GoSpector

Overview

GoSpector is a domain reconnaissance toolkit written in Go.
It is designed to behave like a pipeline-friendly CLI: data comes in, is enriched or scanned, and clean results are emitted to stdout – ready to be chained into other tools.

At the current stage (week 1–2 of the roadmap), GoSpector provides:

• Subdomain enumeration using Certificate Transparency logs (crt.sh).
• Concurrent TCP port scanning using a worker-pool model.

Project Layout

• cmd/gospector/main.go – CLI entrypoint.
• pkg/subdomain/ – Subdomain enumeration logic (crt.sh).
• pkg/scanner/ – Concurrent TCP port scanner.
• pkg/utils/ – Helper utilities (e.g. ports parsing).

Prerequisites

• Go 1.22 or newer.

Installation

git clone https://github.com/lucasonline0/GoSpector.git
cd GoSpector
go build ./cmd/gospector

This will produce a gospector (or gospector.exe on Windows) binary in the current directory.

CLI

GoSpector uses Cobra for the CLI interface and currently exposes two main subcommands.

Global flags:

• -t, --threads – Number of concurrent workers (default: 50).
• --timeout – Timeout in milliseconds for TCP connections in the port scanner (default: 1000).
• --silent – Minimal output (keeps only the essential results, suitable for scripting).
• -o, --output – Output file (reserved for future use; results are currently written to stdout).

Subdomain Enumeration (crt.sh)

Command:

gospector subenum -d example.com

Behavior:

• Queries crt.sh for *.example.com using the JSON output.
• Parses and normalizes hostnames.
• Deduplicates results and prints one subdomain per line to stdout.
• Output is line-oriented and suitable for piping into other tools.

Port Scanner

Command:

gospector portscan --host 192.0.2.10 --ports 1-1024 -t 200 --timeout 1000

Options:

• --host – Target host or IP (required).
• --ports – Comma-separated list of ports and/or ranges (e.g. 80,443,1-1024).
  Duplicates are removed and the final list is sorted.
• -t, --threads – Number of concurrent workers for the scan.
• --timeout – Per-connection timeout in milliseconds.

Behavior:

• Uses a TCP connect scan with net.Dialer and a configurable timeout.
• Distributes ports across a worker pool driven by goroutines and channels.
• Prints each open port as host:port on its own line.
• Designed to be quiet by default: no banners or extra logs are printed, so it composes well in UNIX-style pipelines.