Context
GoSpector is a defensive asset-discovery CLI designed around explicit scope and bounded network behavior. It can enumerate certificate-transparency names, resolve DNS records, perform TCP connect scans, inspect selected service banners and TLS metadata, and issue HTTP GET probes. Its security model explicitly excludes raw/SYN scanning, exploitation, credential attacks, persistence, evasion, destructive actions, and TLS attacks.
Architecture
The CLI composes independent source, resolver, scanner, fingerprint, TLS, HTTP, output, and rate-limit packages into a recon pipeline. Context cancellation, operation timeouts, and concurrency limits flow through the network stages.
Cobra CLI — subdomain, TCP scan, and recon commands with worker, per-host, timeout, rate, output-format, and stage-disable controls
Passive certificate-transparency discovery through crt.sh with retries, exponential backoff, response-size limits, domain filtering, wildcard tracking, and deduplication
Concurrent DNS collection for A, AAAA, CNAME, MX, NS, and TXT records with per-attempt timeouts, retries, backoff, and context cancellation
TCP connect scanning with a global worker pool, per-host connection slots, optional global rate limiting, connection timeouts, cancellation, and deterministic result ordering
Bounded banner reads, selected TLS certificate metadata, and HTTP GET probes with redirect and response-body limits plus selected security-header collection
Engineering Decisions
Use TCP connect scanning instead of raw packet techniques
Port discovery uses net.Dialer.DialContext and ordinary TCP connections. The project deliberately avoids SYN/raw scanning and keeps that boundary documented as part of its authorized defensive scope.
Treat concurrency and rate as operator-controlled safety limits
The scanner combines a global worker pool with per-host semaphores and an optional global rate limiter. Timeouts and context cancellation are checked throughout the job pipeline so large target sets remain interruptible.
Make DNS resolution cancellable and retryable
DNS work runs through a worker pool and collects A, AAAA, CNAME, MX, NS, and TXT data. Individual lookups receive timeouts and retry with backoff rather than leaving unbounded resolver calls inside the recon pipeline.
Bound external data before parsing or fingerprinting
crt.sh JSON decoding is limited to 8 MiB, service banner reads use a 1 KiB buffer, and HTTP response bodies default to a 1 MiB limit with a three-redirect cap. These limits keep reconnaissance inputs from becoming unbounded memory paths.
Separate certificate inspection from certificate trust
The dedicated TLS metadata inspector intentionally disables certificate verification so expired or self-signed certificates can still be described. The security model states that this is metadata collection, not an authentication or trust decision.