Discover related domains from Content Security Policy headers

csprecon reads a source most recon tools skip: the Content Security Policy header. A CSP lists every origin a page may load scripts, frames, fonts, and other resources from, so it often names internal apps, CDNs, third-party services, and sibling properties an organization runs. csprecon fetches that header, parses the directives, and turns one URL into a fresh set of related domains.

It runs over a single domain with -url, a file of domains with -list, or a network block when you set -cidr. The -domain filter keeps only results that fall inside the scopes you care about, -json emits structured records for the rest of a pipeline, and -rate-limit with -concurrency control how hard a wide run hits the network.

On Trickest, csprecon is a Recon node that takes a domain or a list and writes a file and a folder of discovered domains. Run it beside subdomain enumeration to widen scope, then pass the new domains to a prober like httpx to see which ones are live.