GoSpector

GoSpector is a modular Go framework for authorized, defensive asset reconnaissance. It accepts domains, hostnames, IPv4/IPv6 addresses, files, and stdin; it never includes exploitation, evasion, credential, persistence, raw-packet, or destructive capabilities.

flowchart LR
  T[Targets/stdin/files] --> E[Passive sources]
  E --> D[Concurrent DNS resolver]
  D --> S[Bounded TCP scanner]
  S --> F[Safe fingerprint/TLS]
  F --> H[HTTP probe]
  H --> O[Text / JSON / JSONL]

Loading

Install

Requires Go 1.22+.

go install github.com/lucasonline0/GoSpector/cmd/gospector@latest
make build

Commands

echo example.com | gospector subdomains
gospector scan example.com --ports 80,443 --format jsonl
gospector recon example.com --ports 80,443 --format jsonl
gospector recon targets.txt --disable enum --rate 50

subenum and portscan remain aliases. --output report.jsonl writes to a file; --format text|json|jsonl controls serialization independently. Logs and execution summaries use stderr, keeping structured stdout clean. Use --silent to omit the summary.

Configuration is optionally loaded from ~/.config/gospector/config.yaml; command-line flags override its worker, per-host, timeout, rate-limit, port, source, and resolver defaults. The configuration keys are workers, per_host, timeout, rate_limit, ports, enabled_sources, and the single custom DNS resolver address (for example 1.1.1.1:53).

Use --workers for global concurrency and --per-host for the independent per-host connection bound.

JSON objects use typed fields. DNS records contain a, aaaa, cname, mx, ns, and txt; port findings contain host, ip, port, state, latency, and timestamp; service findings add service, banner, and TLS metadata; HTTP findings include status, title, headers, timing, and TLS metadata.

See architecture and security model. The performance model uses bounded goroutine pools, per-operation context deadlines, configurable connection rate limiting, and strict HTTP/banner read limits.

Development and releases

make test
make vet
make build

The GitHub Actions workflow runs tests, the race detector, vet, lint, and builds on supported Go versions. GoReleaser produces Linux, macOS, and Windows amd64/arm64 archives; VERSION is injected into the binary at build time. Docker builds a minimal static runtime image.