Advanced Usage

This guide covers advanced features, customization, and optimization techniques for power users.

---

Custom Function Execution

Running Specific Functions

Use the -c flag to run specific functions:

# Run single function
./reconftw.sh -d example.com -c nuclei_check

# Run multiple functions
./reconftw.sh -d example.com -c sub_passive
./reconftw.sh -d example.com -c webprobe_simple
./reconftw.sh -d example.com -c nuclei_check

Available Functions

Module	Functions
OSINT	google_dorks, github_dorks, metadata, emails, domain_info
Subdomains	sub_passive, sub_crt, sub_brute, sub_permut, sub_dns
Web	webprobe_simple, screenshot, fuzz, urlchecks, jschecks
Vulns	nuclei_check, xss, sqli, ssrf_checks, cors
Hosts	portscan, cdnprovider, waf_checks, geo_info

Function Dependencies

Some functions depend on others:

webprobe_simple → screenshot → urlchecks → jschecks
sub_passive → sub_dns → webprobe_simple

---

Creating Custom Modules

Module Structure

# Create custom module: modules/custom.sh
#!/bin/bash

custom_function() {
    start_func "${FUNCNAME[0]}" "Running custom check"
    
    # Your code here
    echo "Custom scan for $domain"
    
    # Use existing outputs
    if [[ -f "$dir/webs/webs.txt" ]]; then
        cat "$dir/webs/webs.txt" | custom-tool > "$dir/custom/results.txt"
    fi
    
    end_func "Results: $dir/custom/results.txt"
}

Loading Custom Modules

Add to reconftw.sh:

# Load custom module
source "$SCRIPTPATH/modules/custom.sh"

Function Templates

# Template with all features
my_function() {
    # Function lifecycle
    start_func "${FUNCNAME[0]}" "Description"
    
    # Check if should run in DEEP mode
    if should_run_deep "$input_file" "$DEEP_LIMIT"; then
        # DEEP mode behavior
    fi
    
    # Use axiom if enabled
    if [[ "$AXIOM" == true ]]; then
        axiom_scan "$input_file" "my-tool" "$output_file"
    else
        my-tool < "$input_file" > "$output_file"
    fi
    
    # Notifications
    notification "Found $(wc -l < $output_file) results"
    
    # End function
    end_func "Completed: $(wc -l < $output_file) results"
}

---

Plugin System

Plugin Architecture

reconFTW supports plugins via hooks:

# In reconftw.cfg
PLUGINS=true
PLUGINS_PATH="$SCRIPTPATH/plugins"

Creating Plugins

# plugins/my-plugin.sh
#!/bin/bash

# Hook: after_subdomains
plugin_after_subdomains() {
    echo "[PLUGIN] Processing subdomains..."
    # Custom post-processing
}

# Hook: after_scan
plugin_after_scan() {
    echo "[PLUGIN] Scan completed, generating custom report..."
    # Custom reporting
}

# Register plugin
plugins_register "my-plugin" "after_subdomains,after_scan"

Available Hooks

Hook	Timing
before_scan	Before scan starts
after_subdomains	After subdomain enumeration
after_webprobe	After web probing
after_vulns	After vulnerability scanning
after_scan	After scan completes

---

Wordlist Customization

Custom Wordlist Configuration

# In reconftw.cfg

# Custom subdomain wordlists
subs_wordlist="$SCRIPTPATH/wordlists/custom_subdomains.txt"
subs_wordlist_big="$SCRIPTPATH/wordlists/custom_subdomains_big.txt"

# Custom directory wordlists
fuzz_wordlist="$SCRIPTPATH/wordlists/custom_dirs.txt"

# Optional vuln-specific wordlists
lfi_wordlist="$SCRIPTPATH/wordlists/custom_lfi.txt"
ssti_wordlist="$SCRIPTPATH/wordlists/custom_ssti.txt"

Generating Custom Wordlists

# Generate target-specific wordlist
./reconftw.sh -d example.com -c wordlist_gen

# Merge wordlists
cat wordlist1.txt wordlist2.txt | sort -u > merged.txt

# Filter by length
awk 'length($0) >= 3 && length($0) <= 20' wordlist.txt > filtered.txt

Per-Target Wordlists

# Create target-specific wordlist directory
mkdir -p wordlists/example.com/

# Place custom wordlists
cp custom_subs.txt wordlists/example.com/subdomains.txt
cp custom_dirs.txt wordlists/example.com/fuzzing.txt

# reconFTW will use if present

---

Resolver Optimization

Resolver Setup

# Validate resolvers
dnsvalidator -tL public_resolvers.txt -threads 100 -o resolvers.txt

# Use validated resolvers
RESOLVERS="$SCRIPTPATH/resolvers.txt"

Trusted Resolvers

# Trusted resolvers (for sensitive queries)
RESOLVERS_TRUSTED="$SCRIPTPATH/resolvers_trusted.txt"

# Contents: reliable, trusted DNS servers
8.8.8.8
8.8.4.4
1.1.1.1
9.9.9.9

Resolver Rotation

# Enable resolver rotation
RESOLVER_ROTATE=true
RESOLVER_ROTATE_INTERVAL=100  # Rotate every 100 queries

---

Incremental Mode Deep Dive

How Incremental Works

1. First scan: Full enumeration, results saved
2. Subsequent scans: Compare new vs existing
3. Process only NEW findings
4. Merge results

# Enable incremental
./reconftw.sh -d example.com -r --incremental

Incremental Data Flow

┌─────────────────────────────────────────────────────────────────────┐
│                      Incremental Scan Flow                           │
├─────────────────────────────────────────────────────────────────────┤
│                                                                      │
│  ┌──────────────┐     ┌──────────────┐                              │
│  │  New Scan    │     │ Previous     │                              │
│  │  Results     │     │ Results      │                              │
│  └──────┬───────┘     └──────┬───────┘                              │
│         │                    │                                       │
│         └────────┬───────────┘                                       │
│                  │                                                   │
│                  ▼                                                   │
│         ┌───────────────┐                                           │
│         │    Compare    │                                           │
│         │  (comm/diff)  │                                           │
│         └───────┬───────┘                                           │
│                 │                                                    │
│     ┌───────────┼───────────┐                                       │
│     ▼           ▼           ▼                                       │
│ ┌───────┐  ┌────────┐  ┌────────┐                                  │
│ │  New  │  │ Common │  │Removed │                                  │
│ │ Items │  │ Items  │  │ Items  │                                  │
│ └───┬───┘  └────────┘  └────────┘                                  │
│     │                                                                │
│     ▼                                                               │
│ ┌─────────────────┐                                                 │
│ │ Process ONLY    │                                                 │
│ │ New Items       │                                                 │
│ └─────────────────┘                                                 │
│                                                                      │
└─────────────────────────────────────────────────────────────────────┘

Incremental Configuration

# In reconftw.cfg
INCREMENTAL=true
DIFF_ONLY=true           # Process only differences
DIFF_NOTIFY=true         # Notify on new findings

---

Checkpoint/Recovery System

How Checkpoints Work

# Checkpoint directory
Recon/example.com/.called_fn/

# Each completed function creates a marker
.called_fn/
├── sub_passive
├── sub_crt
├── webprobe_simple
└── nuclei_check

Resuming Interrupted Scans

# Scan interrupted at nuclei_check
./reconftw.sh -d example.com -a

# Resume - skips completed functions
./reconftw.sh -d example.com -a
# Output: [sub_passive] Already run, skipping...

Reset Checkpoints

# Reset all checkpoints (full rescan)
rm -rf Recon/example.com/.called_fn/

# Reset specific function
rm Recon/example.com/.called_fn/nuclei_check

Checkpoint Configuration

# In reconftw.cfg
USE_CHECKPOINT=true      # Enable checkpoint system
CHECKPOINT_DIR=".called_fn"

---

Rate Limiting Strategies

Per-Tool Rate Limits

# In reconftw.cfg

# httpx rate limit (requests per second)
HTTPX_RATELIMIT=150

# Nuclei rate limit
NUCLEI_RATELIMIT=150

# FFUF rate limit
FFUF_RATELIMIT=0  # 0 = no limit

Adaptive Rate Limiting

# Enable adaptive rate limiting
./reconftw.sh -d example.com -a --adaptive-rate

# Automatically adjusts based on:
# - Response times
# - Error rates
# - 429 responses

Global Rate Limit

# Limit all requests
./reconftw.sh -d example.com -r -q 100  # 100 req/sec global

Target-Specific Limits

# Create scope file with rate limits
echo "example.com:50" > scope.txt  # 50 req/sec for this target

./reconftw.sh -d example.com -r -i scope.txt

---

Multi-Target Scanning

Target List

# targets.txt
example.com
test.com
target.org

# Scan multiple targets
./reconftw.sh -l targets.txt -r

Parallel Execution

# Run multiple scans in parallel
cat targets.txt | parallel -j 3 "./reconftw.sh -d {} -r"

Multi-Target with Different Configs

# Create per-target configs
cp reconftw.cfg configs/example.com.cfg
cp reconftw.cfg configs/target.org.cfg

# Run with specific config
./reconftw.sh -d example.com -r -f configs/example.com.cfg

---

Scope File Management

Scope File Format

# inscope.txt - domains to include
example.com
*.example.com
api.example.org

# outofscope.txt - domains to exclude
blog.example.com
legacy.example.com

Using Scope Files

# Include scope
./reconftw.sh -d example.com -r -i inscope.txt

# Exclude scope
./reconftw.sh -d example.com -r -x outofscope.txt

# Both
./reconftw.sh -d example.com -r -i inscope.txt -x outofscope.txt

Wildcard Scopes

# inscope.txt with wildcards
*.example.com        # All subdomains
*.*.example.com      # Second-level subdomains
api.*.example.com    # api.X.example.com pattern

---

Notification Customization

Notification Providers

# In reconftw.cfg
NOTIFICATION=true

# Configure in ~/.config/notify/provider-config.yaml

Provider Configuration

# ~/.config/notify/provider-config.yaml
slack:
  - id: "slack-webhook"
    slack_webhook_url: "https://hooks.slack.com/services/XXX"

discord:
  - id: "discord-webhook"
    discord_webhook_url: "https://discord.com/api/webhooks/XXX"

telegram:
  - id: "telegram"
    telegram_api_key: "XXX"
    telegram_chat_id: "XXX"

Custom Notification Templates

# Custom notification format
notification() {
    local message="$1"
    echo "[$(date)] $domain: $message" | notify -silent
}

---

AI Report Customization

AI Configuration

# In reconftw.cfg
AI_REPORT=true
AI_MODEL="gpt-4"
AI_REPORT_TYPE="detailed"  # detailed, executive, compliance

Custom Report Prompts

# Custom system prompt
AI_SYSTEM_PROMPT="You are a senior penetration tester..."

# Custom report sections
AI_REPORT_SECTIONS="executive_summary,findings,recommendations,methodology"

Report Types

Type	Focus	Audience
detailed	Technical deep-dive	Security team
executive	High-level summary	Management
compliance	Compliance mapping	Auditors

---

Performance Tuning

Thread Optimization

# In reconftw.cfg

# Based on CPU cores (nproc)
THREADS=$(($(nproc) * 2))

# Per-tool threads
HTTPX_THREADS=50
FFUF_THREADS=40
KATANA_THREADS=20
DALFOX_THREADS=200
RESOLVE_DOMAINS_THREADS=150
TLSX_THREADS=1000

Memory Management

# Limit memory-intensive tools
FFUF_THREADS=20  # Reduce if OOM
HTTPX_THREADS=20
KATANA_THREADS=10

# Use streaming where possible
# Avoid loading large files into memory

Disk I/O Optimization

# Use SSD for output directory
OUTPUT="/mnt/ssd/Recon"

# Compress old results
tar -czf old_results.tar.gz Recon/old_target/

Network Optimization

# Reduce HTTP timeouts
HTTPX_TIMEOUT=5
HTTPX_UNCOMMONPORTS_TIMEOUT=5

# Reduce passive enum time window
SUBFINDER_ENUM_TIMEOUT=120

---

Circuit Breaker Pattern

Configuration

# In reconftw.cfg
CIRCUIT_BREAKER=true
CIRCUIT_BREAKER_THRESHOLD=50    # Error threshold
CIRCUIT_BREAKER_TIMEOUT=300     # Cooldown in seconds

Behavior

1. Closed: Normal operation
2. Open: Too many errors, stop requests
3. Half-Open: Test with few requests
4. Recovery: Resume normal operation

---

Environment Variables

Override Configuration

# Set via environment
export RECONFTW_THREADS=100
export RECONFTW_OUTPUT="/custom/output"

./reconftw.sh -d example.com -r

Precedence

1. Command-line flags (highest)
2. Environment variables
3. Custom config file (-f)
4. Default reconftw.cfg (lowest)

---

Debugging

Dry Run Mode

# Preview commands without executing
./reconftw.sh -d example.com -r --dry-run

Verbose Output

# Enable debug logging
DEBUG=true ./reconftw.sh -d example.com -r

# Or in config
DEBUG=true

Log Analysis

# Check execution log
tail -f Recon/example.com/.log/reconftw.log

# Check errors
grep -i error Recon/example.com/.log/*.log

---

Next Steps

• Troubleshooting - Common issues
• Configuration - All options