pkg ldap - LDAP/LDAPS client
pkg dcerpc - DCE/RPC client framework and 15 service implementations
pkg kerberos - Kerberos 5 client and ticket operations
pkg ntlm - NTLM authentication protocol
pkg security - Security descriptors, ACLs, SIDs
pkg ese - ESE database parser (NTDS.dit)
pkg registry - Windows registry hive parser
pkg dpapi - DPAPI decryption
pkg relay - NTLM relay framework
Utility Packages - transport, structure, utf16le, ntfs, tds, mqtt
Authentication Patterns - Password, pass-the-hash, Kerberos examples
End-to-End Examples - Complete tool examples