reconFTW

reconFTW runs a large toolchain in sequence against a target domain, covering OSINT, passive and brute-force subdomain discovery, host and port scanning, and web analysis. Scan modes range from passive-only (-p) to full recon (-r) and recon plus active vulnerability checks (-a). Results land in a per-target output folder, with optional JSON, HTML or CSV export.

• subdomains
• DNS records
• open ports
• web services
• URLs and JavaScript endpoints
• leaked credentials and secrets
• cloud buckets
• subdomain takeovers
• emails
• vulnerabilities

Has a passive mode and active modes. The active modes need the owner's permission.

README mode table: "-p | Passive: Passive reconnaissance only"; "-r | Recon: Full reconnaissance without active attacks"; "-a | All: Full reconnaissance plus active vulnerability checks". The sample config sets NUCLEICHECK=true and VULNS_GENERAL=false ("very intrusive and slow").

API keys: The README's "API Checklist (Optional)" lists subfinder provider keys, GitHub/GitLab tokens, WHOISXML, PDCP_API_KEY for asnmap and Shodan, set via env vars or secrets.cfg.

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

./reconftw.sh -d example.com -p

./reconftw.sh -d example.com -r

docker run -it --rm \
  -v "${PWD}/OutputFolder/:/reconftw/Recon/" \
  six2dez/reconftw:main -d example.com -r

Output formats: json, html, csv, txt

Runs these tools under the hood: subfinder, github-subdomains, crt, dnsx, puredns, gotator, regulator, subwiz, urlfinder, waymore, httpx, csprecon, tlsx, dsieve, dnstake, S3Scanner, cloud_enum, hakip2host, whois, emailfinder, LeakSearch, msftrecon, metagoofil, porch-pirate, SwaggerSpy, postleaksNg, dorks_hunter, xnldorker, enumerepo, trufflehog, gitleaks, titus, noseyparker, gato, misconfig-mapper, Spoofy, cdncheck, wafw00f, nmap, naabu, smap, nerva, brutespray, brutus, VhostFinder, CMSeeK, katana, JSA, urless, gf, favirecon, subjs, xnLinkFinder, mantra, jsluice, sourcemapper, GQLSpection, arjun, grpcurl, julius, ffuf, cewler, shortscan, nuclei, dalfox, testssl, interactsh, crlfuzz, TInjA, SQLMap, ghauri, second-order, commix, smugglex, Web-Cache-Vulnerability-Scanner, toxicache, nomore403, Interlace, dnsvalidator

• README recommends 10-20 GB of free disk for the toolchain and data.
• Deep mode (--deep) is slower and README recommends a VPS.
• Requires Bash 4+; on macOS the scripts relaunch under Homebrew Bash.
• Cloud bucket checks no longer cover Alibaba OSS after CloudHunter was replaced with cloud_enum.
• The v2 Go rewrite (v5.0.0-beta.1) is an opt-in pre-release; the bash release remains the default.
• The vulnerability module (VULNS_GENERAL, enabled by -a) is described in the config as very intrusive and slow, and includes password spraying.

• BBOT: Recursive Python scanner with presets for subdomains, emails, cloud assets, web spidering and web scanning, inspired by SpiderFoot.
• FinalRecon: Single Python script for a quick web recon overview: headers, TLS, WHOIS, DNS, subdomains, crawling, directories, Wayback and ports.
• Osmedeus: Go workflow engine that runs security scans defined in YAML, with distributed workers, a web UI and a queryable asset database.
• Recon-ng: Python framework with a Metasploit-style console for modular web-based OSINT, storing harvested data in a per-workspace database.
• reNgine: Self-hosted web UI that runs YAML-configured recon scan engines and stores results in a database for filtering and reports.
• sn0int: Rust OSINT framework and module package manager that runs sandboxed Lua modules and stores entities in a typed database.
• SpiderFoot: Python OSINT automation tool with 200+ modules, a web UI and CLI, correlating data about domains, IPs, emails, names and more.