GitHub - redshadow912/Reconx: Fast, passive-only OSINT tool — 36 data sources, subdomain takeover detection, risk scoring. Built in Rust.

  ____
 |  _ \ ___  ___ ___  _ __ __  __
 | |_) / _ \/ __/ _ \| '_ \\ \/ /
 |  _ <  __/ (_| (_) | | | |>  <
 |_| \_\___|\___\___/|_| |_/_/\_\

Fast, passive-only OSINT reconnaissance tool for subdomain enumeration, asset discovery, credential leak detection, and full domain intelligence.

Features • Installation • Quick Start • Commands • Data Sources • API Keys • Reports • Architecture

Why Reconx?

Reconx replaces the need to juggle SpiderFoot, Amass, theHarvester, and Recon-NG separately. One command queries 36 passive data sources concurrently, correlates results with confidence scoring, detects subdomain takeover vulnerabilities, enriches data with WHOIS intelligence, scores risk, and generates professional reports — all without sending a single packet to the target.

	Reconx	Amass	SpiderFoot	theHarvester
Passive only	✅	Partial	Partial	✅
Concurrent sources	36	~30+	200+ (active/passive)	~15
Subdomain enum	✅	✅	✅	✅
Credential leaks	✅	❌	✅	✅
Subdomain takeover	✅	❌	❌	❌
WHOIS intelligence	✅	✅	✅	❌
Wireless discovery	✅	❌	❌	❌
Asset mapping	✅	Partial	✅	❌
Risk scoring	✅	❌	❌	❌
Historical diff	✅	❌	❌	❌
HTML + Markdown reports	✅	❌	✅	❌
Single binary	✅	✅	❌ (Python)	❌ (Python)
Execution Speed	Very Fast	Slow	Slow	Fast

✨ Features

Core Intelligence

36 Passive Data Sources — Certificate transparency, DNS, threat intel, search engines, breach databases, code leaks, wireless networks, and more
Smart Rate Limiting — Built-in exponential backoff on HTTP 429/5xx and per-API quota limits via governor
Proxy Support — Built-in HTTP/SOCKS5 proxy rotation support via --proxy flag for heavy recon workflows
Concurrent Execution — All collectors run in parallel via Tokio async runtime with configurable concurrency limits
Zero Active Scanning — 100% passive reconnaissance. No port scans, no direct probing, no noise

Analysis & Enrichment

🎯 Subdomain Takeover Detection — Scans CNAME records against 60+ known vulnerable service fingerprints (AWS S3, Azure, Heroku, GitHub Pages, Netlify, etc.)
📋 WHOIS Intelligence — Passive RDAP lookup for registrar, registration dates, expiry alerts, nameservers, and privacy protection status
🔒 SSL/TLS Intelligence — Certificate metadata extraction via crt.sh, SAN discovery, expiry detection, and self-signed cert flagging
📊 Risk Scoring — Weighted 0-10 risk score considering takeover candidates, exposed ports, credential leaks, and SSL issues with ranked Top Risk Factors

Comparison & Monitoring

🔄 Historical Diff Mode — Compare current scan against a previous JSON export to detect new subdomains, removed assets, and infrastructure drift
🔍 Confidence Scoring — Multi-source correlation ranks subdomains by confidence (found by 3 sources = more reliable than 1)

Probing

🌐 HTTP Probing — Live web service detection with status codes, titles, and redirect chains
🔧 Technology Fingerprinting — Detects web frameworks, CMS, CDNs, WAFs, and server software
🚪 Sensitive Path Detection — Checks for exposed /.env, /.git/config, /admin, /swagger-ui/, /phpinfo.php, and more

Reporting

📄 Multi-Format Reports — HTML, JSON, CSV, and Markdown
📊 Executive Summary — Risk score, top risk factors, and finding statistics
🔗 Markdown Reports — Ready to paste into GitHub Issues, Notion, Obsidian, or pentest reports

🚀 Installation

From Source

# Clone the repository
git clone https://github.com/redshadow912/Reconx.git
cd Reconx

# Build optimized release binary
cargo build --release

# Binary will be at ./target/release/reconx

Requirements

Rust 1.70+ (Install Rust)
Internet connection for passive API queries

⚡ Quick Start

# Basic subdomain enumeration (no API keys needed)
reconx enum -d example.com

# Full intelligence gathering with all modules
reconx intel -d example.com -v

# Subdomain enumeration with DNS resolution
reconx enum -d example.com --resolve --no-wildcard

# Compare against a previous scan
reconx enum -d example.com --diff ./reconx-output/example.com/20250101_120000/findings.json

# HTTP probe discovered subdomains
reconx probe -d example.com -v

# Asset discovery
reconx assets -d example.com

# Credential leak search
reconx creds -d example.com

# Wireless network discovery
reconx wireless -n "Company Name"

📖 Commands

`reconx enum` — Subdomain Enumeration

Discovers subdomains from passive sources like certificate transparency logs, DNS databases, search engines, and web archives.

Usage: reconx enum [OPTIONS] --domain <DOMAIN>

Options:
  -d, --domain <DOMAIN>            Target domain
  -o, --output <OUTPUT>            Output directory
  -f, --format <FORMAT>            Report formats [possible values: html, json, csv, markdown]
  -c, --concurrency <CONCURRENCY>  Max parallel collectors [default: 10]
  -t, --timeout <TIMEOUT>          Per-source timeout in seconds [default: 30]
      --sources <SOURCES>          Run only specific sources (comma-separated)
      --exclude <EXCLUDE>          Exclude specific sources (comma-separated)
      --resolve                    Resolve subdomains to IP addresses
      --no-wildcard                Filter out wildcard subdomains
      --diff <DIFF>                Compare against previous scan JSON
  -v, --verbose                    Show detailed collector output
  -q, --quiet                      Suppress all progress output

`reconx intel` — Full Intelligence Gathering

Runs all collector modules simultaneously — subdomains, assets, credentials, emails, code leaks, WHOIS, and wireless.

reconx intel -d example.com -v

`reconx assets` — Asset Discovery

Discovers public-facing IP addresses, open ports, services, and technologies using Shodan, Censys, InternetDB, and other passive sources.

reconx assets -d example.com

`reconx creds` — Credential Leak Detection

Searches Have I Been Pwned, IntelX, GitHub code leaks, and other breach databases for leaked credentials.

reconx creds -d example.com

`reconx probe` — HTTP Probing

Probes discovered subdomains for live web services. Detects technologies, CDNs, WAFs, and sensitive exposed paths.

# Probe from previous enum results
reconx probe --input ./reconx-output/example.com/findings.json

# Or enumerate + probe in one step
reconx probe -d example.com -v

`reconx wireless` — Wireless Network Discovery

Searches Wigle.net for wireless networks associated with the target organization.

reconx wireless -n "Company Name"

`reconx config` — API Key Management

# Set an API key
reconx config set shodan YOUR_API_KEY

# List configured keys
reconx config list

# Show config file path
reconx config path

`reconx report` — Regenerate Reports

Generate new reports from previously saved findings.

reconx report --input findings.json --format html,markdown

🔌 Data Sources

Reconx integrates 36 passive data sources across 9 categories. Sources marked Free work instantly with zero configuration. Sources marked Required need an API key (most offer free tiers).

Certificate Transparency

Source	API Key	Description
crt.sh	Free	Certificate transparency log search
CertSpotter	Free	SSLMate certificate transparency monitoring
CertStream	Free	Real-time certificate transparency log streaming

DNS & Subdomain Discovery

Source	API Key	Description
HackerTarget	Free	DNS lookup and host search
Anubis	Free	Subdomain enumeration
RapidDNS	Free	Fast DNS database search
SubdomainCenter	Free	Subdomain aggregation service
ThreatCrowd	Free	Threat intelligence search
ThreatMiner	Free	Threat intelligence data mining
DNSDumpster	Free	DNS reconnaissance
SecurityTrails	Required	Comprehensive DNS and domain intelligence
Chaos	Required	ProjectDiscovery's asset database

Search Engines & Archives

Source	API Key	Description
Wayback Machine	Free	Internet Archive historical URL data
Common Crawl	Free	Web crawl data repository
DuckDuckGo	Free	Privacy-focused search engine scraping
URLScan	Required	Website scanner and analysis

Threat Intelligence

Source	API Key	Description
VirusTotal	Required	File and URL analysis platform
AlienVault OTX	Required	Open threat intelligence community
ThreatHunter	Free	AI-powered threat hunting
Shodan	Required	Internet-connected device search
Censys	Required	Internet-wide scanning data
InternetDB	Free	Shodan's free lightweight API
FullHunt	Required	Attack surface management
IPInfo	Required	IP geolocation and ASN data
BGPView	Free	BGP and ASN lookup

Credential & Breach Intelligence

Source	API Key	Description
Have I Been Pwned	Required	Breach notification service
IntelX	Required	Intelligence search engine
LeakIX	Required	Leaked database search
Pastebin	Free	Paste site monitoring

Code Leak Detection

Source	API Key	Description
GitHub Dorks	Required	GitHub code search for exposed secrets

Email Harvesting

Source	API Key	Description
Hunter.io	Required	Professional email finder

Domain Intelligence

Source	API Key	Description
WHOIS/RDAP	Free	Domain registration intelligence via RDAP

Search Engine Intelligence

Source	API Key	Description
FOFA	Required	Cyberspace search engine
ZoomEye	Required	Cyberspace search engine
Netlas	Required	Internet intelligence search

Wireless

Source	API Key	Description
Wigle.net	Required	Wireless network database

18 sources are completely free and work instantly with zero setup. The remaining 18 require API keys — most services offer generous free tiers.

🔑 API Keys

Configure API keys to unlock additional data sources:

# Essential (free tier available)
reconx config set virustotal YOUR_KEY
reconx config set shodan YOUR_KEY
reconx config set censys YOUR_KEY
reconx config set github YOUR_TOKEN

# Extended coverage
reconx config set alienvault YOUR_KEY
reconx config set urlscan YOUR_KEY
reconx config set intelx YOUR_KEY
reconx config set ipinfo YOUR_KEY
reconx config set hunter YOUR_KEY
reconx config set wigle YOUR_KEY
reconx config set securitytrails YOUR_KEY
reconx config set leakix YOUR_KEY
reconx config set hibp YOUR_KEY
reconx config set fofa EMAIL:KEY
reconx config set zoomeye YOUR_KEY
reconx config set netlas YOUR_KEY
reconx config set fullhunt YOUR_KEY
reconx config set chaos YOUR_KEY

API keys are stored locally in your system config directory (~/.config/reconx/config.toml). They are never transmitted anywhere except to their respective APIs.

📊 Reports

Reconx generates reports in 4 formats:

Format	File	Description
HTML	`report.html`	Interactive report with statistics and tables
Markdown	`report.md`	Structured report with emoji badges, risk factors — paste into GitHub/Notion/Obsidian
JSON	`findings.json`	Machine-readable findings for integration with other tools
CSV	`subdomains.csv`, `assets.csv`, `credentials.csv`, etc.	Spreadsheet-friendly per-category exports

Reports are saved to ./reconx-output/<domain>/<timestamp>/ by default.

Example Markdown Report Structure

📊 Executive Summary
  Risk Score: 4.5/10 (MEDIUM)
  Subdomains: 570 | Assets: 2 | Credentials: 36

⚠️ Top Risk Factors
  🟠 Credential Leaks — 36 credential leaks
  🟡 Subdomain Exposure — 570 subdomains

🌐 Subdomains (with confidence scores)
🖥️ Assets & Services
🔑 Credential Leaks
📋 WHOIS Intelligence
🔒 SSL/TLS Certificates

🏗️ Architecture

src/
├── main.rs              # CLI entrypoint and orchestration
├── cli.rs               # Command-line argument definitions (clap)
├── config.rs            # API key management and persistence
├── error.rs             # Error types
├── dns/                 # DNS resolution and wildcard detection
├── collectors/          # 36 data source collectors
│   ├── mod.rs           # Collector trait + registry + async executor
│   ├── crtsh.rs         # Certificate Transparency
│   ├── shodan.rs        # Shodan API
│   ├── virustotal.rs    # VirusTotal API
│   ├── whois_rdap.rs    # WHOIS/RDAP intelligence
│   └── ...              # 32 more collectors
├── models/              # Data models
│   ├── finding.rs       # Core Finding enum (Subdomain, Asset, Credential, Whois, Ssl, ...)
│   ├── subdomain.rs     # Subdomain finding with confidence scoring
│   └── ...              # Per-type models
├── analyzers/           # Intelligence analysis pipeline
│   ├── correlator.rs    # Multi-source deduplication and confidence scoring
│   ├── risk_scorer.rs   # Weighted risk analysis with top factors
│   ├── takeover_detector.rs  # Subdomain takeover detection (65+ fingerprints)
│   ├── diff_engine.rs   # Historical scan comparison
│   ├── tech_fingerprint.rs   # Technology stack profiling
│   └── attack_surface.rs     # Attack surface mapping
├── probe/               # Active probing (opt-in)
│   ├── http.rs          # HTTP prober with sensitive path detection
│   ├── ssl_info.rs      # SSL certificate intelligence
│   ├── tech_detect.rs   # Technology detection engine
│   └── cdn_detect.rs    # CDN/WAF detection
├── output/              # Output formatting
│   ├── terminal.rs      # Colored terminal output with progress bars
│   └── writer.rs        # Multi-format report orchestration
└── reports/             # Report generators
    ├── html.rs          # Interactive HTML reports
    ├── markdown.rs      # Structured Markdown with risk badges
    ├── json.rs          # Machine-readable JSON
    └── csv.rs           # Per-category CSV exports

Data Flow

Target Domain
    │
    ▼
┌─────────────────────┐
│  Collector Registry  │ ── 36 passive sources run concurrently
└─────────────────────┘
    │
    ▼
┌─────────────────────┐
│  Correlator          │ ── Dedup + multi-source confidence scoring
└─────────────────────┘
    │
    ▼
┌─────────────────────┐
│  Analyzers           │ ── Takeover detection, risk scoring,
│                      │    tech fingerprinting, attack surface
└─────────────────────┘
    │
    ▼
┌─────────────────────┐
│  Report Writers      │ ── HTML, Markdown, JSON, CSV
└─────────────────────┘

🔒 Passive-Only Philosophy

Reconx is designed to be completely passive by default:

❌ No port scanning
❌ No direct connection to target infrastructure
❌ No DNS brute-forcing
❌ No web crawling or spidering
✅ Only queries third-party APIs and public databases
✅ Safe for pre-engagement reconnaissance
✅ No risk of triggering IDS/IPS or WAF alerts

Note: The probe command performs HTTP GET requests to discovered subdomains. This is opt-in and clearly separated from passive collection.

📜 License

This project is licensed under the MIT License.

Built with ❤️ and Rust 🦀

If you find Reconx useful, consider giving it a ⭐ on GitHub!

Name		Name	Last commit message	Last commit date
Latest commit History 9 Commits
.github/workflows		.github/workflows
src		src
tests		tests
.gitignore		.gitignore
CONTRIBUTING.md		CONTRIBUTING.md
Cargo.lock		Cargo.lock
Cargo.toml		Cargo.toml
LICENSE		LICENSE
README.md		README.md
config.example.toml		config.example.toml

Folders and files

Latest commit

History

Repository files navigation

Why Reconx?

✨ Features

Core Intelligence

Analysis & Enrichment

Comparison & Monitoring

Probing

Reporting

🚀 Installation

From Source

Requirements

⚡ Quick Start

📖 Commands

reconx enum — Subdomain Enumeration

reconx intel — Full Intelligence Gathering

reconx assets — Asset Discovery

reconx creds — Credential Leak Detection

reconx probe — HTTP Probing

reconx wireless — Wireless Network Discovery

reconx config — API Key Management

reconx report — Regenerate Reports