Skip to content
Deepak Gupta markRecon Atlas

Recon frameworks

reNgine

Self-hosted web UI that runs YAML-configured recon scan engines and stores results in a database for filtering and reports.

Passive and active modesScope a pentestAudit your own exposure

8.9k stars · last push November 8, 2026 · v2.2.0 · GPL-3.0

GitHub repositoryOfficial docs

What it finds

reNgine is a Docker-based web application that runs scan engines covering subdomain discovery, port scanning, endpoint gathering, directory fuzzing, screenshots, OSINT and vulnerability scanning. Results go into a database with a query language, change tracking, scheduled scans and PDF reports. It also offers projects, role-based access and optional GPT or local-LLM vulnerability write-ups.

  • subdomains
  • IP addresses
  • open ports
  • endpoints
  • directories and files
  • screenshots
  • emails
  • employees
  • document metadata
  • WAF
  • misconfigured S3 buckets
  • vulnerabilities

Does it touch the target?

Has a passive mode and active modes. The active modes need the owner's permission.

README: pre-configured engines include "Full Scan, Passive Scan, Screenshot Gathering, and the OSINT Scan Engine". Docs (scan engine page): "Not using http_crawl will be a passive scan." The default YAML sets vulnerability_scan run_nuclei: true and port_scan passive: false.

API keys: The README describes OpenAI GPT (or local LLMs since 2.1.0) for vulnerability descriptions and attack-surface suggestions; it lists no API key as required for scanning.

Install

Install with script
git clone https://github.com/yogeshojha/rengine && cd rengine
nano .env
sudo ./install.sh

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Non-interactive install (admin credentials preset in .env)
sudo ./install.sh -n

From the project's documentation

Update an existing install
cd rengine &&  sudo ./update.sh

From the project's documentation

Default subdomain tool selection in a scan engine YAML
subdomain_discovery: {
  'uses_tools': ['subfinder', 'ctfr', 'sublist3r', 'tlsx', 'oneforall', 'netlas'],

From the project's documentation

Output formats: pdf

Runs these tools under the hood: subfinder, ctfr, sublist3r, tlsx, oneforall, netlas, amass, chaos, naabu, nmap, gospider, hakrawler, waybackurls, katana, gau, gf, ffuf, nuclei, dalfox, crlfuzz, s3scanner

Limits the project documents

  • README Quick Setup targets Ubuntu/VPS; Mac and Windows need the detailed guide on rengine.wiki.
  • README ties Celery worker counts to RAM (MAX_CONCURRENCY=10 for 4GB, 30 for 8GB, 50 for 16GB).
  • Docs warn that scan engine configs from versions before 2.0.0 do not work in 2.0 and later.
  • Docs: "reNgine currently does not support multiple wordlists."
  • Support is through a community-maintained Discord with no guaranteed response; GitHub issues are not for support requests.

Deepak's take

Analysis, not documentation

Use it when
Use it when a team needs a persistent, browser-based recon workspace with scheduled rescans, change tracking, roles and PDF reports.
Skip it when
Skip it for quick one-off CLI runs or low-RAM machines, where reconFTW or BBOT avoid the Docker stack and database.
What it will miss
It reports what its bundled tools find for the targets you add, so unrelated domains owned by the same organisation need adding by hand.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: GPL-3.0. reNgine is a trademark or project name of its owners; this library is not affiliated with it.