surfacediff takes a snapshot of your attack surface and diffs it against
the last one. New hosts, dead hosts, flipped status codes, changed titles. It exits
1, so it goes straight into cron and you find out before someone else does.
MIT licensed. Read the source before you point any of it at your own perimeter.
Dangling DNS and subdomain takeover detection in Go. 81 CNAME fingerprints across 21 providers, each with its own takeover signature, so a CNAME at a live bucket is not reported as a finding.
Content-addressed snapshots of your perimeter, diffed field by field. Takes
recon output on stdin, exits 1 on a delta. No daemon.
WordPress and CMS auditing in Go. Plugin fingerprinting and offline CVE correlation, with each verdict stating how much of the target the local database could actually speak to.
Risk scoring you can audit. Computes from CVSS vectors, EPSS probability and
CISA KEV presence rather than a vendor's black box, so the ranking has a
reason. Needs requests and PyYAML.
Why automated takeover scanners fail on wildcard DNS and edge CDNs, the mechanics of unverified CNAME chains, and how cryptographic canary probing eliminates false positive alerts.
Read →Four offline WordPress vulnerability scanners compared on what they detect, how they source advisory data, and whether they tell you when their database has no coverage of a plugin.
Read → All research →
surfacediff and HostageLVX take stdin and write stdout.
They sit between tools you already have.
$ subfinder -d example.com -silent | surfacediff snap -l subs --source subfinder $ surfacediff diff -l subs || echo "New subdomains found!" $ cat subs.txt | hostage -threads 50 -verify $ httpx -l subs.txt -json -silent | surfacediff snap -l web --source httpx $ surfacediff diff -l web --json > /tmp/surface_delta.json
