Skip to content
Deepak Gupta markRecon Atlas

Recon frameworks

FinalRecon

Single Python script for a quick web recon overview: headers, TLS, WHOIS, DNS, subdomains, crawling, directories, Wayback and ports.

Passive and active modesScope a pentestAudit your own exposure

3.0k stars · last push October 31, 2026 · MIT

GitHub repository

What it finds

FinalRecon takes a target URL and runs built-in modules rather than chaining external tools. It reports security headers, certificate and WHOIS details, 40+ DNS record types, subdomains from 15 sources, crawled links, Wayback URLs, directory hits and the top 1000 ports. Each module has its own flag, and --full runs them all.

  • HTTP headers
  • missing security headers
  • cookie attributes
  • SSL certificate details
  • WHOIS
  • DNS records
  • DMARC
  • subdomains
  • links and JavaScript URLs
  • directories
  • Wayback URLs
  • open ports

Does it touch the target?

Has a passive mode and active modes. The active modes need the owner's permission.

Per-module flags: --sub and --wayback use third-party sources, while --headers, --crawl, --dir and --ps ("Fast Port Scan") send requests to the target URL. No single passive-only mode is named.

API keys: README: "Some Modules Use API Keys to fetch data from different resources, these are optional, if you are not using an API key, they will be simply skipped."

Install

Install with package
sudo apt install finalrecon

From the project's documentation

Install with package
sudo pacman -S finalrecon

From the project's documentation

Install with source
git clone https://github.com/thewhiteh4t/FinalRecon.git
cd FinalRecon
pip3 install -r requirements.txt

From the project's documentation

Install with docker
docker pull thewhiteh4t/finalrecon

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Check response headers
python3 finalrecon.py --headers --url https://example.com

From the project's documentation

Check SSL certificate
python3 finalrecon.py --sslinfo --url https://example.com

From the project's documentation

Directory search with extensions and wordlist
python3 finalrecon.py --dir --url https://example.com -e txt,php -w /path/to/wordlist

From the project's documentation

Run every module
python3 finalrecon.py --full --url https://example.com

From the project's documentation

Output formats: txt

Limits the project documents

  • README: designed for Linux; "Windows and Termux are NOT supported."
  • Port scan covers the top 1000 ports only.
  • Wayback module fetches up to 50,000 URLs.
  • Export format listed is txt only.
  • Subdomain sources that need a key are skipped when no key is set.

Deepak's take

Analysis, not documentation

Use it when
Use it for a fast first look at one web target with minimal dependencies, especially on Kali or BlackArch where it is packaged.
Skip it when
Skip it for organisation-wide asset discovery or recursion across many hosts; BBOT or reconFTW cover that scope.
What it will miss
It looks at one target URL per run, so related domains and IP ranges not linked from it are out of view.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: MIT. FinalRecon is a trademark or project name of its owners; this library is not affiliated with it.