A security tool that identifies "ghosted" domains in Content Security Policy (CSP) headers - domains that are trusted by websites but are available for sale, creating mal-inheritance risks.

Bonus Discovery: As a side-effect of DNS enumeration, Ghosted also discovers organic typosquatting domains that resolve but weren't intentionally registered by the target organization. These trusts can be abused in a few different ways, context always applies.

Ghosted has successfully identified CSP trust erosions at 122+ major organizations:

• CSP Header Analysis: Scans websites for Content Security Policy headers
• Domain Extraction: Identifies all external domains trusted by CSP policies
• Availability Checking: Uses AWS Route53 to check if trusted domains are available for registration
• PublicWWW Research: Discovers how available domains are used across the web (optional)
• Bug Bounty Reports: Auto-generates professional security reports
• High-Performance Scanning: Beast mode with 1000 DNS concurrency
• Resume Capability: Continue interrupted scans with wordlist tracking
• Automatic Organization: Scan results organized into hot/archive folders

• Typosquatting Discovery: DNS enumeration naturally uncovers typosquatted domains that resolve but weren't registered by the target
  • Identifies potential phishing domains
  • Reveals trademark infringement
  • Discovers forgotten test/staging domains
  • Exposes defensive registrations that need monitoring

• Go 1.21 or higher
• AWS Account (for Route53 domain checking)
• Optional: PublicWWW API key (for enhanced research)

1. Clone the repository

2. Install dependencies:

   go mod download

3. Download wordlists (optional, for active enumeration):

   # Clone SecLists
   git clone https://github.com/danielmiessler/SecLists.git
   
   # Copy wordlists
   cp SecLists/Discovery/DNS/dns-Jhaddix.txt wordlists/FUZZSUBS_CYFARE_1.txt
   cp SecLists/Discovery/DNS/subdomains-top1million-110000.txt wordlists/FUZZSUBS_CYFARE_2.txt

   Note: Wordlists are only needed for --wordlists 1 mode. Passive mode (--wordlists 0) works without them.

4. Configure environment:

   cp .env.example .env
   # Edit .env with your API keys

5. Build:

   go build -o ghosted cmd/ghosted/main.go

# Scan a single domain
./ghosted scan example.com --wordlists 1

# Beast mode (high concurrency - 1000 DNS/sec)
./ghosted beast hosts.txt --wordlists 0  # Passive only
./ghosted beast hosts.txt --wordlists 1  # Full enumeration

# Research available domains via PublicWWW
./ghosted research output/beast_example.com_20251003_120000

# Generate send it report
./ghosted sendit output/beast_example.com_20251003_120000

Environment Variables (.env):

• AWS_ACCESS_KEY_ID - AWS access key (required for Route53)
• AWS_SECRET_ACCESS_KEY - AWS secret key (required for Route53)
• AWS_REGION - AWS region (must be us-east-1 for Route53 Domains API)
• PUBLICWWW_KEY - PublicWWW API key (optional for domain research)

output/
├── beast_example.com_20251003_120000/
│   ├── database.db              # SQLite database
│   ├── SENDIT_REPORT.md         # Comprehensive findings
│   ├── reports/
│   │   ├── high_risk_findings.md
│   │   ├── csp_posture.md
│   │   └── bugbounty/           # Per-domain reports
│   └── logs/                    # Execution logs

This tool is designed for:

• Security research
• Bug bounty hunting
• Defensive security assessment
• Vulnerability discovery

Always obtain proper authorization before scanning domains you don't own.

This project is provided as-is for security research purposes.

This tool builds upon excellent open-source projects:

• ProjectDiscovery - Subfinder and dnsx tools for subdomain enumeration
  • subfinder - Fast passive subdomain enumeration
  • dnsx - Fast and multi-purpose DNS toolkit
• SecLists - Security testing wordlists (FUZZSUBS_CYFARE)
• AWS Route53 - Domain availability checking API
• PublicWWW - Source code search engine for domain usage research

Reports include attribution to https://thecontractor.io/ghosted/

For issues and questions, please open an issue on GitHub, but for those who know me, this is a JC / Claude Code Special, I've spent enough time complaining I can't code to have learned every single syscall from scratch, so ... chat amongst yourselves ? <3