Recon.py

This is my personal multi-threaded reconnaissance script written in Python for bug hunting.

If you find my work helpful and would like to show your support, you can buy me a coffee! ☕

Usage

Using recon.py

Before using recon.py for your reconnaissance tasks, ensure you have installed all the required tools and configured the following variables in the script to achieve optimal outcomes:

github_token = "your_github_token"
dns_wordlist = "dns_wordlist.txt"
perm_wordlist = "perm_wordlist.txt"

python3 recon.py scope.txt

Summary

The recon.py script performs the following tasks:

1. Active/Passive Subdomain Enumeration:

   • Utilizes various tools for discovering subdomains within a specified scope.

2. Finding Valid Subdomains:

   • Searches for valid subdomains.

3. Filtering Web Applications:

   • Filters out web applications running on default ports 80/443 using httpx.

4. Finding Vulnerabilities:

   • Uses nuclei to find low-hanging fruits and vulnerabilities, then sends output notifications to Discord, Slack, or email via notify.

5. Port Scanning and Filtering:

   • Performs port scans on discovered domains using rustscan and filters out web servers running on non-default ports.

6. Asset Discovery in Cloud Environments:

   • Discovers assets in cloud environments using cloudenum and sends output notifications to Discord, Slack, or email via notify.

7. Crawling Valid Assets:

   • Utilizes tools like katana, hakrawler, and gospider to crawl valid discovered assets for endpoints, JavaScript files, and new subdomains.

Feel free to explore and customize these scripts and tools based on your specific needs. Contributions and feedback are welcome!

Note: I personally use this script on my Digital Ocean VPS and have not tested it on my local network.

DigitalOcean Referral

If you're interested in trying out DigitalOcean for hosting your projects, you can sign up using this referral link. By using this link, you'll get some free credits to start with.

Sign up on DigitalOcean

Reconnaissance Toolbox

This repository contains a collection of tools for reconnaissance and information gathering during security assessments.

Tools List

Each tool in this repository serves a specific purpose in reconnaissance and information gathering. Refer to the respective GitHub repositories for installation instructions, usage examples, and additional details about each tool.

1. dnsvalidator: A tool for validating and verifying DNS records.

2. chaos: A subdomain discovery tool that uses multiple DNS sources to discover subdomains.

3. subfinder: A tool designed to find subdomains using passive methods.

4. assetfinder: A tool for finding domains and subdomains related to a given domain.

5. crobat: A tool that leverages Sonar data to find subdomains.

6. amass: An open-source intelligence tool for discovering subdomains.

7. github-subdomains: A tool to discover subdomains from GitHub repositories.

8. oam_subs: A tool for enumerating Oracle Access Manager endpoints.

9. dnsx: A fast DNS enumeration and resolution tool.

10. dnscan: A tool to gather information about a domain including subdomains and open ports.

11. oneforall: A tool for subdomain enumeration that integrates multiple techniques.

12. Gotator: A DNS subdomain scanner with multi-threading support.

13. httpx: A fast and multi-purpose HTTP toolkit.

14. nuclei: A fast and customizable vulnerability scanner based on templates.

15. rustscan: A fast port scanner written in Rust.

16. notify: A simple tool for sending notifications via different mediums.

17. cloudenum: A tool for finding out information about cloud environments.

18. Gospider: A tool for web crawling and fingerprinting.

19. Hakrawler: A simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application.

20. Katana: A next-generation crawling and spidering framework.

21. anew: A tool for comparing two lists of lines in a file and outputting the differences.

Social Profiles

Medium | YouTube | LinkedIn | Twitter | HackerOne | Facebook | Instagram

Disclaimer

Usage of these tools for unauthorized access or any malicious activity is strictly prohibited. Use them responsibly and with proper authorization.