gossan · 2026-07-30 · product

Meet gossan: attack-surface discovery in one scan.

Your attack surface is everything an outsider can reach: every subdomain, open port, running service, and forgotten bucket. You cannot defend what you have not mapped. gossan maps it. Point it at a domain and it enumerates subdomains, scans ports, fingerprints the technology actually running, finds hidden endpoints, and discovers cloud assets, emitting structured output your pipeline can diff run over run.

Install it

cargo

cargo install gossan

from source

git clone https://github.com/santhreal/gossan && cd gossan && cargo build --release

Then point it at a domain you own:

gossan scan acme.com

One scan, every module

A full run executes every compiled-in module in pipeline order. Subdomain enumeration pulls from certificate transparency logs and DNS sources, resolves candidates, and filters wildcards. The port scanner is a SYN engine with explicit rate control: pass --adaptive-rate and it halves its send rate on transmit-drop bursts and recovers slowly, so a full sweep does not read like an attack to your own edge. You can ask which packet I/O backend the engine would pick before you commit to a run:

gossan probe-engine

Technology fingerprinting answers what is actually running, not what the version string claims. Web crawling and JavaScript analysis surface routes and API paths that never appear in a sitemap. Cloud discovery finds buckets and storage attached to the target's footprint. Origin-IP discovery tries to see behind the CDN. Every module can be disabled individually (--no-subdomain, --no-headless, and so on) when you want a narrower run:

gossan scan acme.com --no-headless --no-cloud

Output your pipeline already reads

Recon you cannot diff is recon you cannot operationalize. gossan emits the formats your existing tooling consumes:

JSON / JSONL. A top-level array of findings, or one finding per line for streaming into log shippers.
SARIF. The JSON format for scan results that GitHub Code Scanning reads natively, so new exposure lands in your Security tab: gossan scan acme.com --format sarif -o report.sarif
nmap XML and masscan grepable. Drop-in for tooling built on those scanners: --format nmap-xml, --format masscan-grep
GraphML. The asset graph for Gephi, Cytoscape, or yEd: --format graphml
Markdown. A report you can paste into an issue body.

A nightly run against your own domains becomes a changelog of your exposure: new subdomain, new open port, new technology, new bucket. That diff is the finding.

Modular by construction

Each capability is its own crate and its own feature flag: subdomain, portscan, techstack, hidden, cloud, crawl, js, origin, dns, graph, and more. CI builds compile only the modules a pipeline uses:

cargo build --no-default-features --features subdomain,techstack

The engine is async Rust with io_uring (the Linux kernel's asynchronous I/O interface) where available. Structured JSON logs for Loki, CloudWatch, or Datadog are one environment variable away (GOSSAN_LOG_JSON=1), and output paths are guarded against traversal unless you explicitly override with GOSSAN_ALLOW_UNSAFE_PATHS=1.

Try it

github.com/santhreal/gossan - MIT licensed, no telemetry. The CLI is on crates.io and the feature overview lives at santh.dev/gossan. Use it against assets you own or are authorized to test.