gossan · open source · MIT
Map the attack surface of a domain.
Your attack surface is everything an outsider can reach: subdomains, open ports, running services, and cloud storage. Point gossan at a domain and it enumerates subdomains, scans ports, fingerprints the technology actually running, finds hidden endpoints, and discovers cloud assets, emitting JSON your pipeline can diff run over run.
Install
cargo install gossangit clone https://github.com/santhreal/gossan && cd gossan && cargo build --releaseThen point it at a domain:
gossan scan acme.comWhat it finds
- Subdomains. Enumeration across certificate transparency, DNS sources, and permutation, with resolution and wildcard filtering.
- Open ports and services. Rate-limited scanning that identifies what listens, not just that something does.
- The real stack. Technology fingerprinting via TrueStack: what is actually running, not what the version string claims.
- Hidden endpoints. Web crawling and JS analysis surface routes and API paths that never appear in a sitemap.
- Cloud assets. Discovery of buckets, storage, and exposed services attached to the target's footprint.
Built for pipelines
gossan emits structured JSON for every module, so a nightly run against your own domains becomes a changelog of your exposure: new subdomain, new open port, new technology, new bucket. Each capability is its own crate and its own feature flag, so CI builds compile only the modules you use:
cargo build --no-default-features --features subdomain,techstackThe engine is async Rust on io_uring, the Linux kernel's asynchronous I/O interface, with explicit rate limits, so a full-surface sweep does not read like an attack to the target's edge.
Get it
github.com/santhreal/gossan - source and issues. The CLI and its module crates are on crates.io. Use it against assets you own or are authorized to test.