Net-Recon: Enhanced Automated Network Reconnaissance Pipeline

Net-Recon is a comprehensive and powerful network reconnaissance tool built with Python. It automates the process of network discovery, scanning, and vulnerability assessment, providing detailed and well-structured reports in various formats.

Features

• Multi-phase Scanning: Performs a series of scans, from host discovery to in-depth vulnerability assessment.
• Multiple Scan Modes: Choose between quick, standard, and full scan modes to control the scan depth.
• Flexible Output Formats: Generates reports in html, json, and markdown.
• Configuration-driven: Easily customize the scanner's behavior using a config.yaml file.
• Concurrent Scanning: Utilizes threading for efficient and fast port scanning.
• Vulnerability Assessment: Includes checks for common vulnerabilities and utilizes NSE scripts.
• Containerized: Comes with a Dockerfile for easy deployment and execution in a containerized environment.

Installation

1. Clone the repository:

   git clone https://github.com/your-username/net-recon.git
   cd net-recon

2. Install dependencies:

   pip install -r requirements.txt

Usage

Run a scan using the main.py script:

python main.py -t <target_ip_or_hostname> [options]

Options:

• -t, --target: The target IP address or hostname to scan (required).
• -o, --output: The output directory for the scan results (default: recon_results).
• -m, --mode: The scan mode (quick, standard, full) (default: standard).
• -c, --config: The path to a custom configuration file.
• --threads: The maximum number of threads to use for scanning (default: 10).

Example:

python main.py -t 127.0.0.1 -m quick

Output

The tool generates a new directory for each scan in the recon_results directory. The output directory contains the scan results in the configured formats. By default, it generates a recon_report.md file with a summary of the findings.

Example Markdown Report:

# Network Reconnaissance Report

## Target: 127.0.0.1
**Scan Date:** 2025-11-03 22:48:33
**Scan Mode:** quick

## Executive Summary
- **Open Ports:** 5
- **Services Found:** 5
- **Vulnerabilities:** 1
- **Host Status:** alive

## Detailed Findings

### Services
- **Port 22:** `SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.1`
- **Port 80:** `Apache/2.4.41 (Ubuntu)`
- ...

### Potential Vulnerabilities
1.  CVE-2021-41773: Apache Path Traversal

Configuration

The scanner can be configured using the config.yaml file. The default configuration is as follows:

scan:
  timeout: 600
  max_threads: 15
  common_ports: [...] # A list of common ports to scan
  top_ports:
    quick: 1000
    standard: 10000
    full: 65535

output:
  formats: ['html', 'json', 'markdown']
  include_timestamp: true
  compress_results: false

nmap:
  timing_template: '-T4'
  scripts: ['vuln', 'safe', 'discovery', 'default', 'auth']
  script_timeout: 5m

http:
  user_agent: 'Mozilla/5.0 (compatible; NetworkRecon/2.0)'
  timeout: 10
  follow_redirects: true

vulnerability:
  check_cves: true
  check_banners: true
  check_versions: true

reporting:
  generate_executive_summary: true
  include_screenshots: false
  risk_levels: ['low', 'medium', 'high', 'critical']

Development

To run the tests, use pytest:

python -m pytest