gossan · open source · MIT
Map your attack surface before someone else does.
gossan is an attack surface management and recon tool written in async Rust. Point it at a domain and it enumerates subdomains, scans ports, fingerprints the technology actually running, finds hidden endpoints, and discovers cloud assets, emitting JSON your pipeline can diff run over run.
Install
cargo install gossangit clone https://github.com/santhreal/gossan && cd gossan && cargo build --releaseThen point it at a domain:
gossan recon acme.comWhat it finds
- Subdomains. Enumeration across certificate transparency, DNS sources, and permutation, with resolution and wildcard filtering.
- Open ports and services. Rate-limited scanning that identifies what listens, not just that something does.
- The real stack. Technology fingerprinting via TrueStack: what is actually running, not what the version string claims.
- Hidden endpoints. Web crawling and JS analysis surface routes and API paths that never appear in a sitemap.
- Cloud assets. Discovery of buckets, storage, and exposed services attached to the target's footprint.
Built for pipelines
Recon you cannot diff is recon you cannot operationalize. gossan emits structured JSON for every module, so a nightly run against your own domains becomes a changelog of your exposure: new subdomain, new open port, new technology, new bucket. Each capability is its own crate and its own feature flag, so CI builds compile only the modules you use:
cargo build --no-default-features --features subdomain,techstackThe engine is async Rust on io_uring with explicit rate limits, so a full-surface sweep does not read like an attack to the target's edge, yours or anyone else's.
Get it
github.com/santhreal/gossan - source and issues. The CLI and its module crates are on crates.io. Use it against assets you own or are authorized to test.