gossan-horizontal

Horizontal discovery — ASN/BGP prefix mapping and sibling-domain correlation.

Expands the attack surface beyond the seed domain by mapping the organization's network footprint via public BGP/WHOIS data and by fingerprinting candidate domains for shared infrastructure (TLS certificate issuer overlap, favicon hash collision, response body similarity, leaked tracker IDs, internal-IP disclosure, security-header twins, etc.).

Conservative mode

Set Config::conservative = true (or pass --conservative from the CLI) to enable the zero-false-positive validator that confirms whether a candidate domain truly belongs to the same organization before emitting it downstream.

License

MIT