GitHub - user123cy/auger: Load test, discover and inspect HTTP endpoints from the terminal. Rust CLI with latency percentiles, flamegraph and security header checks. · GitHub

/" data-turbo-transient="true" />

Skip to content

Type / to search

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

user123cy

auger

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

main

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>31 Commits<br>31 Commits

.github/workflows

.github/workflows

scripts

scripts

src

src

.gitignore

.gitignore

CHANGELOG.md

CHANGELOG.md

Cargo.lock

Cargo.lock

Cargo.toml

Cargo.toml

LICENSE

LICENSE

README.md

README.md

View all files

Repository files navigation

auger

Load test, discover and inspect HTTP endpoints from the terminal.

Five commands, one binary:

auger run — hammer a URL with concurrent requests, get percentiles, a latency histogram and a flamegraph

auger scan — brute-force endpoints with a wordlist

auger check — inspect status, HTTP version and security headers with an A-F grade

auger cert — show the TLS certificate for a host

auger ping — measure per-phase latency (DNS/TCP/TLS/TTFB) of a single request

install

From crates.io:

cargo install auger

Or the install script (downloads the latest prebuilt binary):

curl -fsSL https://raw.githubusercontent.com/user123cy/auger/main/scripts/install.sh | bash

Prebuilt binaries for Linux, macOS and Windows are attached to every release.

load test

auger run https://api.example.com/ # 20 workers, 5s<br>auger run https://api.example.com/ -c 200 -d 30s # 200 workers, 30s<br>auger run https://api.example.com/ -m POST -d 10s<br>auger run https://api.example.com/ --random-ua -H "X-Token: abc"<br>auger run https://api.example.com/ -m POST --body '{"user":1}' # inline request body<br>auger run https://api.example.com/ -d 30s --quiet # no progress line<br>auger run https://api.example.com/ -d 30s --json # machine-readable output

Save a baseline and compare against it later:

auger run https://api.example.com/ -d 30s -s baseline.json<br>auger run https://api.example.com/ -d 30s --compare baseline.json --threshold 1.2

Any percentile slower than the baseline by more than the threshold flags a regression. A regression sets the exit code to 1 — hook it into CI. --json prints the diff rows instead of the table.

discover

auger scan https://example.com/ -w wordlist.txt # find non-404 paths<br>auger scan https://example.com/ -w wordlist.txt -e php,html # also try .php and .html<br>auger scan https://example.com/ -w wordlist.txt -o hits.txt # save status + url lines<br>auger scan https://example.com/ -w wordlist.txt -R # also probe robots.txt + sitemap.xml paths<br>auger scan https://example.com/ -w wordlist.txt --depth 2 # cap recursion into 2xx directories<br>auger scan https://example.com/ -w wordlist.txt --no-recursion # probe only the base path<br>auger scan https://example.com/ -w wordlist.txt --json # machine-readable output<br>cat urls.txt | auger scan -w wordlist.txt --stdin # scan many bases from stdin<br>cat urls.txt | auger scan -w wordlist.txt --stdin --silent # print only "status url" lines<br>auger scan https://example.com/ -w wordlist.txt --filter-status 403,500 # drop these statuses<br>auger scan https://example.com/ -w wordlist.txt --filter-size 1234 # drop responses of this exact size

Before scanning each base, auger probes a random path to learn what a catch-all response looks like (status + body size) and hides matching hits — so a SPA that answers 200 to every path won't flood the results. Filters (--filter-status, --filter-size) apply before --match-status.

latency

auger ping https://example.com/ # DNS, TCP, TLS, TTFB, total for one request<br>auger ping example.com -c 3 # 3 attempts + min/avg/max per phase<br>auger ping https://example.com/ --json # machine-readable attempt object<br>auger ping http://localhost:8080/api # missing scheme defaults to http

Useful for spotting which phase of a connection is slow — a bad DNS resolver, a slow TLS handshake or a server that takes long to send headers.

inspect

auger check https://example.com/<br>auger check https://example.com/ --json

Shows status, HTTP version, server and which security headers are present: HSTS, CSP, clickjacking, mime sniffing, referrer, permissions, COOP, CORP. The headers are weighted and scored into a letter grade (A-F) in the style of securityheaders.com. Missing headers show the exact header line to add. Cookies are listed with their Secure/HttpOnly/SameSite flags.

certificate

auger cert example.com<br>auger cert example.com:8443<br>auger cert https://example.com/ --json

Shows the subject, issuer, TLS version, key size, signature...