Modern Security Tooling (Part 1/3): Why Go Is Eating AppSec

Part 1 of a 3-part series on open-source security tooling worth knowing: AppSec tooling in Go, Firebase recon, and AI agents in pentesting.

If you've been in application security for more than a few years, you've lived through the era of running 20 different Python scripts, juggling broken pip dependencies, and waiting 45 minutes for a single-threaded scanner to finish.

That era is fading fast. A big part of the offensive security and bug bounty toolbox is now written in Go: dalfox, katana, httpx, subfinder, nuclei, ffuf. There are good reasons for that:

• No dependency hell. One compiled binary. Copy it and run it.
• Cheap concurrency. Goroutines make thousands of parallel requests the default, not a hack.
• Unix-pipe friendly. Small tools that read and write plain text chain naturally: cat urls.txt | tool1 | tool2.

Two open-source projects show where this is heading.

1. XSStrike-go

🔗 https://github.com/Sakura-501/XSStrike-go

The original XSStrike by s0md3v is a legendary idea: work out where your input lands, then craft payloads for that context instead of blasting a static wordlist. But it's Python, with the maintenance burden and speed that come with it.

XSStrike-go is a rewrite in Go, ported feature by feature with tests against the original Python behaviour. It already covers a lot:

• Context-aware payload generation, instead of blindly firing thousands of static strings at a WAF
• Reflection analysis: an HTML parser, a filter checker and a candidate generator that work out where your input is reflected and what survives the filters
• Concurrent requests with --threads, plus a crawl mode, WAF fingerprinting and JSON reports

It's still a work in progress (the README lists what isn't ported yet), which also makes it a good codebase to read or contribute to.

2. A Dalfox helper for Burp Suite

🔗 https://github.com/offset7/Dalfox-burp-extension

Dalfox is one of the smartest parameter-focused XSS analysis engines around, and it's written in Go. But security engineers spend most of their day inside Burp Suite, and copying cookies, headers and endpoints between Burp and a terminal is pure friction.

This small project closes that gap. Despite the name, its README says no custom Burp plugin is required: you run it alongside Burp, point it at your Burp traffic or exported requests, and it pipes them straight into Dalfox, so you don't rebuild each request by hand. Results come back as JSON or plain text. You bring your own Dalfox binary.

It's a tiny project, but the idea is exactly right: keep Burp as your source of truth and let a fast Go engine do the repetitive checking.

The takeaway

Don't use automated scanners to spam targets.

Use small, fast Go utilities to remove the repetitive legwork: finding reflection contexts, spotting parameter anomalies, checking which characters a filter lets through.

Then spend your own brainpower where tools are weakest: business logic flaws, access control bugs, and multi-step impact.

What tools are anchored in your daily AppSec pipeline? Drop your go-to utilities in the comments.