Skip to content
Deepak Gupta markRecon Atlas

Recon frameworks

Recon-ng

Python framework with a Metasploit-style console for modular web-based OSINT, storing harvested data in a per-workspace database.

Passive and active modesScope a pentestAudit your own exposure

6.0k stars · last push October 5, 2026 · GPL-3.0

GitHub repositoryOfficial docs

What it finds

Recon-ng is an interactive console where you install modules from a marketplace, seed a database with domains or contacts, and chain modules that turn one record type into another. Each workspace has its own SQLite database, options and reports. Recon-web adds a browser view for analysis and export, and recon-cli exposes everything to shell scripts.

  • hosts
  • domains
  • contacts
  • emails
  • credentials from breach sources
  • profiles

Does it touch the target?

Has a passive mode and active modes. The active modes need the owner's permission.

Wiki (Features): "Reconnaissance is the use of open sources to gain information about a target, commonly referred to as 'passive reconnaissance'. Discovery, commonly referred to as 'active reconnaissance', occurs when packets are explicitly sent to the target network". Each has its own module branch; which runs depends on the modules you load.

API keys: Wiki: modules needing third-party credentials are marked in the K column of marketplace search, and loading one without its key gives a warning.

Install

Install with source
git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng
pip install -r REQUIREMENTS
./recon-ng

From the project's documentation

Install with docker
docker build --rm -t recon-ng .
docker run --rm -it -p 5000:5000 -v $(pwd):/recon-ng -v ~/.recon-ng:/root/.recon-ng --entrypoint "./recon-ng" recon-ng

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Install all marketplace modules
marketplace install all

From the project's documentation

Find modules that take domains as input
marketplace search domains-

From the project's documentation

Run a resource file of commands
./recon-ng -r <filename>

From the project's documentation

Start without usage analytics
./recon-ng --no-analytics

From the project's documentation

Limits the project documents

  • Wiki: "The framework itself does not include any modules by default." Modules come from the marketplace, and their dependencies are not installed automatically.
  • Wiki: recon-ng sends an analytics request (UUID, module name, version) each time a module is loaded unless started with --no-analytics.
  • Wiki: the Recon-web API task runner needs Redis, which is not in the plain Docker image; use docker-compose for the full API.
  • Wiki: reporting modules "should be considered deprecated" in favour of Recon-web.
  • Wiki: the project "has historically consisted of a one-man development team", and modules break as web sources change.

Deepak's take

Analysis, not documentation

Use it when
Use it for analyst-driven OSINT where you want to pick each module, keep data per engagement, and script repeatable runs with resource files.
Skip it when
Skip it when you want hands-off automation; BBOT or reconFTW run a whole pipeline from one command.
What it will miss
It finds nothing until you install and configure modules, and modules whose web sources have changed may silently return no data.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Licence: GPL-3.0. Recon-ng is a trademark or project name of its owners; this library is not affiliated with it.