A Bash‑driven reconnaissance framework that automates common bug‑bounty and pentest recon tasks.
It wraps Nmap, Dirsearch, and crt.sh lookups (with room for more) into a single, modular workflow supporting:
- multi‑domain scanning
- interactive mode
- selective scan modes (
nmap-only,dirsearch-only,crt-only,all) - tidy per‑domain reports 🌐📄
Recon/
├── recon.sh # Main launcher
├── scan.lib # Function library (nmap / dirsearch / crt)
├── dirsearch/ # External clone of dirsearch (see setup below)
└── README.md
git clone https://github.com/imcoder44/Recon.git
cd Recongit clone https://github.com/maurosoria/dirsearch.gitLeave the dirsearch/ folder inside the repo, or export its path (next step).
sudo apt update
sudo apt install nmap jq curl python3 -ychmod +x recon.shTo call dirsearch.py from anywhere:
export PATH="$PWD/dirsearch:$PATH"
# add the same line to ~/.bashrc for permanence| Mode | Command | Description |
|---|---|---|
| Full scan | ./recon.sh -m all example.com |
Runs Nmap + Dirsearch + crt.sh |
| Nmap only | ./recon.sh -m nmap-only example.com |
Just ports |
| Dirsearch only | ./recon.sh -m dirsearch-only example.com |
Directory brute‑force |
| crt.sh only | ./recon.sh -m crt-only example.com |
Pull cert subdomains |
| Multi‑domain | ./recon.sh -m all example.com test.com |
Batch scan |
| Interactive | ./recon.sh -i -m all |
Type domains one‑by‑one, quit to exit |
Tip: combine
-iand specific modes for on‑the‑fly targeted scans.
Each target produces a folder:
example.com_recon/
├── nmap # cleaned port list
├── dirsearch # dirsearch simple report
├── crt # raw JSON from crt.sh
└── report # consolidated human‑readable report
Replace these placeholder paths with your own images.
- All scan logic lives in
scan.lib– drop in new functions (e.g.subfinder_scan) and call them inrecon.sh. - Use
jq,grep, or custom parsers to normalise tool output before appending to the master report.
Use only on targets you own or have explicit permission to test. The author takes no responsibility for misuse.
This project is released under the MIT License – see LICENSE for details.
### What changed vs. the previous draft?
1. **Clone URL:** now points to `https://github.com/imcoder44/Recon.git`.
2. **Badges:** added shields.io badges for license, last commit, and open issues.
3. **Username references:** switched to **imcoder44** everywhere.
4. **Minor polish:** tightened wording, clarified optional PATH step.