gossan-origin 0.3.2

Discovers the true origin IP of web assets behind CDNs/WAFs — part of the security research ecosystem
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

//! Censys host search for origin IP discovery.
//!
//! Queries Censys v2 hosts API for historical A records and certificates
//! tied to the target domain. Requires Censys API ID + Secret.

use crate::util::{bounded_json, is_routable_ip};
use crate::OriginCandidate;
use gossan_core::{Config, ScanClient};
use std::collections::HashSet;
use std::net::IpAddr;
use std::str::FromStr;

/// Scan Censys for origin candidates.
pub async fn scan(
    domain: &str,
    config: &Config,
    client: &ScanClient,
) -> anyhow::Result<Vec<OriginCandidate>> {
    let api_id = match config.api_keys.get("censys_id") {
        Some(k) => k,
        None => {
            tracing::debug!(source = "censys", "skipping: no censys_id API key");
            return Ok(vec![]);
        }
    };
    let api_secret = match config.api_keys.get("censys_secret") {
        Some(k) => k,
        None => {
            tracing::debug!(source = "censys", "skipping: no censys_secret API key");
            return Ok(vec![]);
        }
    };

    let mut candidates = Vec::new();
    let mut seen = HashSet::new();

    // 1. Certificate search — find IPs in certs for this domain
    let cert_url = format!(
        "https://search.censys.io/api/v2/certificates/search?q=names:{}&per_page=100",
        urlencoding::encode(domain)
    );

    let req = client
        .inner()
        .get(&cert_url)
        .basic_auth(api_id, Some(api_secret))
        .build()?;

    match client.execute(req).await {
        Ok(resp) => {
            if resp.status().is_success() {
                let limit = config.max_response_size.min(10 * 1024 * 1024);
                if let Ok(json) = bounded_json::<serde_json::Value>(resp, limit).await {
                    if let Some(results) = json
                        .get("result")
                        .and_then(|r| r.get("hits"))
                        .and_then(|h| h.as_array())
                    {
                        for hit in results {
                            if let Some(ips) = hit.get("ip").and_then(|v| v.as_str()) {
                                if let Ok(ip) = IpAddr::from_str(ips) {
                                    if is_routable_ip(ip) && seen.insert(ip) {
                                        candidates.push(OriginCandidate::new(
                                            ip,
                                            "censys_cert",
                                            75,
                                        ));
                                    }
                                }
                            }
                        }
                    }
                }
            } else {
                tracing::warn!(source = "censys", status = %resp.status(), "Censys cert search failed");
            }
        }
        Err(e) => {
            tracing::warn!(source = "censys", error = %e, "Censys cert request failed");
        }
    }

    tokio::time::sleep(std::time::Duration::from_millis(config.host_delay_ms)).await;

    // 2. Host search — find hosts presenting this domain
    let host_url = format!(
        "https://search.censys.io/api/v2/hosts/search?q=services.tls.certificates.leaf.names:{}&per_page=100",
        urlencoding::encode(domain)
    );

    let req = client
        .inner()
        .get(&host_url)
        .basic_auth(api_id, Some(api_secret))
        .build()?;

    match client.execute(req).await {
        Ok(resp) => {
            if resp.status().is_success() {
                let limit = config.max_response_size.min(10 * 1024 * 1024);
                if let Ok(json) = bounded_json::<serde_json::Value>(resp, limit).await {
                    if let Some(results) = json
                        .get("result")
                        .and_then(|r| r.get("hits"))
                        .and_then(|h| h.as_array())
                    {
                        for hit in results {
                            if let Some(ip_str) = hit.get("ip").and_then(|v| v.as_str()) {
                                if let Ok(ip) = IpAddr::from_str(ip_str) {
                                    if is_routable_ip(ip) && seen.insert(ip) {
                                        candidates.push(OriginCandidate::new(
                                            ip,
                                            "censys_host_tls",
                                            80,
                                        ));
                                    }
                                }
                            }
                        }
                    }
                }
            } else {
                tracing::warn!(source = "censys", status = %resp.status(), "Censys host search failed");
            }
        }
        Err(e) => {
            tracing::warn!(source = "censys", error = %e, "Censys host request failed");
        }
    }

    Ok(candidates)
}