Recon frameworks
Can one tool run the whole workflow?
Frameworks chain many of the tools above into one pipeline with shared output. They save setup time, but you inherit every component's behaviour, including active steps and, in some, vulnerability scanning.
Listed alphabetically. The order is not a ranking.
- BBOTPassive and active modes
Recursive Python scanner with presets for subdomains, emails, cloud assets, web spidering and web scanning, inspired by SpiderFoot.
11k stars · last push November 11, 2026 · v3.0.2 · AGPL-3.0
- FinalReconPassive and active modes
Single Python script for a quick web recon overview: headers, TLS, WHOIS, DNS, subdomains, crawling, directories, Wayback and ports.
3.0k stars · last push October 31, 2026 · MIT
- OsmedeusActive
Go workflow engine that runs security scans defined in YAML, with distributed workers, a web UI and a queryable asset database.
6.6k stars · last push November 6, 2026 · v5.1.2 · MIT
- Recon-ngPassive and active modes
Python framework with a Metasploit-style console for modular web-based OSINT, storing harvested data in a per-workspace database.
6.0k stars · last push October 5, 2026 · GPL-3.0
- reconFTWPassive and active modes
Bash orchestrator that chains dozens of recon tools for subdomains, OSINT, web analysis and optional vulnerability checks.
8.4k stars · last push November 2, 2026 · v4.1 · MIT
- reNginePassive and active modes
Self-hosted web UI that runs YAML-configured recon scan engines and stores results in a database for filtering and reports.
8.9k stars · last push November 8, 2026 · v2.2.0 · GPL-3.0
- sn0intPassive and active modes
Rust OSINT framework and module package manager that runs sandboxed Lua modules and stores entities in a typed database.
2.6k stars · last push September 20, 2026 · v0.26.1 · GPL-3.0
- SpiderFootPassive and active modes
Python OSINT automation tool with 200+ modules, a web UI and CLI, correlating data about domains, IPs, emails, names and more.
24k stars · last push April 13, 2026 · v4.0 · MIT