{"id":49888894,"url":"https://github.com/santhsecurity/gossan","last_synced_at":"2026-05-15T20:01:25.536Z","repository":{"id":347295102,"uuid":"1193285140","full_name":"santhsecurity/gossan","owner":"santhsecurity","description":"Attack surface management and recon — subdomain enumeration, port scanning, tech fingerprinting, hidden endpoints, cloud discovery","archived":false,"fork":false,"pushed_at":"2026-05-15T05:53:34.000Z","size":347,"stargazers_count":0,"open_issues_count":1,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-15T06:20:16.587Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://santh.dev","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/santhsecurity.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":"AUDIT_REPORT.md","citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-27T04:03:52.000Z","updated_at":"2026-05-15T05:53:40.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/santhsecurity/gossan","commit_stats":null,"previous_names":["santhsecurity/gossan"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/santhsecurity/gossan","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fgossan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fgossan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fgossan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fgossan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/santhsecurity","download_url":"https://codeload.github.com/santhsecurity/gossan/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fgossan/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33077916,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-15T11:35:32.926Z","status":"ssl_error","status_checked_at":"2026-05-15T11:35:31.362Z","response_time":103,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-05-15T20:00:51.977Z","updated_at":"2026-05-15T20:01:25.508Z","avatar_url":"https://github.com/santhsecurity.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003e Part of the [Santh](https://santh.dev) security research ecosystem.\n\n# gossan\n\n[![CI](https://github.com/santhsecurity/gossan/actions/workflows/ci.yml/badge.svg)](https://github.com/santhsecurity/gossan/actions/workflows/ci.yml) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![Crates.io](https://img.shields.io/crates/v/gossan)](https://crates.io/crates/gossan)\n\n**Fast, modular attack surface discovery.** Subdomains, ports, tech stack, hidden paths, cloud assets, DNS security, origin IP: all in one scan.\n\n## Install\n\n```bash\ncargo install gossan\n```\n\n## Usage\n\n```bash\n# Full recon scan\ngossan scan example.com\n\n# Specific modules\ngossan scan example.com --modules subdomain,portscan,hidden\n\n# Custom ports\ngossan scan example.com --ports 80,443,8080,8443\n\n# JSON output\ngossan scan example.com --format json -o results.json\n\n# Probe which packet I/O backend the SYN engine would select\ngossan probe-engine\n\n# Adaptive (AIMD) rate control — halves on TX-drop bursts, recovers slowly\ngossan scan example.com --adaptive-rate\n\n# Other formats: SARIF (security-tool integration), nmap-xml (-oX),\n# masscan-grep (-oG), graphml (Gephi/Cytoscape/yEd).\ngossan scan example.com --format sarif -o report.sarif\ngossan scan example.com --format nmap-xml -o scan.xml\n```\n\n## Output formats\n\n| `--format`       | aliases             | use case |\n|------------------|---------------------|----------|\n| `text`           | (default)           | human terminal |\n| `json`           | —                   | scripting / pipeline (top-level array of `Finding`) |\n| `jsonl`          | `ndjson`            | streaming / log shippers |\n| `sarif`          | —                   | GitHub code-scanning, sarif-multitool |\n| `markdown`       | `md`                | issue body / wiki |\n| `nmap-xml`       | `nmap`, `xml`, `-oX`| drop-in for nmap consumers |\n| `masscan-grep`   | `grepable`, `-oG`   | drop-in for masscan consumers |\n| `graphml`        | `graph-ml`          | Gephi / Cytoscape / yEd |\n\n## Environment variables\n\n| var                                        | effect |\n|--------------------------------------------|--------|\n| `GOSSAN_LOG_JSON=1`                        | structured JSON logs (Loki/CloudWatch/Datadog) |\n| `GOSSAN_ALLOW_UNSAFE_PATHS=1`              | override `--out` path-traversal guard |\n| `GITHUB_TOKEN`                             | scm GitHub org enumeration |\n| `GITLAB_TOKEN`                             | scm GitLab group enumeration |\n| `CENSYS_API_ID` + `CENSYS_API_SECRET`      | origin Censys integration |\n| `SHODAN_API_KEY`                           | origin favicon-hash cross-reference |\n| `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` | cloud inside-out discovery |\n\n\n## Screenshots\n\n```\n+-------------------------------------------------------------+\n| gossan scan example.com                                     |\n+-------------------------------------------------------------+\n| [✓] Subdomain Enum      : 124 found                         |\n| [✓] Port Scanning       : 12 open ports                     |\n| [✓] Tech Fingerprinting : React, Nginx, PHP                 |\n| [✓] Cloud Assets        : 1 S3 bucket found (public!)       |\n|                                                             |\n| Findings:                                                   |\n| - [HIGH] S3 Bucket 'example-backup' is publicly readable.   |\n| - [MED]  Exposed .git directory at dev.example.com/.git/    |\n| - [LOW]  Missing DMARC record on mail.example.com           |\n+-------------------------------------------------------------+\n```\n\n## Architecture\n\nGossan is a workspace of independent, reusable crates. Each crate is a standalone scanner that can be used independently or composed through the `gossan` CLI.\n\n| Crate | Description |\n|-------|-------------|\n| `gossan-core` | Core types, traits, config, rate limiting |\n| `gossan-subdomain` | Subdomain enumeration (CT logs, Wayback, DNS brute) |\n| `gossan-portscan` | TCP port scanning with TLS inspection and banner grabbing |\n| `gossan-techstack` | Technology fingerprinting (headers, cookies, HTML patterns) |\n| `gossan-dns` | DNS security auditing (SPF, DMARC, DKIM, CAA, zone transfer) |\n| `gossan-hidden` | Hidden endpoint discovery (dirbusting, sitemap, robots.txt, swagger) |\n| `gossan-cloud` | Cloud asset discovery (S3, GCS, Azure blobs) |\n| `gossan-js` | JavaScript analysis (secrets, API endpoints, WASM) |\n| `gossan-origin` | Origin IP discovery (bypass CDN/WAF) |\n| `gossan-crawl` | Authenticated web crawler with form/parameter extraction |\n| `gossan-correlation` | Cross-module finding correlation |\n| `gossan-checkpoint` | Scan checkpoint and resume |\n| `gossan-engine` | Stateless masscan-class SYN engine (netforge, requires root) |\n| `gossan-headless` | Headless browser integration |\n| `gossan-horizontal` | Horizontal discovery (ASN/BGP mapping + ownership) |\n| `gossan-graph` | Graph-based Attack Surface Management (ASM) |\n| `gossan-scm` | Source Control Mapping (GitHub/GitLab discovery) |\n| `gossan-intel` | Global Passive Intel (Local bulk dataset indexing) |\n| `gossan-fleet` | Distributed Master/Worker orchestration |\n\n## Conservative Campaign Mapper\n\nWhen `--conservative` is set, Gossan runs a **zero-false-positive horizontal asset validator** that confirms whether candidate domains/IPs truly belong to the same organization or campaign before feeding them downstream into Warpscan (static rule scanning) and Sear (URL detonation).\n\n**Every candidate is tested pairwise against the seed using multiple independent signals:**\n\n| Signal | Weight | Description |\n|--------|--------|-------------|\n| TLS Certificate Serial | High | Same leaf cert = same deployment |\n| SSH Host Key | High | Same key exchange fingerprint |\n| Shared GA/GTM Trackers | High | Same analytics property = same operator |\n| WHOIS Registrant Match | Medium | Ownership-level correlation |\n| Favicon Hash (mmh3) | Medium | Shodan-compatible favicon fingerprint |\n| Content Hash | Medium | Identical page content |\n| Error Page Structure | Medium | Hash DOM structure of 404 page (survives content rotation) |\n| HTTP/2 SETTINGS Fingerprint | Low | Server SETTINGS frame = deployment config |\n| Header Ordering | Low | Response header sequence = middleware stack |\n| JARM TLS Fingerprint | Low | TLS stack fingerprint (high ambient noise from CDNs) |\n| DNS Resolution IP | Low | Shared hosting makes this noisy alone |\n\n**Scoring rules:**\n- Known CDN/shared-hosting values (Cloudflare JARM, default favicons, AWS ELB IPs) are **blocklisted** and receive zero weight.\n- A candidate must exceed a **multi-signal threshold**: no single weak signal can produce a match.\n- Each emitted match carries a **confidence tier** (High/Medium/Low) so downstream consumers can decide their own risk tolerance.\n\n```bash\n# Conservative mode for safe downstream feeding\ngossan scan example.com --conservative\n\n# Pairs with:\nwarpscan scan ./campaign-assets --rules-dir ./rules   # Static rule matching\nsear analyze \"https://candidate.evil.tk\" --depth full  # URL detonation\n```\n\n## Legendary Accuracy: Differential Signal Intelligence\n\nGossan is the only scanner designed to survive the **\"Mirror Maze\"**: environments where thousands of subdomains or paths alias to a single root asset.\n\n- **Response Baselining**: Every new host is interrogated with randomized \"garbage\" paths to establish a structural baseline (DOM tree, fuzzy hashes, and header signatures).\n- **Structural Delta Engine**: Subsequent discoveries are compared against this baseline. Assets with \u003e98% structural similarity are flagged as **Mirror Assets** and automatically **braked** to save bandwidth.\n- **Signal Sniping**: Outliers that break the pattern (e.g., a single `openapi.json` hidden in a sea of mirrors) are promoted as **Signal Assets** for deep analysis.\n- **Response Bomb Shield**: Hard-killing TCP connections that exceed safe `Content-Length` thresholds (5MB HTML / 10MB JS) to prevent OOM attacks.\n\n## As a Library\n\n```rust\nuse gossan_portscan::PortScanner;\nuse gossan_core::{Config, Scanner, ScanInput, Target};\n\nlet scanner = PortScanner;\nlet config = Config::default();\nlet input = ScanInput { targets: vec![/* ... */] };\nlet output = scanner.run(input, \u0026config).await?;\n```\n\n## License\n\nMIT: [Santh Security](https://santh.dev)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsanthsecurity%2Fgossan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsanthsecurity%2Fgossan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsanthsecurity%2Fgossan/lists"}