# Introduction
Automated Reconnaissance Framework
GitHub • Twitter • Discord • Telegram
***
## Welcome to reconFTW
**reconFTW** is a modular reconnaissance automation framework designed for security researchers, penetration testers, and bug bounty hunters. It orchestrates 80+ security tools to perform full reconnaissance on your targets, from subdomain enumeration to vulnerability scanning.
### Why reconFTW?
| Feature | Description |
| -------------------------- | ------------------------------------------------------------------- |
| 🔄 **Automated Workflow** | Complete reconnaissance pipeline with a single command |
| 🧩 **Modular Design** | Enable/disable any module or function as needed |
| **Distributed Scanning** | Scale with [Axiom](/integrations/axiom) across cloud infrastructure |
| **Structured Output** | Organized results with multiple export formats |
| 🔧 **Highly Configurable** | 300+ configuration options for fine-tuning |
| 🔄 **Incremental Scans** | Only scan new findings since last run |
| 🤖 **AI Integration** | Generate executive reports with local AI models |
### What Can reconFTW Do?
```
┌─────────────────────────────────────────────────────────────────┐
│ reconFTW Capabilities │
├─────────────────────────────────────────────────────────────────┤
│ OSINT │ Google dorks, GitHub secrets, metadata, │
│ │ email harvesting, API leaks, cloud enum, │
│ │ leaked credentials, S3 buckets │
├──────────────────┼──────────────────────────────────────────────┤
│ Subdomains │ 10+ passive sources, DNS bruteforce, │
│ │ permutations (AI-powered), recursive enum, │
│ │ CT logs, scraping, zone transfer, takeover │
├──────────────────┼──────────────────────────────────────────────┤
│ Web Analysis │ HTTP probing, screenshots, JS secrets, │
│ │ URL extraction, directory fuzzing, CMS, │
│ │ virtual hosts, parameters, GraphQL, gRPC │
├──────────────────┼──────────────────────────────────────────────┤
│ Vulnerabilities │ Nuclei templates, XSS, SQLi, SSRF, LFI, │
│ │ SSTI, CORS, CRLF, command injection, │
│ │ prototype pollution, 403 bypass, smuggling │
├──────────────────┼──────────────────────────────────────────────┤
│ Host Analysis │ Port scanning (nmap/naabu), CDN detection, │
│ │ WAF fingerprinting, geolocation, banners │
├──────────────────┼──────────────────────────────────────────────┤
│ Automation │ Checkpoint/resume system, incremental scans, │
│ │ notifications (Slack/Discord/Telegram), │
│ │ Axiom distributed scanning, AI reports │
└─────────────────────────────────────────────────────────────────┘
```
***
## Quick Start
```bash
# Install reconFTW
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh
# Run your first scan
./reconftw.sh -d example.com -r
# Full scan with vulnerabilities
./reconftw.sh -d example.com -a
```
***
## Documentation Overview
This documentation is organized to help you get the most out of reconFTW:
### 📚 For Beginners
1. [**First 30 Minutes**](/welcome/first-30-minutes) - Quick start guide to get scanning
2. [**Getting Started**](/getting-started/getting-started) - Installation and setup
3. [**Concepts**](/understanding-reconftw/concepts) - Understanding how reconFTW works
4. [**Usage Guide**](/usage/usage) - All command-line options explained
### 🔧 For Configuration
5. [**Configuration**](/configuration/configuration) - Deep dive into reconftw\.cfg
6. [**Modules**](/modules/05-modules) - Detailed documentation for each module
7. [**Tools Reference**](/tools-reference/tools) - All 80+ integrated tools
### 📊 For Results
8. [**Output Interpretation**](/output/output) - Understanding your results
9. [**Data Model & I/O**](/guides/data-model) - Complete input/output reference
10. [**Integrations**](https://github.com/six2dez/reconftw-docs/blob/main/08-integrations/README.md) - Axiom and Faraday setup
### For Advanced Users
11. [**Deployment**](/deployment/deployment) - Docker, Terraform, VPS, CI/CD
12. [**Performance Tuning**](/guides/tuning) - Optimize for speed and target size
13. [**Case Studies**](/guides/case-studies) - Real-world usage examples
14. [**Advanced Usage**](/advanced/advanced) - Custom functions and optimization
15. [**Troubleshooting**](/help/troubleshooting) - Common issues and solutions
### ⚖️ Legal & Security
16. [**OPSEC & Legal**](/guides/opsec-legal) - Stay safe and authorized
***
## Scan Modes at a Glance
| Mode | Flag | Description | Use Case |
| -------------- | ---- | ---------------------------- | ------------------------- |
| **Recon** | `-r` | Full reconnaissance | Standard bug bounty recon |
| **Subdomains** | `-s` | Subdomain enumeration only | Quick subdomain discovery |
| **Passive** | `-p` | Passive reconnaissance | Stealth/non-intrusive |
| **All** | `-a` | Full recon + vulnerabilities | Full assessment |
| **Web** | `-w` | Web analysis only | Analyze known URLs |
| **OSINT** | `-n` | OSINT gathering only | Intelligence gathering |
| **Custom** | `-c` | Run custom function | Advanced workflows |
| **Zen** | `-z` | Minimal output mode | Clean terminal output |
***
## ⚠️ Legal & OPSEC
> **IMPORTANT**: reconFTW is designed for authorized security testing only.
### Authorization Checklist
Before running any scan, verify:
* [ ] Written permission from target owner
* [ ] Defined scope (in-scope and out-of-scope assets)
* [ ] Rate limits agreed upon
* [ ] Testing window defined (if applicable)
* [ ] Emergency contact available
* [ ] NDA signed (if required)
### OPSEC Considerations
| Risk | Mitigation |
| ----------------- | --------------------------------------- |
| **IP Blocking** | Use VPS, rotate IPs with Axiom |
| **WAF Detection** | Start with passive mode (`-p`) |
| **Rate Limiting** | Use `--adaptive-rate` flag |
| **Legal Issues** | Always have written authorization |
| **Data Exposure** | Keep `secrets.cfg` secure, never commit |
### Legal Disclaimer
By using this tool, you confirm that:
* You have explicit written permission to test the target
* You will comply with all applicable laws and regulations
* You understand that unauthorized testing is illegal
The developers assume no liability for misuse of this tool. **Use responsibly.**
➡️ [**Full OPSEC Guide**](/understanding-reconftw/concepts#opsec-and-legal)
***
## Community & Support
* **GitHub Issues**: [Report bugs or request features](https://github.com/six2dez/reconftw/issues)
* **Discord**: [Join our community](https://discord.gg/R5DdXVEdTy)
* **Telegram**: [Discussion group](https://t.me/joinchat/H5bAaw3YbzzmI5co)
* **Twitter**: [@Six2dez1](https://twitter.com/Six2dez1)
***
## Contributing
reconFTW is open source and welcomes contributions! See our [Contributing Guide](https://github.com/six2dez/reconftw/blob/main/CONTRIBUTING.md) for details.
***
Made with ❤️ by six2dez and the security community
***
# First 30 Minutes
Get from zero to your first scan results in 30 minutes or less.
***
## Minute 0-5: Install
```bash
# Clone and install
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh
```
☕ **While it installs (\~15-20 min):** Read the next sections.
***
## Minute 5-10: Understand What You're Running
### reconFTW in One Sentence
> reconFTW finds subdomains, probes them, and scans for vulnerabilities—automatically.
### Available Scan Modes
reconFTW offers multiple modes for different use cases:
| Mode | Flag | Description | Activity Level |
| -------------- | ---- | ---------------------------------------------------------------------- | -------------- |
| **Passive** | `-p` | No direct contact with target, uses only public sources | None |
| **Subdomains** | `-s` | Subdomain enumeration only | Low-Medium |
| **OSINT** | `-n` | OSINT gathering only | Low |
| **Web** | `-w` | Web analysis on known subdomains | Medium |
| **Recon** | `-r` | **Default/recommended.** Full recon + light vuln scan (nuclei on webs) | Medium-High |
| **All** | `-a` | Full recon + aggressive vulnerability scanning | **Very High** |
> ⚠️ **Important:** Even `-r` mode performs active scanning (DNS queries, HTTP requests, port scans). Always ensure you have authorization.
### About the `-a` (All) Mode
> 🔴 **WARNING:** The `-a` flag runs aggressive vulnerability testing including SQLi payloads, fuzzing, and multiple scanner tools. This generates significant traffic and may trigger security alerts. Only use when you have **explicit written authorization** for penetration testing.
### Quick Decision Tree
```
Do I have written authorization for this target?
├── No → STOP. Get permission first.
└── Yes
├── First time? → Start with -p (passive)
├── Need subdomains only? → Use -s
├── Standard recon? → Use -r (recommended)
└── Full pentest scope? → Use -a (read warning above)
```
***
## Minute 10-15: Configure API Keys (Optional but Recommended)
API keys improve results by adding more data sources. Set up at least these 3:
### 1. Shodan (Free tier available)
```bash
# Get key: https://shodan.io → Account → API Key
echo 'SHODAN_API_KEY="your_key"' >> secrets.cfg
```
### 2. GitHub Token (Free)
```bash
# Get token: GitHub → Settings → Developer settings → Personal access tokens
echo 'GITHUB_TOKEN="your_token"' >> secrets.cfg
```
### 3. SecurityTrails (Free tier)
```bash
# Get key: https://securitytrails.com/app/api
# Add to ~/.config/subfinder/provider-config.yaml
```
**No keys?** reconFTW still works, just with fewer data sources.
***
## Minute 15-20: Verify Installation
```bash
# Check all tools installed
./reconftw.sh --check-tools
# You should see green checkmarks ✓
# Red X means a tool failed - usually fixed by running install.sh again
```
### Common Issues
| Problem | Fix |
| ----------------------- | -------------------------------------- |
| `go: command not found` | `source ~/.bashrc` or restart terminal |
| Tool shows ✗ | Run `./install.sh` again |
| Permission denied | `chmod +x reconftw.sh` |
***
## Minute 20-25: Run Your First Scan
### Option A: Safe Passive Scan (Recommended First)
```bash
./reconftw.sh -d example.com -p
```
This:
* ✅ No direct contact with target
* ✅ Uses only public data sources
* ✅ Fast (\~15 minutes)
* ✅ Safe for any authorized target
### Option B: Quick Subdomain Discovery
```bash
./reconftw.sh -d example.com -s
```
This:
* ⚠️ Makes DNS queries (minimal noise)
* ✅ Finds subdomains only
* ✅ \~30 minutes
### What's Happening?
```
[sub_passive] Running: Subdomain enumeration...
→ Querying 40+ data sources
→ Certificate Transparency logs
→ DNS brute-forcing (if -s or -r)
[webprobe_simple] Running: Web probing...
→ Checking which subdomains are alive
→ Detecting technologies
```
***
## Minute 25-30: Check Your Results
### Where Are Results?
```bash
ls Recon/example.com/
```
```
Recon/example.com/
├── subdomains/
│ └── subdomains.txt ← All found subdomains
├── webs/
│ └── webs.txt ← Live web servers
├── osint/
│ └── emails.txt ← Found email addresses
└── .log/
└── reconftw.log ← Execution log
```
### Quick Results Check
```bash
# How many subdomains?
wc -l Recon/example.com/subdomains/subdomains.txt
# What's alive?
cat Recon/example.com/webs/webs.txt
# Any interesting findings?
cat Recon/example.com/osint/*.txt
```
***
## What's Next?
### If Passive Scan Looks Good → Run Full Recon
```bash
./reconftw.sh -d example.com -r
```
### If You Need Vulnerabilities → Run All
```bash
./reconftw.sh -d example.com -a
```
### If Scan Was Interrupted → Just Resume
```bash
# Run the same command again - it continues from where it stopped
./reconftw.sh -d example.com -r
```
***
## Quick Reference Card
### Essential Commands
```bash
# Passive (safe, fast)
./reconftw.sh -d target.com -p
# Recon (full discovery)
./reconftw.sh -d target.com -r
# All (recon + vulns)
./reconftw.sh -d target.com -a
# Multiple targets
./reconftw.sh -l targets.txt -r
# Resume interrupted scan
./reconftw.sh -d target.com -r # just run again
```
### Essential Locations
| What | Where |
| -------- | ---------------------- |
| Results | `Recon//` |
| Config | `reconftw.cfg` |
| API Keys | `secrets.cfg` |
| Logs | `Recon//.log/` |
### Getting Help
```bash
./reconftw.sh -h # Show help
./reconftw.sh --check-tools # Verify installation
```
***
## Common First-Timer Questions
### "It's taking forever"
Normal! Full scans take 1-8 hours. Use `-p` for quick results.
### "I got rate limited"
Add to `reconftw.cfg`:
```bash
HTTPX_RATELIMIT=50
NUCLEI_RATELIMIT=50
```
### "Results are empty"
1. Check target exists: `dig target.com`
2. Check API keys are set
3. Look at logs: `cat Recon/target.com/.log/*.log`
### "Can I stop and resume?"
Yes! Just Ctrl+C to stop, run same command to resume.
***
## 🎉 You're Ready!
You now know enough to:
* [x] Run passive reconnaissance
* [x] Find subdomains
* [x] Check results
* [x] Resume interrupted scans
**Next steps:**
* [**Full Usage Guide**](/usage/usage) - All flags explained
* [**Configuration**](/configuration/configuration) - Customize behavior
* [**OPSEC & Legal**](/guides/opsec-legal) - Stay safe and legal
# FAQ
Common questions and answers about reconFTW.
***
## General Questions
### What is reconFTW?
reconFTW is an automated reconnaissance framework that orchestrates 80+ security tools to perform full reconnaissance on targets. It's designed for bug bounty hunters, penetration testers, and security researchers.
### Is reconFTW free?
Yes, reconFTW is completely free and open source under the MIT license.
### What operating systems are supported?
* **Linux** (Ubuntu/Debian recommended) - Full support
* **macOS** - Supported with GNU tools installed via Homebrew
* **Windows** - Via WSL2 (Windows Subsystem for Linux)
### Do I need root/sudo access?
Only for the initial installation of system dependencies. Normal scans run without elevated privileges.
***
## Installation Questions
### How long does installation take?
Initial installation typically takes 15-30 minutes depending on your internet connection and system speed. Most time is spent downloading and compiling Go tools.
### Can I install on a VPS?
Yes! VPS deployment is recommended for large scans. See the [Deployment Guide](/deployment/deployment) for detailed instructions.
### Which cloud provider is best?
Any provider works. Popular choices:
* **DigitalOcean** - Simple, good pricing
* **Linode** - Good performance
* **Hetzner** - Best value in Europe
* **AWS/Azure** - Enterprise features
### How do I update reconFTW?
```bash
cd reconftw
git pull
./install.sh
```
### Tools aren't installing, what do I do?
1. Ensure Go is properly installed: `go version`
2. Check PATH includes Go bin: `echo $PATH | grep go`
3. Run installer again: `./install.sh`
4. Check specific tool: `which httpx`
***
## Usage Questions
### What scan modes are available?
reconFTW has several modes for different scenarios:
| Flag | Mode | What It Does | Use Case |
| ---- | ---------- | ------------------------------------------------------- | -------------------------- |
| `-p` | Passive | Uses only public data sources, no direct target contact | Safe first scan, stealth |
| `-s` | Subdomains | Subdomain enumeration (passive + active) | Quick subdomain discovery |
| `-n` | OSINT | OSINT gathering only (dorks, emails, leaks) | Information gathering |
| `-w` | Web | Web analysis on existing subdomains | Analyze known assets |
| `-r` | **Recon** | **Full reconnaissance + light nuclei scan** | **Default, recommended** |
| `-a` | All | Full recon + aggressive vulnerability scanning | Full pentest (see warning) |
| `-c` | Custom | Run a single specific function | Advanced users |
### What's the difference between `-r` and `-a`?
**`-r` (Recon) is the recommended default mode.** It performs:
* Full subdomain enumeration (passive + active)
* Web probing, screenshots, JS analysis
* URL collection and parameter discovery
* Light vulnerability scanning (nuclei on discovered webs/domains)
* Port scanning
> ⚠️ **Note:** `-r` mode IS active scanning. It sends HTTP requests, DNS queries, and runs nuclei templates. It generates traffic to the target.
**`-a` (All) adds aggressive vulnerability testing:**
* SQLi testing with SQLMap/Ghauri
* XSS fuzzing with Dalfox
* SSRF, LFI, SSTI, command injection checks
* Directory fuzzing
* All nuclei templates including intrusive ones
> 🔴 **WARNING:** The `-a` flag is the "YOLO mode". It sends attack payloads to the target. Only use with explicit written authorization for penetration testing. This mode may trigger WAFs, get your IP blocked, or cause service disruption.
### How do I scan multiple domains?
Create a file with one domain per line:
```bash
# targets.txt
example.com
test.com
target.org
```
Then run:
```bash
./reconftw.sh -l targets.txt -r
```
### Can I resume an interrupted scan?
Yes! Simply run the same command again. reconFTW uses checkpoints to skip completed functions.
```bash
# Scan interrupted
./reconftw.sh -d example.com -a
# Resume - just run again
./reconftw.sh -d example.com -a
# Output: [sub_passive] Already run, skipping...
```
### How do I force a full rescan?
Delete the checkpoint directory:
```bash
rm -rf Recon/example.com/.called_fn/
./reconftw.sh -d example.com -a
```
### How do I run only specific functions?
Use the `-c` flag:
```bash
./reconftw.sh -d example.com -c nuclei_check
./reconftw.sh -d example.com -c sub_passive
```
`-c` accepts a single function per run. To execute multiple functions, run separate commands.
### What does DEEP mode do?
DEEP mode runs additional, more intensive checks when the number of assets is below a threshold. It's controlled by `DEEP_LIMIT` in the config. See [Performance Tuning](/guides/tuning#understanding-deep-mode) for details.
***
## Configuration Questions
### Where is the config file?
The main configuration file is `reconftw.cfg` in the reconftw directory. See [Configuration Reference](/configuration/configuration) for all options.
### Where do I put API keys?
Create a `secrets.cfg` file (it's gitignored for security):
```bash
# secrets.cfg
SHODAN_API_KEY="your_key"
GITHUB_TOKEN="your_token"
```
### How do I change thread counts?
Edit `reconftw.cfg`:
```bash
HTTPX_THREADS=50
FFUF_THREADS=40
KATANA_THREADS=20
DALFOX_THREADS=200
RESOLVE_DOMAINS_THREADS=150
TLSX_THREADS=1000
```
For Nuclei speed, use `NUCLEI_RATELIMIT`.
### How do I use a custom wordlist?
```bash
# In reconftw.cfg
subs_wordlist="/path/to/your/wordlist.txt"
subs_wordlist_big="/path/to/your/big_wordlist.txt"
fuzz_wordlist="/path/to/your/dirs.txt"
```
### How do I exclude certain subdomains?
Create an out-of-scope file:
```bash
# outofscope.txt
blog.example.com
legacy.example.com
```
Then run:
```bash
./reconftw.sh -d example.com -r -x outofscope.txt
```
***
## Output Questions
### Where are results saved?
Results are saved in the `Recon/` directory. See [Data Model & I/O](/guides/data-model) for the complete output structure:
```
Recon/
└── example.com/
├── subdomains/
├── webs/
├── hosts/
├── osint/
└── vulns/
```
### What format are vulnerability results in?
Nuclei results are saved in JSON format in `vulns/nuclei_output/`:
* `nuclei_critical.json`
* `nuclei_high.json`
* `nuclei_medium.json`
* etc.
### How do I generate a report?
Enable AI reports:
```bash
./reconftw.sh -d example.com -a -y
```
Or manually aggregate results from the output files.
### Can I export to CSV?
Results can be converted:
```bash
cat vulns/nuclei_output/*.json | jq -r '[.host, .["template-id"], .info.severity] | @csv'
```
***
## Performance Questions
### How long does a full scan take?
Depends on target size:
* Small target (< 100 subdomains): 30-60 minutes
* Medium target (100-1000 subdomains): 2-4 hours
* Large target (1000+ subdomains): 4-12+ hours
### How do I speed up scans?
1. **Use Axiom** for distributed scanning (see [Axiom Integration](/integrations/axiom))
2. **Increase threads** in config (see [Performance Tuning](/guides/tuning))
3. **Use passive mode** (`-p`) for quick results
4. **Skip modules** you don't need
### Why is my scan slow?
Common causes:
* Large number of subdomains (normal)
* Rate limiting by target
* Slow DNS resolvers
* Limited system resources
Solutions:
* Use validated resolvers
* Reduce rate limits to avoid blocks
* Increase VPS resources
* Enable DEEP mode limits
### How much disk space do I need?
* Small scans: 1-5 GB
* Medium scans: 5-20 GB
* Large scans: 20-100+ GB
Monitor with: `du -sh Recon/example.com/`
***
## Axiom Questions
### What is Axiom?
Axiom is a tool that lets you distribute reconFTW across multiple cloud instances for faster scanning. See [Axiom Integration](/integrations/axiom) for full details.
### Do I need Axiom?
No, Axiom is optional. It's useful for:
* Very large targets
* Time-sensitive engagements
* Regular/automated scanning
### How do I enable Axiom?
1. Install Axiom: `bash <(curl -s https://raw.githubusercontent.com/pry0cc/axiom/master/interact/axiom-configure)`
2. Configure cloud provider
3. Run reconFTW with `-v` flag: `./reconftw.sh -d example.com -a -v`
### How much does Axiom cost?
Axiom itself is free. You pay for cloud instances:
* \~$0.07/hour for a 10-instance fleet
* A typical scan costs $0.15-0.50
***
## Legal Questions
### Is it legal to use reconFTW?
reconFTW is a legal tool. However, using it against targets without authorization is illegal. Always:
* Get written permission before testing
* Stay within defined scope
* Follow responsible disclosure
### Can I use it for bug bounties?
Yes! reconFTW is designed for bug bounty hunting. See [OPSEC & Legal](/guides/opsec-legal) and [Case Studies](/guides/case-studies#case-study-1-bug-bounty---new-program-launch) for detailed guidance. Always:
* Read the program's rules carefully
* Respect rate limits
* Stay in scope
* Report responsibly
### What about rate limiting and being blocked?
To avoid issues (see [OPSEC & Legal](/guides/opsec-legal#staying-under-the-radar)):
* Use reasonable rate limits
* Respect robots.txt (optional, configurable)
* Don't scan during business hours if concerned
* Use the `-p` (passive) flag for initial recon
***
## Troubleshooting
### Where can I get help?
* **GitHub Issues:**
* **Discord:**
* **Telegram:**
### How do I report a bug?
Open a GitHub issue with:
1. reconFTW version: `git rev-parse --abbrev-ref HEAD` and `git describe --tags 2>/dev/null || git rev-parse --short HEAD`
2. Operating system
3. Full error message
4. Steps to reproduce
### Where are the logs?
Logs are in the scan directory:
```bash
cat Recon/example.com/.log/reconftw.log
cat Recon/example.com/.log/errors.log
```
***
## More Questions?
If your question isn't answered here:
1. Check the [Troubleshooting Guide](/help/troubleshooting)
2. Search [GitHub Issues](https://github.com/six2dez/reconftw/issues)
3. Ask on [Discord](https://discord.gg/R5DdXVEdTy)
4. Open a new GitHub issue
# Glossary
Technical terms and concepts used throughout the reconFTW documentation.
***
## A
### Active Scanning
Reconnaissance that directly interacts with the target, such as sending HTTP requests or DNS queries. Contrast with [Passive Scanning](#passive-scanning).
### API Key
Authentication credential for accessing third-party services like Shodan, VirusTotal, or GitHub.
### ASN (Autonomous System Number)
A unique identifier for a network on the internet, useful for discovering related IP ranges.
### Asset
Any discoverable resource belonging to a target: subdomains, IPs, URLs, etc.
### Axiom
Infrastructure automation tool for distributing security tools across cloud instances. Commands use `axiom-*` naming (e.g., `axiom-fleet`, `axiom-scan`). See [Axiom Integration](/integrations/axiom).
***
## B
### Banner Grabbing
Technique to identify services by examining their response banners (e.g., SSH version, HTTP server).
### Brute Force
Technique of systematically checking all possible values (e.g., subdomain wordlist enumeration).
### Bug Bounty
Program where organizations pay security researchers for responsibly disclosed vulnerabilities.
***
## C
### CDN (Content Delivery Network)
Distributed network of servers that cache content closer to users. Examples: Cloudflare, Akamai, CloudFront.
### Certificate Transparency (CT)
Public logs of SSL/TLS certificates, useful for discovering subdomains.
### Checkpoint
Marker file indicating a function has completed, enabling scan resumption.
### CIDR (Classless Inter-Domain Routing)
Notation for IP address ranges (e.g., 192.168.1.0/24).
### CORS (Cross-Origin Resource Sharing)
Browser security mechanism that can be misconfigured, leading to data theft vulnerabilities.
### Crawler
Tool that automatically follows links to discover URLs and content on websites.
### CRLF Injection
Vulnerability where attacker injects carriage return and line feed characters to manipulate HTTP headers.
### CRT.sh
Certificate Transparency log search engine operated by Sectigo.
### CVE (Common Vulnerabilities and Exposures)
Standardized identifier for known security vulnerabilities (e.g., CVE-2021-44228).
***
## D
### Dalfox
Fast XSS (Cross-Site Scripting) vulnerability scanner.
### DEEP Mode
reconFTW mode that runs additional intensive checks when target size is below threshold.
### DNS (Domain Name System)
System that translates domain names to IP addresses.
### DNS Bruteforce
Technique of testing wordlist entries as subdomains against DNS servers.
### Dnsx
Fast DNS toolkit for resolution and record querying.
### Dork
Search query using advanced operators to find specific information (e.g., Google dorks).
***
## E
### Endpoint
Specific URL path on a web server (e.g., /api/users).
### Enumeration
Process of systematically discovering assets or information.
***
## F
### Faraday
Collaborative vulnerability management platform for organizing and reporting findings.
### Favicon
Small icon associated with a website, can be used to discover real IPs behind CDNs.
### ffuf
Fast web fuzzer for discovering directories, files, and parameters.
### Fleet
Group of cloud instances managed by Axiom for distributed scanning. See [Axiom Integration](/integrations/axiom).
### Fuzzing
Technique of sending random or semi-random data to find vulnerabilities or hidden content.
***
## G
### GAU (Get All URLs)
Tool that fetches known URLs from web archives and other sources.
### gf (grep for pentesters)
Pattern-matching tool for extracting potentially vulnerable URLs.
### GitBook
Documentation platform used to host docs.reconftw\.com.
### GitHub Dorking
Using GitHub search to find sensitive information in repositories.
### Go/Golang
Programming language used by many security tools integrated with reconFTW.
### Gowitness
Screenshot tool for capturing web page images.
***
## H
### httpx
Fast HTTP toolkit for probing web servers and extracting metadata.
### Host
Individual server or IP address.
***
## I
### Incremental Scan
Scan mode that only processes new findings since the last scan.
### In-Scope
Assets that are authorized for testing in an engagement.
### Interactsh
Out-of-band interaction detection service for finding blind vulnerabilities.
***
## J
### JavaScript Analysis
Examining JavaScript files for endpoints, secrets, and vulnerabilities.
### JSON (JavaScript Object Notation)
Data format used for structured output (e.g., Nuclei results).
### JSONL (JSON Lines)
Format with one JSON object per line, useful for streaming data.
***
## K
### Katana
Modern web crawler for URL and endpoint discovery.
***
## L
### LFI (Local File Inclusion)
Vulnerability allowing attackers to read local files from the server.
### Linkfinder
Tool for extracting endpoints from JavaScript files.
***
## M
### Massdns
High-performance DNS resolver for bulk subdomain resolution.
### Metadata
Data about data; in documents, includes author, creation date, software used.
### Module
Logical grouping of related functions in reconFTW (e.g., OSINT module, Subdomains module).
***
## N
### Nmap
Network scanner for port discovery and service detection.
### NOERROR
DNS response code indicating the domain exists (used for subdomain discovery).
### Notify
Tool for sending notifications to Slack, Discord, Telegram, etc.
### Nuclei
Template-based vulnerability scanner by ProjectDiscovery.
### Nuclei Templates
YAML files defining vulnerability checks for Nuclei.
***
## O
### OOB (Out-of-Band)
Testing technique where vulnerable application makes external callback to attacker's server.
### Open Redirect
Vulnerability where application redirects users to arbitrary URLs.
### OSINT (Open Source Intelligence)
Information gathered from publicly available sources.
### Out-of-Scope
Assets explicitly excluded from testing authorization.
***
## P
### Parameter
Query string or form field name (e.g., `?id=1` where `id` is the parameter).
### Passive Scanning
Reconnaissance using only publicly available data without direct target interaction.
### Permutation
Variation of subdomain names (e.g., dev, dev1, development).
### Port
Network endpoint for services (e.g., 80 for HTTP, 443 for HTTPS).
### Port Scanning
Discovering open ports and services on hosts.
### Prototype Pollution
JavaScript vulnerability where attacker modifies Object prototype.
### Proxy
Intermediary server for routing traffic (e.g., Burp Suite).
### Puredns
Fast DNS resolution tool with wildcard filtering.
***
## R
### Rate Limiting
Restricting request frequency to avoid overwhelming targets or being blocked.
### Recon (Reconnaissance)
Information gathering phase of security testing.
### Recursive Enumeration
Discovering subdomains of subdomains (e.g., finding x.dev.example.com).
### Resolver
DNS server that translates domain names to IP addresses.
### RFI (Remote File Inclusion)
Vulnerability allowing inclusion of remote files in server-side code.
***
## S
### Scope
Defined boundaries of what can be tested in an engagement.
### Screenshot
Image capture of web page appearance.
### Secrets
Sensitive data like API keys, passwords, or tokens.
### Shodan
Search engine for internet-connected devices.
### Smap
Shodan-based passive port scanner.
### Spider
See [Crawler](#crawler).
### SQL Injection (SQLi)
Vulnerability where attacker injects SQL commands into database queries.
### SSRF (Server-Side Request Forgery)
Vulnerability where attacker makes server perform requests to internal resources.
### SSTI (Server-Side Template Injection)
Vulnerability in template engines allowing code execution.
### Subdomain
Prefix to a domain name (e.g., `www` in `www.example.com`).
### Subdomain Takeover
Vulnerability where unclaimed subdomain can be claimed by attacker.
### Subfinder
Fast passive subdomain enumeration tool.
***
## T
### Target
Domain, IP, or organization being assessed.
### Template
Reusable definition file (e.g., Nuclei vulnerability templates).
### Thread
Concurrent execution unit; more threads = faster but more resource-intensive.
### TLS/SSL
Encryption protocols for secure communication.
### Tlsx
TLS analysis tool for certificate inspection.
### Trufflehog
Secret scanning tool for Git repositories.
***
## U
### URL (Uniform Resource Locator)
Web address (e.g., ).
### User-Agent
HTTP header identifying the client software.
***
## V
### VPS (Virtual Private Server)
Cloud-hosted virtual machine for running tools.
### Vulnerability
Security weakness that can be exploited.
***
## W
### WAF (Web Application Firewall)
Security system that filters malicious web traffic.
### Wafw00f
WAF detection and fingerprinting tool.
### Wayback Machine
Internet Archive's historical web page database.
### Wildcard
DNS configuration returning response for any subdomain query.
### Wordlist
File containing entries for brute-force testing.
***
## X
### XSS (Cross-Site Scripting)
Vulnerability allowing injection of malicious scripts into web pages.
### XXE (XML External Entity)
Vulnerability in XML parsers allowing file disclosure or SSRF.
***
## Z
### Zen Mode
reconFTW mode with minimal terminal output.
### Zone Transfer
DNS mechanism for replicating records, sometimes misconfigured to leak all subdomains.
# Installation & Setup
This guide will walk you through installing reconFTW, setting it up, and running your first reconnaissance scan.
***
## System Requirements
### Minimum Requirements
| Resource | Minimum | Recommended |
| -------------- | --------------------------------- | ---------------- |
| **OS** | Ubuntu 20.04+ / Debian 11+ / Kali | Ubuntu 22.04 LTS |
| **RAM** | 4 GB | 8-16 GB |
| **Disk Space** | 20 GB | 50+ GB |
| **CPU** | 2 cores | 4+ cores |
| **Network** | Stable internet | High bandwidth |
### Supported Operating Systems
* ✅ **Ubuntu** 20.04, 22.04, 24.04 (Recommended)
* ✅ **Debian** 11, 12
* ✅ **Kali Linux** (latest rolling)
* ✅ **Parrot OS**
* ✅ **macOS** 12+ (with Homebrew)
* ✅ **Docker** (any platform)
* ⚠️ **Windows WSL2** (experimental)
### Required Dependencies
reconFTW will install most dependencies automatically, but these base packages are required:
```bash
# Ubuntu/Debian
sudo apt update
sudo apt install -y git curl wget python3 python3-pip ruby golang jq
# macOS (via Homebrew)
brew install git curl wget python@3 ruby go jq gnu-getopt coreutils gnu-sed bash
```
***
## Installation Methods
### Method 1: Local Installation (Recommended)
This is the standard installation for Linux/macOS systems.
```bash
# Clone the repository
git clone https://github.com/six2dez/reconftw.git
cd reconftw
# Run the installer (interactive)
./install.sh
# Or run non-interactively (option 1 = install all)
echo 1 | ./install.sh
```
The installer will:
1. Check system requirements
2. Install Go, Rust, and Python dependencies
3. Install 80+ security tools
4. Configure PATH and environment variables
5. Download required wordlists and resolvers
> **⏱️ Installation Time**: 15-45 minutes depending on internet speed and system resources.
#### Installation Options
When running `./install.sh`, you'll see these options:
```
Select an option:
1. Install all dependencies and tools
2. Install only tools (skip dependencies)
3. Update tools only
4. Check tool installation status
```
### Method 2: Docker Installation
Docker provides a consistent environment across all platforms.
```bash
# Pull the official image
docker pull six2dez/reconftw:latest
# Run a scan
docker run --rm -v $(pwd)/Recon:/reconftw/Recon six2dez/reconftw:latest -d example.com -r
# Interactive mode
docker run -it --rm -v $(pwd)/Recon:/reconftw/Recon six2dez/reconftw:latest /bin/bash
```
#### Docker with Custom Configuration
```bash
# Mount your custom config
docker run --rm \
-v $(pwd)/Recon:/reconftw/Recon \
-v $(pwd)/my_config.cfg:/reconftw/reconftw.cfg \
-e SHODAN_API_KEY="your_key" \
six2dez/reconftw:latest -d example.com -r
```
#### Building Custom Docker Image
```bash
cd reconftw/Docker
docker build -t my-reconftw .
```
### Method 3: Terraform + Ansible (Cloud Deployment)
For deploying reconFTW on AWS or other cloud providers:
```bash
cd reconftw/Terraform
# Configure your AWS credentials
export AWS_ACCESS_KEY_ID="your_key"
export AWS_SECRET_ACCESS_KEY="your_secret"
# Deploy infrastructure
terraform init
terraform apply
# Run Ansible playbook
ansible-playbook -i inventory reconFTW.yml
```
See [Deployment Guide](/deployment/deployment) for detailed cloud setup.
***
## macOS-Specific Setup
macOS requires additional Homebrew packages due to BSD tool differences:
```bash
# Install Homebrew if not installed
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
# Install required formulae
brew install bash coreutils gnu-sed gnu-getopt findutils grep
# Use Homebrew's bash (required for reconFTW)
# reconFTW will automatically use /opt/homebrew/bin/bash on Apple Silicon
```
> **Note**: reconFTW automatically detects macOS and uses Homebrew GNU tools. Make sure they're installed before running.
***
## Your First Scan
### Basic Reconnaissance Scan
```bash
cd reconftw
# Standard reconnaissance
./reconftw.sh -d example.com -r
```
This will:
1. Enumerate subdomains (passive + active)
2. Probe for live web servers
3. Take screenshots
4. Extract URLs and JavaScript files
5. Run nuclei vulnerability scans
6. Generate organized output
### Understanding the Output
Results are saved in `Recon//`:
```
Recon/example.com/
├── subdomains/ # Discovered subdomains
│ ├── subdomains.txt # Final subdomain list
│ └── ...
├── webs/ # Web server information
│ ├── webs.txt # Live web servers
│ └── ...
├── hosts/ # Host/IP information
├── vulns/ # Vulnerability findings
├── osint/ # OSINT results
├── screenshots/ # Web screenshots
├── nuclei_output/ # Nuclei scan results
├── .log/ # Scan logs
└── .tmp/ # Temporary files
```
### Quick Scan Examples
```bash
# Subdomain enumeration only (fast)
./reconftw.sh -d example.com -s
# Passive reconnaissance (non-intrusive)
./reconftw.sh -d example.com -p
# Full scan with vulnerability checks
./reconftw.sh -d example.com -a
# Scan from a list of domains
./reconftw.sh -l targets.txt -r
# Custom output directory
./reconftw.sh -d example.com -r -o /path/to/output
```
***
## Verifying Installation
### Check Tools Installation
```bash
# Verify all tools are installed
./reconftw.sh --check-tools
```
This displays a checklist of all required tools and their installation status.
### Health Check
```bash
# Run system health check
./reconftw.sh --health-check
```
The health check verifies:
* All critical dependencies are installed
* Required files and directories exist
* Configuration is valid
* Network connectivity works
### Dry Run Mode
Test your command without executing anything:
```bash
# Preview what commands would be executed
./reconftw.sh -d example.com -r --dry-run
```
***
## Updating reconFTW
### Update Everything
```bash
cd reconftw
# Pull latest code
git pull
# Update all tools
./install.sh --tools
```
### Update Only Tools
```bash
./install.sh --tools
# Or use option 3 in interactive mode
```
### Automatic Updates Before Scans
Enable in `reconftw.cfg`:
```bash
upgrade_before_running=true
```
***
## Post-Installation Configuration
After installation, you should configure API keys for maximum effectiveness:
### 1. Create secrets.cfg
```bash
cp secrets.cfg.example secrets.cfg
chmod 600 secrets.cfg
```
Edit `secrets.cfg`:
```bash
# API keys for enhanced functionality
SHODAN_API_KEY="your_shodan_api_key"
WHOISXML_API="your_whoisxml_api_key"
XSS_SERVER="your_xss_hunter_server"
COLLAB_SERVER="your_interactsh_server"
```
### 2. Configure GitHub Tokens
Create `$HOME/Tools/.github_tokens` with one token per line:
```
ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ghp_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
```
Multiple tokens help avoid rate limiting during GitHub reconnaissance.
### 3. Verify Configuration
```bash
# Test with a simple scan
./reconftw.sh -d example.com -p --dry-run
```
***
## Common Installation Issues
### "Go not found"
```bash
# Install Go manually
wget https://go.dev/dl/go1.21.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.21.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
export GOPATH=$HOME/go
export PATH=$PATH:$GOPATH/bin
```
### "Permission denied"
```bash
# Fix permissions
chmod +x reconftw.sh install.sh
```
### "Tool X not found"
```bash
# Reinstall specific tools
./install.sh --tools
```
See [Troubleshooting](/help/troubleshooting) for more solutions.
***
## Next Steps
Now that reconFTW is installed:
1. [**Learn the concepts**](/understanding-reconftw/concepts) - Understand how reconFTW works
2. [**Explore usage options**](/usage/usage) - Master command-line flags
3. [**Configure settings**](/configuration/configuration) - Customize for your needs
4. [**Understand output**](/output/output) - Interpret your results
***
## Quick Reference Card
```bash
# Installation
git clone https://github.com/six2dez/reconftw.git && cd reconftw && ./install.sh
# Basic scans
./reconftw.sh -d target.com -r # Full recon
./reconftw.sh -d target.com -s # Subdomains only
./reconftw.sh -d target.com -p # Passive only
./reconftw.sh -d target.com -a # Full + vulns
# Advanced options
./reconftw.sh -d target.com -r --deep # Deep/thorough scan
./reconftw.sh -d target.com -r -v # With Axiom (distributed)
./reconftw.sh -l targets.txt -r # Multiple targets
# Maintenance
./reconftw.sh --check-tools # Verify installation
./reconftw.sh --health-check # System health
./install.sh --tools # Update tools
```
# Concepts & Architecture
This guide explains the fundamental concepts behind reconFTW, its architecture, and how it orchestrates reconnaissance workflows.
***
## What is reconFTW?
reconFTW is a **modular reconnaissance automation framework** that integrates 80+ security tools into a unified workflow. Rather than running tools individually and correlating results manually, reconFTW:
1. **Orchestrates** tools in the optimal order
2. **Manages** input/output between tools automatically
3. **Deduplicates** and normalizes results
4. **Resumes** interrupted scans from checkpoints
5. **Scales** across distributed infrastructure (via Axiom)
### Philosophy
reconFTW follows these design principles:
* **Thorough over fast**: Cover all attack surface, don't miss findings
* **Modular**: Enable/disable any component without breaking others
* **Resumable**: Never lose progress on long-running scans
* **Configurable**: Every behavior can be customized
* **Fail-soft**: Continue scanning even if individual tools fail
***
## Reconnaissance Methodology
reconFTW implements a structured reconnaissance methodology following industry best practices:
```
┌─────────────────────────────────────────────────────────────────────┐
│ reconFTW Reconnaissance Phases │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ OSINT │───▶│ Subdomain│───▶│ Web │───▶│ Vulns │ │
│ │ Gathering│ │ Enum │ │ Analysis │ │ Scanning │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
│ │ │ │ │ │
│ ▼ ▼ ▼ ▼ │
│ • Dorks • Passive • Probing • Nuclei │
│ • Emails • Active • Screenshots • XSS/SQLi │
│ • Metadata • Bruteforce • Fuzzing • SSRF/LFI │
│ • API leaks • Permutations • JS Analysis • Misconfigs │
│ • GitHub • Takeovers • CMS detect • SSL/TLS │
│ │
└─────────────────────────────────────────────────────────────────────┘
```
### Phase 1: OSINT (Open Source Intelligence)
Gather publicly available information about the target:
| Technique | Purpose | Tools |
| ---------------- | ------------------------- | ------------------------ |
| Google Dorks | Find exposed files/pages | dorks\_hunter |
| GitHub Dorks | Find leaked credentials | gitdorks\_go |
| Metadata | Extract document metadata | metagoofil, exiftool |
| Email Harvesting | Discover email addresses | emailfinder |
| API Leaks | Find exposed APIs | porch-pirate, SwaggerSpy |
| Domain Info | WHOIS, registrant data | whois, msftrecon |
### Phase 2: Subdomain Enumeration
Discover all subdomains associated with the target:
| Technique | Type | Description |
| ----------------- | ------------- | ---------------------------------- |
| Passive | Non-intrusive | Query APIs, CT logs, archives |
| Active/Bruteforce | Intrusive | DNS queries with wordlists |
| Permutations | Intrusive | Generate variations |
| Recursive | Both | Enumerate subdomains of subdomains |
| Scraping | Semi-passive | Extract from web pages |
### Phase 3: Web Analysis
Analyze discovered web assets:
* HTTP probing (find live servers)
* Screenshot capture
* URL extraction (passive + crawling)
* JavaScript analysis (secrets, endpoints)
* Directory fuzzing
* CMS detection
* Parameter discovery
### Phase 4: Vulnerability Scanning
Test for security issues:
* CVE scanning with Nuclei
* Injection testing (XSS, SQLi, SSTI, LFI)
* Server-side vulnerabilities (SSRF, command injection)
* Misconfigurations (CORS, open redirect)
* SSL/TLS issues
* Subdomain takeovers
***
## Architecture Overview
reconFTW uses a modular architecture where components are separated by responsibility:
```
reconftw/
├── reconftw.sh # Main entry point (orchestration)
├── reconftw.cfg # Configuration file
├── secrets.cfg # API keys (gitignored)
│
├── modules/ # Feature modules (what to do)
│ ├── utils.sh # Utility functions
│ ├── core.sh # Framework core (logging, lifecycle)
│ ├── osint.sh # OSINT functions
│ ├── subdomains.sh # Subdomain enumeration
│ ├── web.sh # Web analysis
│ ├── vulns.sh # Vulnerability scanning
│ ├── axiom.sh # Distributed scanning
│ └── modes.sh # Scan mode orchestration
│
├── lib/ # Pure libraries (how to do it)
│ ├── common.sh # Shared utility functions (dedupe, ensure_dirs)
│ ├── config.sh # Configuration helpers
│ ├── parallel.sh # Parallelization framework
│ └── validation.sh # Input validation
│
└── Recon/ # Output directory
└── / # Per-target results
```
### Module Loading Order
Modules are loaded in a specific order to ensure dependencies are satisfied:
```bash
1. lib/validation.sh # Input validation (first)
2. lib/common.sh # Shared utilities (ensure_dirs, dedupe, etc.)
3. lib/parallel.sh # Parallelization framework
4. modules/utils.sh # Base utilities
5. modules/core.sh # Framework infrastructure
6. modules/osint.sh # OSINT functions
7. modules/subdomains.sh # Subdomain functions
8. modules/web.sh # Web analysis functions
9. modules/vulns.sh # Vulnerability functions
10. modules/axiom.sh # Distributed scanning
11. modules/modes.sh # Mode orchestration (last)
```
### Key Functions
#### Lifecycle Functions (core.sh)
```bash
start_func(name, description) # Begin a function, check if already done
end_func(message, name) # Complete a function, mark as done
```
Every scan function follows this pattern:
```bash
function some_scan() {
if [[ ! -f "$called_fn_dir/.${FUNCNAME[0]}" ]] || [[ $DIFF == true ]]; then
start_func "${FUNCNAME[0]}" "Running some scan..."
# ... actual scan logic ...
end_func "Results saved in..." "${FUNCNAME[0]}"
fi
}
```
#### Utility Functions (utils.sh)
| Function | Purpose |
| ---------------------- | ---------------------------------------- |
| `sanitize_domain()` | Clean and validate domain input |
| `sanitize_ip()` | Clean and validate IP/CIDR input |
| `deleteOutScoped()` | Remove out-of-scope entries |
| `run_command()` | Execute with logging (respects DRY\_RUN) |
| `should_run_deep()` | Check if DEEP mode should activate |
| `retry_with_backoff()` | Retry failed operations |
| `check_disk_space()` | Verify available storage |
#### Common Library Functions (lib/common.sh)
| Function | Purpose |
| ----------------------- | ----------------------------------------------- |
| `ensure_dirs()` | Create multiple directories safely |
| `safe_backup()` | Backup file with timestamp |
| `skip_notification()` | Log skipped function notification |
| `count_lines()` | Count lines in file safely |
| `safe_count()` | Count with fallback to 0 |
| `dedupe_append()` | Append and deduplicate file |
| `run_tool()` | Execute tool with timeout and error handling |
| `process_results()` | Process and dedupe results |
| `should_run_function()` | Check if function should run (checkpoint aware) |
#### Parallelization Functions (lib/parallel.sh)
| Function | Purpose |
| ---------------------------- | -------------------------------------------- |
| `parallel_run()` | Run commands in parallel with job limit |
| `parallel_funcs()` | Run bash functions in parallel |
| `parallel_batch()` | Run commands with rate limiting |
| `parallel_passive_enum()` | Parallel passive subdomain enumeration |
| `parallel_active_enum()` | Parallel active DNS enumeration |
| `parallel_postactive_enum()` | Parallel post-resolution (TLS, analytics) |
| `parallel_brute_enum()` | Parallel brute force (resource limited) |
| `parallel_web_vulns()` | Parallel web vulnerability scanning |
| `parallel_subdomains_full()` | Orchestrate full parallelized subdomain enum |
***
## Data Flow
Understanding how data flows through reconFTW helps interpret results:
```
┌─────────────────────────────────────┐
│ USER INPUT │
│ -d domain.com / -l targets.txt │
└─────────────────┬───────────────────┘
│
▼
┌─────────────────────────────────────┐
│ INPUT SANITIZATION │
│ • Validate domain/IP format │
│ • Remove dangerous characters │
│ • Normalize case │
└─────────────────┬───────────────────┘
│
▼
┌─────────────────────────────────────┐
│ DIRECTORY SETUP │
│ Recon// │
│ ├── subdomains/ │
│ ├── webs/ │
│ ├── hosts/ │
│ ├── vulns/ │
│ ├── osint/ │
│ ├── .tmp/ │
│ └── .log/ │
└─────────────────┬───────────────────┘
│
┌────────────────────────┼────────────────────────┐
│ │ │
▼ ▼ ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ OSINT │ │ SUBDOMAINS │ │ WEB │
│ (osint.sh) │ │ (subdomains.sh) │ │ (web.sh) │
└────────┬─────────┘ └────────┬─────────┘ └────────┬─────────┘
│ │ │
▼ ▼ ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐
│ osint/*.txt │───▶│subdomains/*.txt │───▶│ webs/*.txt │
└──────────────────┘ └────────┬─────────┘ └────────┬─────────┘
│ │
│ │
▼ ▼
┌──────────────────┐ ┌──────────────────┐
│ HOSTS ANALYSIS │ │ VULN SCANNING │
│ (hosts/) │ │ (vulns.sh) │
└──────────────────┘ └────────┬─────────┘
│
▼
┌──────────────────┐
│ FINAL OUTPUT │
│ • vulns/ │
│ • nuclei_output/│
│ • hotlist.txt │
└──────────────────┘
```
### Data Dependencies
| Module | Depends On | Produces |
| -------------- | -------------- | ------------------------------- |
| OSINT | Target domain | osint/\*.txt |
| Subdomains | Target domain | subdomains/subdomains.txt |
| Hosts | subdomains.txt | hosts/ips.txt, hosts/portscan\* |
| Web Probing | subdomains.txt | webs/webs.txt |
| URL Collection | webs.txt | webs/url\_extract.txt |
| JS Analysis | webs.txt | js/js\_secrets.txt |
| Vulns | webs.txt, urls | vulns/*, nuclei\_output/* |
***
## Scan Phases
When you run `./reconftw.sh -d target.com -r`, the following phases execute:
### 1. Initialization (`start()`)
```
[start] → Validate config → Check disk space → Create directories → Initialize logging
```
### 2. OSINT Phase
```
[osint] → domain_info → emails → google_dorks → github_repos → metadata → apileaks
```
### 3. Subdomain Phase
```
[subdomains] → sub_passive → sub_crt → sub_brute → sub_permut → sub_scraping → sub_dns
```
### 4. Host Analysis
```
[hosts] → portscan → cdnprovider → waf_checks → favicon → geo_info
```
### 5. Web Analysis
```
[web] → webprobe → screenshot → urlchecks → jschecks → fuzz → cms_scanner
```
### 6. Vulnerability Phase (if `-a` flag)
```
[vulns] → nuclei → xss → sqli → ssrf → cors → lfi → ssti → ...
```
### 7. Finalization (`end()`)
```
[end] → Build hotlist → Generate reports → Send notifications → Cleanup
```
***
## Checkpoint System
reconFTW uses a checkpoint system to track completed functions and enable scan resumption.
### How It Works
Each function creates a marker file when completed:
```
Recon//.called_fn/
├── .sub_passive # sub_passive() completed
├── .sub_brute # sub_brute() completed
├── .webprobe_simple # webprobe_simple() completed
└── ...
```
### Resume Behavior
When you re-run a scan:
1. reconFTW checks for existing `.called_fn` markers
2. Functions with markers are **skipped**
3. Functions without markers are **executed**
```bash
# First run - executes all functions
./reconftw.sh -d target.com -r
# Second run - skips completed functions
./reconftw.sh -d target.com -r
# Output: "sub_passive has already been processed..."
```
### Force Re-execution
To re-run a specific function:
```bash
# Delete the marker
rm Recon/target.com/.called_fn/.sub_passive
# Or delete all markers (full rescan)
rm -rf Recon/target.com/.called_fn/
```
### DIFF Mode
The `-r` flag with `DIFF=true` in config enables differential scanning:
```bash
# Config setting
DIFF=true
```
In DIFF mode:
* All functions execute regardless of markers
* Only **new** findings are highlighted
* Previous results are preserved
***
## Understanding DEEP Mode
DEEP mode enables thorough scanning for high-value targets:
### Standard vs DEEP
| Aspect | Standard | DEEP |
| --------------- | ------------- | --------------- |
| Wordlists | Small (\~10k) | Large (\~100k+) |
| Permutations | Basic | Extensive |
| Recursive depth | Limited | Full |
| Fuzzing | Common paths | Extended |
| Time | 1-4 hours | 4-24+ hours |
### Activation
```bash
# Command line
./reconftw.sh -d target.com -r --deep
# Or in config
DEEP=true
```
### Auto-DEEP
reconFTW can auto-enable DEEP based on result counts:
```bash
# In reconftw.cfg
DEEP_LIMIT=500 # First threshold
DEEP_LIMIT2=1500 # Second threshold
```
If subdomains < DEEP\_LIMIT, additional enumeration runs automatically.
***
## Error Handling
reconFTW uses a "fail-soft" approach:
### Error Codes
| Code | Meaning |
| ---- | ------------------- |
| 0 | Success |
| 1 | General error |
| 2 | Missing dependency |
| 3 | Invalid input |
| 4 | Network error |
| 5 | Disk space error |
| 6 | Permission error |
| 7 | Timeout |
| 8 | Configuration error |
### Error Trapping
Errors are logged but don't stop the scan:
```bash
# From reconftw.sh
trap 'rc=$?; ... echo "$msg" >>"$LOGFILE" ...' ERR
```
### Circuit Breaker
For unreliable tools, reconFTW implements a circuit breaker:
```bash
# After 3 consecutive failures, tool is skipped
CIRCUIT_BREAKER_THRESHOLD=3
CIRCUIT_BREAKER_TIMEOUT=300 # Reset after 5 minutes
```
***
## Global Variables
Key variables used throughout reconFTW:
### Required Variables
| Variable | Description |
| ---------------- | --------------------------------- |
| `$SCRIPTPATH` | Path to reconFTW installation |
| `$domain` | Current target domain |
| `$dir` | Output directory for current scan |
| `$called_fn_dir` | Directory for checkpoint markers |
| `$LOGFILE` | Current log file path |
### Configuration Flags
| Variable | Default | Description |
| ---------- | ------- | ------------------------- |
| `$DEEP` | false | Enable thorough scanning |
| `$DIFF` | false | Differential mode |
| `$AXIOM` | false | Distributed scanning |
| `$DRY_RUN` | false | Preview without executing |
***
## Visual: Architecture Diagram
```
┌─────────────────────────────────────┐
│ CONFIGURATION │
│ reconftw.cfg │ secrets.cfg │
│ ───────────────────────────────── │
│ • API keys • Module toggles │
│ • Wordlists • Rate limits │
└───────────────────┬─────────────────┘
│
▼
┌────────────────────┐ ┌─────────────────────────────────────────────────────┐
│ INPUT │ │ reconftw.sh │
│ ──────────────── │────────▶│ (Main Orchestrator) │
│ -d domain.com │ │ ─────────────────────────────────────────────── │
│ -l targets.txt │ │ • Argument parsing • Module loading │
│ -m multi.txt │ │ • Checkpoint system • Notification hooks │
└────────────────────┘ └────────────────────────┬────────────────────────────┘
│
┌──────────────────────────────────┼──────────────────────────────────┐
│ │ │
▼ ▼ ▼
┌────────────────────┐ ┌────────────────────┐ ┌────────────────────┐
│ lib/ │ │ modules/ │ │ config/ │
│ ──────────────── │ │ ──────────────── │ │ ──────────────── │
│ common.sh │ │ osint.sh │ │ amass_config.ini │
│ parallel.sh │ │ subdomains.sh │ │ nuclei_config.yml │
│ validation.sh │ │ web.sh │ │ sensitive_domains │
│ │ │ vulns.sh │ │ ... │
│ Utilities for: │ │ core.sh │ │ │
│ • Parallelization │ │ modes.sh │ │ Tool configs │
│ • Error handling │ │ axiom.sh │ │ Wordlists paths │
│ • File operations │ │ utils.sh │ │ │
└────────────────────┘ └─────────┬──────────┘ └────────────────────┘
│
┌──────────────────────────────┴──────────────────────────────┐
│ SCAN PHASES │
│ ────────────────────────────────────────────────────────── │
│ │
│ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ │
│ │ 1.OSINT │──▶│ 2.SUBS │──▶│ 3.WEB │──▶│ 4.VULNS │ │
│ │(passive)│ │(active) │ │(probe) │ │(exploit)│ │
│ └─────────┘ └─────────┘ └─────────┘ └─────────┘ │
│ │
│ Data flows from each phase to the next │
└──────────────────────────────┬──────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────┐
│ OUTPUT STRUCTURE │
│ Recon// │
│ ───────────────────────────────────────────── │
│ ├── subdomains/ (discovered subs) │
│ ├── webs/ (live web URLs) │
│ ├── hosts/ (IP data, ports) │
│ ├── vulns/ (vulnerability results) │
│ ├── osint/ (passive intel) │
│ ├── screenshots/ (web captures) │
│ ├── .called_fn/ (checkpoint markers) │
│ └── .log/ (execution logs) │
└─────────────────────────────────────────────────┘
│
┌──────────────────────────────┴──────────────────────────────┐
│ OPTIONAL: AXIOM │
▼ │
┌────────────────────────────────────────────────────────────────┐ │
│ Distributed Execution │ │
│ ──────────────────────────────────────────────────────────── │ │
│ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ │ │
│ │ node01 │ │ node02 │ │ node03 │ │ node04 │ │ node05 │ │◀───────┘
│ └────────┘ └────────┘ └────────┘ └────────┘ └────────┘ │
│ │
│ Splits workload across cloud instances for faster scanning │
└────────────────────────────────────────────────────────────────┘
```
### Module Interaction Flow
```
┌─────────────────────────────────────────────────────────────────────────────┐
│ DETAILED DATA FLOW │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ INPUT: domain.com │
│ │ │
│ ▼ │
│ ┌──────────────┐ │
│ │ OSINT │──▶ osint/emails.txt, osint/dorks.txt │
│ │ (passive) │ osint/github_secrets.json │
│ └──────┬───────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ Passive: subfinder, amass, crt.sh │
│ │ SUBDOMAINS │──▶ Active: puredns, massdns │
│ │ (enum) │ Output: subdomains/subdomains.txt │
│ └──────┬───────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ │
│ │ WEB PROBE │──▶ webs/webs.txt (live HTTP/HTTPS URLs) │
│ │ (httpx) │ webs/webs_info.txt (titles, status, tech) │
│ └──────┬───────┘ │
│ │ │
│ ├───────────────────────┬───────────────────────┐ │
│ ▼ ▼ ▼ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │
│ │ URL CHECK │ │ JS CHECKS │ │ SCREENSHOTS │ │
│ │ (katana) │ │ (xnlink) │ │ (nuclei) │ │
│ └──────┬───────┘ └──────┬───────┘ └──────────────┘ │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ gf patterns │ │ JS secrets │ │
│ │ (params) │ │ (API keys) │ │
│ └──────┬───────┘ └──────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────────────────────────────────────────────────────────┐ │
│ │ VULNERABILITY SCANNING │ │
│ │ ───────────────────────────────────────────────────────────── │ │
│ │ nuclei (CVEs) │ dalfox (XSS) │ sqlmap (SQLi) │ ffuf (fuzz)│ │
│ │ cors │ ssrf │ lfi │ ssti │ │
│ └──────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ vulns/nuclei_output/, vulns/xss.txt, vulns/sqli.txt, etc. │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
```
***
## OPSEC and Legal
### Authorization Requirements
**NEVER scan without explicit written authorization.** This includes:
1. **Bug Bounty Programs**: Read rules carefully, some exclude certain asset types
2. **Penetration Tests**: Written statement of work (SOW) with defined scope
3. **Internal Testing**: Formal approval from asset owners
4. **Personal Projects**: Only test assets you own
### Pre-Scan Checklist
```markdown
## Authorization Checklist
- [ ] Written permission obtained (email, contract, bug bounty policy)
- [ ] Scope document reviewed
- [ ] In-scope targets identified
- [ ] Out-of-scope targets documented
- [ ] Rate limits defined (if any)
- [ ] Testing window confirmed
- [ ] Emergency contact identified
- [ ] Data handling requirements understood
- [ ] NDA signed (if required)
```
### OPSEC Best Practices
| Consideration | Recommendation |
| ------------------- | ------------------------------------------------ |
| **IP Attribution** | Use VPS or cloud instances, not personal IP |
| **Rate Limiting** | Start conservative, increase gradually |
| **Noise Reduction** | Begin with passive mode (`-p`) |
| **Data Security** | Encrypt sensitive findings, secure `secrets.cfg` |
| **Logging** | Keep records of authorization and scan times |
| **Communication** | Notify target of critical findings immediately |
### Reducing Detection Risk
```bash
# Start with passive reconnaissance (no direct contact)
./reconftw.sh -d target.com -p
# Use adaptive rate limiting
./reconftw.sh -d target.com -r --adaptive-rate
# Lower rate limits in config
# In reconftw.cfg
HTTPX_RATELIMIT=50
NUCLEI_RATELIMIT=50
```
### Legal Risks by Region
| Region | Key Laws | Notes |
| ---------- | ----------------------------- | ---------------------------------------------- |
| **USA** | CFAA | Unauthorized access is federal crime |
| **EU** | Computer Misuse Acts (varies) | Strict consent requirements |
| **UK** | Computer Misuse Act 1990 | Even attempting unauthorized access is illegal |
| **Global** | Various | Always research local laws |
### What to Do If Something Goes Wrong
1. **Stop scanning immediately**
2. **Document what happened** (timestamps, commands run)
3. **Contact the target** via emergency channels
4. **Preserve evidence** of authorization
5. **Consult legal counsel** if needed
***
## Recommended Workflows
### Bug Bounty - Standard Recon
Best for: Regular bug bounty hunting on established programs.
```bash
# Week 1: Initial passive recon
./reconftw.sh -d target.com -p
# Week 1: Full reconnaissance (if passive looks good)
./reconftw.sh -d target.com -r
# Week 2+: Incremental updates
./reconftw.sh -d target.com -r --incremental
```
### Bug Bounty - New Program
Best for: New programs where you want full coverage quickly.
```bash
# Full scan with vulnerabilities
./reconftw.sh -d target.com -a
# Enable notifications
# In reconftw.cfg: NOTIFICATION=true
# Check results
ls -la Recon/target.com/vulns/
```
### Large Scope / Multiple Targets
Best for: Programs with many root domains or large scope.
```bash
# Create scope file
cat > scope.txt << EOF
target1.com
target2.com
*.target3.com
EOF
# Use Axiom for distributed scanning
./reconftw.sh -l scope.txt -r -v
# Or run sequentially with multi-mode
./reconftw.sh -m client-project -l scope.txt -r
```
### Red Team / Pentest
Best for: Authorized penetration tests with defined scope.
```bash
# Start passive (intelligence gathering)
./reconftw.sh -d target.com -n # OSINT only
# Then subdomains
./reconftw.sh -d target.com -s
# Finally, careful active scanning
./reconftw.sh -d target.com -a -q 50 # Rate limited
```
### Automated Weekly Monitoring
Best for: Continuous monitoring of assets.
```bash
# Cron job (every Sunday at 2 AM)
0 2 * * 0 cd /path/to/reconftw && ./reconftw.sh -d target.com -r --incremental -z
# Or use Docker
0 2 * * 0 docker run -v /data/recon:/reconftw/Recon six2dez/reconftw -d target.com -r --incremental
```
### Quick Assessment
Best for: Rapid initial assessment before deeper testing.
```bash
# Passive only (fastest, safest)
./reconftw.sh -d target.com -p
# Time: ~15-30 minutes
# Output: subdomains, basic OSINT, no active scanning
```
### CI/CD Integration
Best for: Automated security checks in pipelines.
```yaml
# GitHub Actions example
- name: Security Recon
run: |
./reconftw.sh -d ${{ secrets.TARGET }} -p -z
- name: Check Critical Vulns
run: |
if [ -s Recon/*/vulns/nuclei_critical.json ]; then
echo "Critical vulnerabilities found!"
exit 1
fi
```
***
## Next Steps
Now that you understand how reconFTW works:
1. [**Learn the command line options**](/usage/usage) - Master all flags
2. [**Configure your setup**](/configuration/configuration) - Customize behavior
3. [**Explore modules in depth**](/modules/05-modules) - Understand each capability
# Reconnaissance Methodology Deep Dive
This guide explains the reasoning behind reconFTW's reconnaissance approach.
***
## Why This Order?
reconFTW executes modules in a specific sequence based on data dependencies and resource efficiency.
### 1. OSINT First
**Functions:** `google_dorks`, `github_dorks`, `metadata`, `emails`, `domain_info`
**Why first:**
* Zero target interaction (completely passive)
* Provides context for later phases
* May reveal additional scope (related domains, acquisitions)
* Fast execution with no rate limiting concerns
**What it reveals:**
* Exposed files via search engines
* Leaked credentials in code repositories
* Document metadata (usernames, software versions)
* Email patterns for social engineering
* Domain registration history
### 2. Subdomain Enumeration Second
**Functions:** `sub_passive`, `sub_crt`, `sub_active`, `sub_brute`, `sub_permut`
**Why second:**
* Defines the attack surface
* Required input for all subsequent phases
* Passive sources first (no detection), active later
**Data flow:**
```
Passive sources → Merge → Resolve → Filter wildcards → Active enum
↓
subdomains/subdomains.txt
```
### 3. Web Probing Third
**Functions:** `webprobe_simple`, `webprobe_full`
**Why third:**
* Requires subdomain list as input
* Identifies HTTP/HTTPS services
* Filters to only web-accessible hosts
**Output:** `webs/webs.txt` - URLs of live web services
### 4. Host Analysis Fourth
**Functions:** `portscan`, `cdnprovider`, `favicon`, `geo_info`
**Why fourth:**
* Operates on resolved IPs
* Identifies services beyond HTTP
* CDN detection affects later scanning decisions
### 5. Web Analysis Fifth
**Functions:** `urlchecks`, `jschecks`, `fuzz`, `cms_scanner`
**Why fifth:**
* Requires live web URLs
* Discovers endpoints for vulnerability testing
* JavaScript analysis reveals API endpoints
### 6. Vulnerability Scanning Last
**Functions:** `nuclei_check`, `xss`, `sqli`, `ssrf_checks`
**Why last:**
* Most intrusive phase
* Requires discovered URLs and parameters
* Generates alerts/logs on target systems
***
## Passive vs Active
### Passive Reconnaissance
Operations that do NOT directly contact the target.
| Technique | Data Source | Detection Risk |
| ---------------------- | -------------------------- | -------------- |
| CT log queries | crt.sh, Censys | None |
| DNS database queries | SecurityTrails, VirusTotal | None |
| Search engine dorks | Google, Bing | None |
| Code repository search | GitHub, GitLab | None |
| WHOIS lookups | WHOIS servers | None |
**reconFTW passive mode:** `./reconftw.sh -d target.com -p`
### Active Reconnaissance
Operations that directly interact with target systems.
| Technique | Target Contact | Detection Risk |
| ---------------------- | ------------------- | -------------- |
| DNS resolution | Target DNS servers | Low |
| HTTP probing | Target web servers | Medium |
| Port scanning | Target hosts | High |
| Directory fuzzing | Target web servers | High |
| Vulnerability scanning | Target applications | High |
***
## The Checkpoint System
reconFTW tracks completed functions to enable resumption.
### How It Works
Each function creates a marker file on completion:
```
Recon/target.com/.called_fn/
├── .sub_passive # sub_passive() completed
├── .sub_crt # sub_crt() completed
├── .webprobe_simple # webprobe_simple() completed
└── ...
```
### Resume Behavior
On subsequent runs:
1. Check if marker exists for function
2. If exists and `DIFF=false` → Skip function
3. If missing or `DIFF=true` → Execute function
### Clearing Checkpoints
```bash
# Re-run single function
rm Recon/target.com/.called_fn/.sub_passive
# Re-run all
rm -rf Recon/target.com/.called_fn/
```
***
## Wildcard Handling
Wildcard DNS records return valid responses for any subdomain query.
### The Problem
```
*.example.com → 1.2.3.4
Query: randomstring.example.com
Result: 1.2.3.4 (valid response)
```
Without filtering, bruteforce returns millions of false positives.
### Standard Detection
Query random string, if resolves → wildcard exists at root level.
### Deep Detection (DEEP\_WILDCARD\_FILTER)
Enterprises use nested wildcards:
```
*.api.example.com → 1.2.3.4
*.na45.salesforce.com → 5.6.7.8
```
Deep detection iteratively tests parent domains at all levels.
***
## Rate Limiting Strategy
### Why Rate Limit?
* Avoid overwhelming target infrastructure
* Prevent IP blocks and WAF bans
* Stay within API quotas
* Reduce detection risk
### Configuration
```bash
# Global rate limit
./reconftw.sh -d target.com -r -q 50 # 50 requests/second
# Per-tool limits
HTTPX_RATELIMIT=50
NUCLEI_RATELIMIT=150
FFUF_RATELIMIT=50
```
### Adaptive Rate Limiting
```bash
./reconftw.sh -d target.com -r --adaptive-rate
```
Automatically reduces rate on:
* HTTP 429 (Too Many Requests)
* HTTP 503 (Service Unavailable)
* Connection timeouts
***
## Scope Management
### In-Scope Filtering
```bash
# inscope.txt
*.example.com
api.example.com
staging.example.com
```
Enable: `INSCOPE=true`
### Out-of-Scope Exclusion
```bash
# outofscope.txt
admin.example.com
vpn.example.com
*.internal.example.com
```
Usage: `./reconftw.sh -d example.com -r -x outofscope.txt`
### Sensitive Domain Exclusion
Prevents scanning government, military, and critical infrastructure:
```bash
EXCLUDE_SENSITIVE=true
```
Patterns defined in `config/sensitive_domains.txt`.
***
## Output Organization
```
Recon/target.com/
├── subdomains/
│ ├── subdomains.txt # All discovered subdomains
│ ├── subdomains_new.txt # New since last run (incremental)
│ └── wildcards_detected.txt
├── webs/
│ ├── webs.txt # Live web URLs
│ └── webscreenshot/ # Screenshots
├── hosts/
│ ├── ips.txt # Resolved IPs
│ └── portscan/ # Nmap results
├── osint/
│ ├── emails.txt
│ └── github_dorks.txt
├── vulns/
│ ├── nuclei_output/
│ └── xss.txt
├── .tmp/ # Temporary files
├── .log/ # Execution logs
└── .called_fn/ # Checkpoint markers
```
***
## Tool Selection Rationale
reconFTW integrates specific tools for each task:
| Task | Tool | Why This Tool |
| ------------------ | ----------------- | ---------------------------------------- |
| Passive subdomains | subfinder | 50+ sources, fast, maintained |
| DNS resolution | puredns + massdns | Fastest resolver with wildcard filtering |
| HTTP probing | httpx | Feature-rich, handles edge cases |
| Screenshots | webscreenshot | Headless Chrome, reliable |
| Port scanning | nmap | Industry standard, scriptable |
| Fuzzing | ffuf | Fast, flexible, mature |
| Vuln scanning | nuclei | Template-based, community templates |
Tools are selected based on:
* Speed and reliability
* Active maintenance
* Community adoption
* Output format compatibility
# Command Line Guide
> **Documentation for reconFTW `dev` branch** | [View all flags](#quick-reference)
This guide covers every command-line option available in reconFTW, with detailed explanations and practical examples.
***
## Basic Syntax
```bash
./reconftw.sh [TARGET_OPTIONS] [MODE_OPTIONS] [ADDITIONAL_OPTIONS]
```
### Quick Examples
```bash
# Single domain reconnaissance
./reconftw.sh -d example.com -r
# Multiple targets from file
./reconftw.sh -l targets.txt -r
# Full scan with vulnerabilities
./reconftw.sh -d example.com -a
# Passive only (stealth)
./reconftw.sh -d example.com -p
```
***
## Target Options
### `-d, --domain `
Specify a single target domain or IP address.
```bash
# Domain target
./reconftw.sh -d example.com -r
# Subdomain target
./reconftw.sh -d api.example.com -r
# IP address target
./reconftw.sh -d 192.168.1.1 -r
# CIDR range
./reconftw.sh -d 192.168.1.0/24 -r
```
**Input Validation:**
* Domains are sanitized (lowercase, safe characters only)
* IPs/CIDRs are validated for proper format
* Invalid inputs are rejected with error messages
### `-l, --list `
Specify a file containing multiple targets (one per line).
```bash
# Create targets file
cat > targets.txt << EOF
example.com
test.com
demo.org
EOF
# Run scan on all targets
./reconftw.sh -l targets.txt -r
```
**File Format:**
```
# targets.txt
example.com
api.example.com
192.168.1.0/24
test.org
```
**Behavior:**
* Each target is scanned sequentially
* Results are saved in separate directories
* Progress continues if one target fails
### `-m `
Multi-target mode with custom name for the output directory.
```bash
# Scan multiple targets, save under "client-project"
./reconftw.sh -m client-project -l targets.txt -r
```
**Output Structure:**
```
Recon/client-project/
├── targets/
│ ├── example.com/
│ ├── test.com/
│ └── demo.org/
└── .log/
```
***
## Scan Modes
reconFTW offers several scan modes optimized for different use cases.
### `-r, --recon` (Full Reconnaissance)
**The standard bug bounty reconnaissance mode.** Performs full subdomain enumeration, web analysis, and light vulnerability scanning (nuclei on discovered webs).
> ⚠️ **Note:** This is an active scanning mode. It sends requests to the target. Ensure you have authorization.
```bash
./reconftw.sh -d example.com -r
```
**What it does:**
| Phase | Functions |
| ----------- | ------------------------------------------------- |
| OSINT | domain\_info, emails, dorks, metadata |
| Subdomains | passive, bruteforce, permutations, scraping |
| Hosts | portscan, CDN detection, WAF detection |
| Web | probing, screenshots, URL extraction, JS analysis |
| Light Vulns | nuclei (info/low), subdomain takeover |
**Duration:** 1-4 hours depending on target size
**Best for:** Initial reconnaissance, bug bounty hunting
### `-s, --subdomains` (Subdomain Enumeration Only)
**Fast subdomain discovery without web analysis.**
```bash
./reconftw.sh -d example.com -s
```
**What it does:**
* Passive subdomain enumeration (APIs, CT logs)
* Active DNS bruteforce
* Permutation generation
* DNS resolution
* Subdomain takeover checks
**Does NOT do:**
* Web probing
* Screenshot capture
* URL extraction
* Vulnerability scanning
**Duration:** 15-60 minutes
**Best for:** Quick attack surface mapping, asset discovery
### `-p, --passive` (Passive Reconnaissance)
**Non-intrusive reconnaissance using only passive techniques.**
```bash
./reconftw.sh -d example.com -p
```
**What it does:**
* Passive subdomain enumeration only
* No DNS bruteforce
* No active web crawling
* No vulnerability scanning
* OSINT gathering
**Techniques disabled:**
```
SUBNOERROR=false
SUBANALYTICS=false
SUBBRUTE=false
SUBSCRAPING=false
SUBPERMUTE=false
PORTSCAN_ACTIVE=false
```
**Duration:** 10-30 minutes
**Best for:** Stealth recon, initial scoping, when you can't touch the target
### `-a, --all` (Full Scan with Vulnerabilities)
**Complete reconnaissance plus full vulnerability scanning.**
> 🔴 **WARNING:** This is the "YOLO mode". It sends attack payloads (SQLi, XSS, etc.) to the target. Only use with explicit written authorization for penetration testing. May trigger WAFs and security alerts.
```bash
./reconftw.sh -d example.com -a
```
**What it does:** Everything in `-r` mode PLUS:
* Full Nuclei scanning (all severities)
* XSS testing
* SQL injection testing
* SSRF checks
* LFI/SSTI testing
* CORS misconfiguration
* Open redirect testing
* Command injection
* Prototype pollution
* HTTP smuggling
* And more...
**Duration:** 4-24+ hours
**Best for:** Full security assessment, when you have explicit authorization and time
> ⚠️ **Warning:** This mode performs intrusive testing. Ensure you have explicit authorization.
### `-w, --web` (Web Analysis Only)
**Analyze a list of known URLs without subdomain enumeration.**
```bash
# Create a list of URLs
cat > urls.txt << EOF
https://www.example.com
https://api.example.com
https://admin.example.com
EOF
# Run web analysis
./reconftw.sh -l urls.txt -w
```
**What it does:**
* HTTP probing
* Screenshot capture
* URL extraction
* JavaScript analysis
* Directory fuzzing
* CMS detection
**Does NOT do:**
* Subdomain enumeration
* DNS analysis
* Port scanning
**Duration:** 30 minutes - 2 hours
**Best for:** When you already have a list of targets, analyzing specific endpoints
### `-n, --osint` (OSINT Only)
**Gather open-source intelligence without active scanning.**
```bash
./reconftw.sh -d example.com -n
```
**What it does:**
* Domain WHOIS information
* Email harvesting
* Google dorking
* GitHub repository analysis
* Metadata extraction
* API leak detection
* Third-party misconfiguration checks
* SPF/DMARC analysis
* Cloud storage enumeration
**Does NOT do:**
* Active subdomain enumeration
* Web crawling
* Port scanning
* Vulnerability testing
**Duration:** 15-45 minutes
**Best for:** Intelligence gathering, pre-engagement research
### `-c ` (Custom Function)
**Execute a specific function from the reconFTW modules.**
```bash
# Run only subdomain bruteforce
./reconftw.sh -d example.com -c sub_brute
# Run only nuclei scanning
./reconftw.sh -d example.com -c nuclei_check
# Run only screenshot capture
./reconftw.sh -d example.com -c screenshot
```
**Note:** `-c` accepts a single function per run. To execute multiple functions, run separate commands (or create a custom mode).
**Available Functions:**
Click to expand function list
**OSINT Functions:**
* `google_dorks`
* `github_dorks`
* `github_repos`
* `metadata`
* `apileaks`
* `emails`
* `domain_info`
* `third_party_misconfigs`
* `spoof`
* `mail_hygiene`
* `cloud_enum_scan`
* `ip_info`
**Subdomain Functions:**
* `sub_passive`
* `sub_crt`
* `sub_brute`
* `sub_permut`
* `sub_ia_permut`
* `sub_regex_permut`
* `sub_recursive_passive`
* `sub_recursive_brute`
* `sub_scraping`
* `sub_analytics`
* `sub_noerror`
* `sub_dns`
* `sub_tls`
* `subtakeover`
* `zonetransfer`
* `s3buckets`
**Web Functions:**
* `webprobe_simple`
* `webprobe_full`
* `screenshot`
* `virtualhosts`
* `urlchecks`
* `url_gf`
* `url_ext`
* `jschecks`
* `fuzz`
* `cms_scanner`
* `wordlist_gen`
* `iishortname`
* `graphql_scan`
**Vulnerability Functions:**
* `nuclei_check`
* `xss`
* `cors`
* `open_redirect`
* `ssrf_checks`
* `crlf_checks`
* `lfi`
* `ssti`
* `sqli`
* `command_injection`
* `prototype_pollution`
* `smuggling`
* `webcache`
* `4xxbypass`
* `fuzzparams`
* `test_ssl`
* `spraying`
* `brokenLinks`
**Host Functions:**
* `portscan`
* `cdnprovider`
* `waf_checks`
* `favicon`
* `geo_info`
**Requirement:** The target directory must already exist (from a previous scan).
### `-z, --zen` (Zen Mode)
**Minimal terminal output mode for cleaner logs.**
```bash
./reconftw.sh -d example.com -z
```
**Behavior:**
* Reduced terminal output
* Progress indicators only
* Full details in log files
* Same functionality as `-r`
**Best for:** Running in tmux/screen, CI/CD pipelines
***
## Scope Management
### `-x ` (Out-of-Scope)
Exclude specific domains/patterns from results.
```bash
# Create out-of-scope file
cat > outscope.txt << EOF
*.cdn.example.com
staging.example.com
*.cloudfront.net
EOF
# Run scan with exclusions
./reconftw.sh -d example.com -r -x outscope.txt
```
**Pattern Syntax:**
```
# Exact match
staging.example.com
# Wildcard (ends with)
*.cdn.example.com
# Multiple patterns
test.example.com
*.dev.example.com
```
### `-i ` (In-Scope)
Only include targets matching the scope file.
```bash
# Create in-scope file
cat > inscope.txt << EOF
*.example.com
*.example.org
api.partner.com
EOF
# Run scan with scope filter
./reconftw.sh -d example.com -r -i inscope.txt
```
**How it works:**
1. Results are generated normally
2. inscope filter is applied
3. Only matching entries are kept
**Enable in config:**
```bash
INSCOPE=true # In reconftw.cfg
```
***
## Advanced Flags
### `--deep` (Deep/Thorough Mode)
Enable extended scanning with larger wordlists and more techniques.
```bash
./reconftw.sh -d example.com -r --deep
```
**Changes from standard mode:**
| Aspect | Standard | Deep |
| --------------------- | ------------- | --------------- |
| Subdomain wordlist | \~10k entries | \~100k+ entries |
| Permutation depth | 1 level | Multiple levels |
| GitHub dorks | Small list | Medium list |
| Fuzzing wordlist | Common paths | Extended |
| Recursive enumeration | Limited | Full |
### `-v, --vps` (Axiom/Distributed Mode)
Enable distributed scanning using [Axiom](https://github.com/six2dez/reconftw-docs/blob/main/03-usage/08-integrations/axiom.md).
```bash
./reconftw.sh -d example.com -r -v
```
**Requirements:**
* Axiom must be installed and configured
* Cloud provider account (DigitalOcean, AWS, etc.)
* Fleet configuration in reconftw\.cfg
See [Axiom Integration](/integrations/axiom) for setup details.
### `-f ` (Custom Config)
Use a custom configuration file instead of the default.
```bash
# Create custom config
cp reconftw.cfg custom_config.cfg
# Edit custom_config.cfg...
# Use custom config
./reconftw.sh -d example.com -r -f custom_config.cfg
```
**Use cases:**
* Different configs for different clients
* Testing configuration changes
* CI/CD with environment-specific settings
### `-q ` (Rate Limiting)
Set a global rate limit for all tools.
```bash
# Limit to 50 requests/second
./reconftw.sh -d example.com -r -q 50
# Very slow/stealthy
./reconftw.sh -d example.com -r -q 10
```
**Affects:**
* `NUCLEI_RATELIMIT`
* `FFUF_RATELIMIT`
* `HTTPX_RATELIMIT`
### `-o ` (Custom Output Directory)
Save results to a custom location.
```bash
# Absolute path
./reconftw.sh -d example.com -r -o /home/user/results
# Relative path
./reconftw.sh -d example.com -r -o ./client-results
```
**Output structure:**
```
/home/user/results/
└── example.com/
├── subdomains/
├── webs/
└── ...
```
### `-y, --ai` (AI Report Generation)
Generate AI-powered reports after scan completion.
```bash
./reconftw.sh -d example.com -r -y
```
**Requirements:**
* Local AI model (e.g., llama3:8b via Ollama)
* reconftw\_ai tool installed
* Configured in reconftw\.cfg
**Report types:**
* `executive` - High-level summary
* `brief` - Concise findings
* `bughunter` - Detailed technical report
### `--quick-rescan`
Skip heavy operations if no new subdomains/assets found.
```bash
./reconftw.sh -d example.com -r --quick-rescan
```
**Behavior:**
1. Performs subdomain enumeration
2. Compares with previous results
3. If no new subdomains → skips heavy modules
4. Saves significant time on repeat scans
### `--incremental`
Only scan new findings since last run.
```bash
./reconftw.sh -d example.com -r --incremental
```
**How it works:**
1. Loads previous scan baseline
2. Performs new enumeration
3. Identifies delta (new findings only)
4. Scans only new assets
5. Generates incremental report
### `--adaptive-rate`
Automatically adjust rate limits when encountering errors.
```bash
./reconftw.sh -d example.com -r --adaptive-rate
```
**Behavior:**
* Starts at configured rate limit
* Detects 429/503 errors
* Reduces rate by 50% on errors
* Increases rate by 20% on success
* Respects MIN/MAX limits
### `--dry-run`
Preview commands without executing them.
```bash
./reconftw.sh -d example.com -r --dry-run
```
**Output:**
```
[DRY-RUN] Would execute: subfinder -d example.com -all -o .tmp/subfinder.txt
[DRY-RUN] Would execute: amass enum -passive -d example.com -o .tmp/amass.txt
...
```
**Best for:** Testing configurations, understanding workflow
### `--parallel`
Run independent functions in parallel for faster scans.
```bash
./reconftw.sh -d example.com -r --parallel
```
**What it does:**
* Runs passive enumeration sources concurrently
* Runs active DNS checks in parallel after passive completes
* Runs TLS and analytics checks after resolution
* Uses native bash job control (no external dependencies)
**Performance impact:**
* \~2-3x faster subdomain enumeration
* Higher memory usage (multiple processes)
* Higher CPU usage
**When NOT to use:**
* Low memory systems (< 4GB RAM)
* Rate-limited targets
* With Axiom (already distributed)
* When debugging issues
### `--check-tools`
Verify all required tools are installed.
```bash
./reconftw.sh --check-tools
```
**Output:**
```
[✓] subfinder
[✓] amass
[✓] httpx
[✗] nuclei (not found)
...
```
### `--health-check`
Run system health diagnostics.
```bash
./reconftw.sh --health-check
```
**Checks:**
* Critical dependencies installed
* Configuration file valid
* Required directories exist
* Network connectivity
* Disk space available
***
## Usage Examples
### Bug Bounty Workflow
```bash
# Initial reconnaissance
./reconftw.sh -d target.com -r
# Follow-up with vulnerabilities
./reconftw.sh -d target.com -a
# Quick rescan after some time
./reconftw.sh -d target.com -r --quick-rescan --incremental
```
### Stealth Assessment
```bash
# Passive only - no direct contact with target
./reconftw.sh -d target.com -p -q 5
```
### Large-Scale Scanning
```bash
# Multiple targets with Axiom
./reconftw.sh -l targets.txt -r -v --deep
# With custom output
./reconftw.sh -m client-assessment -l targets.txt -a -o /data/assessments
```
### CI/CD Integration
```bash
# Non-interactive, minimal output
./reconftw.sh -d target.com -r -z --dry-run
# With health check first
./reconftw.sh --health-check && ./reconftw.sh -d target.com -r -z
```
### Scoped Assessment
```bash
# With in-scope and out-of-scope files
./reconftw.sh -d target.com -a -i scope.txt -x exclusions.txt
```
### Custom Function Execution
```bash
# Re-run only specific parts
./reconftw.sh -d target.com -c nuclei_check
./reconftw.sh -d target.com -c xss
./reconftw.sh -d target.com -c sqli
```
***
## Flag Reference Table
| Flag | Long Form | Argument | Description |
| ---- | ----------------- | -------- | ---------------------------------- |
| `-d` | `--domain` | domain | Single target domain/IP |
| `-l` | `--list` | file | Target list file |
| `-m` | - | name | Multi-target output name |
| `-r` | `--recon` | - | Full reconnaissance mode |
| `-s` | `--subdomains` | - | Subdomain enumeration only |
| `-p` | `--passive` | - | Passive reconnaissance |
| `-a` | `--all` | - | Full scan + vulnerabilities |
| `-w` | `--web` | - | Web analysis only |
| `-n` | `--osint` | - | OSINT gathering only |
| `-c` | - | function | Custom function execution |
| `-z` | `--zen` | - | Minimal output mode |
| `-x` | - | file | Out-of-scope file |
| `-i` | - | file | In-scope file |
| `-o` | - | path | Custom output directory |
| `-f` | - | file | Custom config file |
| `-q` | - | rate | Rate limit (req/sec) |
| `-v` | `--vps` | - | Axiom distributed mode |
| `-y` | `--ai` | - | AI report generation |
| - | `--deep` | - | Deep/thorough scanning |
| - | `--quick-rescan` | - | Skip heavy ops if no new assets |
| - | `--incremental` | - | Scan only new findings |
| - | `--adaptive-rate` | - | Auto-adjust rate limits |
| - | `--dry-run` | - | Preview without executing |
| - | `--parallel` | - | Run functions in parallel (faster) |
| - | `--check-tools` | - | Verify tool installation |
| - | `--health-check` | - | System diagnostics |
| `-h` | `--help` | - | Show help message |
***
## Next Steps
* [**Configuration Reference**](/configuration/configuration) - Customize every setting
* [**Module Documentation**](/modules/05-modules) - Deep dive into each module
* [**Output Interpretation**](/output/output) - Understand your results
***
> **Documentation Info**\
> Branch: `dev` | Version: `v3.0.0+` | Last updated: February 2026
# Configuration Reference
> **Documentation for reconFTW `dev` branch** | Variables match `reconftw.cfg`
This guide provides a complete reference for reconFTW's configuration file (`reconftw.cfg`), covering every option with detailed explanations.
***
## Configuration Files Overview
reconFTW uses several configuration files:
| File | Purpose | Git Tracked |
| ------------------- | ------------------------- | ----------------- |
| `reconftw.cfg` | Main configuration | ✅ Yes |
| `secrets.cfg` | API keys and tokens | ❌ No (gitignored) |
| `custom_config.cfg` | User overrides (optional) | ❌ No |
### Load Order
1. `reconftw.cfg` is loaded first (defaults)
2. `secrets.cfg` is sourced if it exists (API keys)
3. Custom config via `-f` flag overrides all
***
## General Settings
### Tool Paths
```bash
# Path where tools are installed
tools=$HOME/Tools
# Auto-detected script path (don't change)
SCRIPTPATH="$( cd "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
```
### Shell Configuration
```bash
# Detected shell profile (.bashrc, .zshrc, etc.)
profile_shell=".$(basename "${SHELL:-/bin/bash}")rc"
```
### Version Information
```bash
# Auto-detected from git
reconftw_version="$(git rev-parse --abbrev-ref HEAD)-$(git describe --tags)"
```
### Resolver Settings
```bash
# Generate custom resolvers with dnsvalidator
generate_resolvers=false
# Fetch resolvers from trickest before scanning
update_resolvers=true
# Resolver URLs
resolvers_url="https://raw.githubusercontent.com/trickest/resolvers/main/resolvers.txt"
resolvers_trusted_url="https://gist.githubusercontent.com/six2dez/.../trusted_resolvers.txt"
```
**When to change:**
* Set `generate_resolvers=true` for custom resolver validation (slower but more accurate)
* Set `update_resolvers=false` if you maintain your own resolver list
### Proxy Settings
```bash
# HTTP proxy for tools that support it
proxy_url="http://127.0.0.1:8080/"
# Enable proxy usage
PROXY=false
```
**Usage:** Set `PROXY=true` to route web requests through Burp Suite or similar proxy.
### Golang Configuration
```bash
install_golang=true # Install Go if not found
export GOROOT="/usr/local/go" # Go installation path
export GOPATH="$HOME/go" # Go workspace
```
### Update Settings
```bash
upgrade_tools=true # Allow tool updates
upgrade_before_running=false # Update tools before each scan
```
### Output Settings
```bash
# Custom output directory (uncomment to enable)
#dir_output=/custom/output/path
# Log executed commands (verbose, may contain sensitive data)
SHOW_COMMANDS=false
```
### Disk Space Check
```bash
# Minimum required disk space in GB (0 to disable)
MIN_DISK_SPACE_GB=0
```
***
## API Keys and Tokens
### Environment Variables (Preferred)
Set these in your shell or `secrets.cfg`:
```bash
# Shodan API for passive port scanning
SHODAN_API_KEY="your_shodan_api_key"
# WhoisXML API for domain lookups
WHOISXML_API="your_whoisxml_api_key"
# Blind XSS callback server
XSS_SERVER="https://your.xss.hunter"
# SSRF/OOB callback server
COLLAB_SERVER="https://your.interact.sh"
# Slack notifications
slack_channel="C0XXXXXXXXX"
slack_auth="xoxb-xxxxx-xxxxx-xxxxx"
```
### secrets.cfg File
Create from the example:
```bash
cp secrets.cfg.example secrets.cfg
chmod 600 secrets.cfg # Restrict permissions
```
Edit `secrets.cfg`:
```bash
# API Keys
SHODAN_API_KEY="abc123..."
WHOISXML_API="xyz789..."
# Callback servers
XSS_SERVER="https://xss.example.com"
COLLAB_SERVER="https://interact.example.com"
# Notifications
slack_channel="C0XXXXXXXXX"
slack_auth="xoxb-..."
```
### Token Files
```bash
# GitHub tokens (one per line for rate limit distribution)
GITHUB_TOKENS=${tools}/.github_tokens
# GitLab tokens
GITLAB_TOKENS=${tools}/.gitlab_tokens
```
**Create GitHub tokens file:**
```bash
cat > $HOME/Tools/.github_tokens << EOF
ghp_token1xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ghp_token2xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ghp_token3xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
EOF
chmod 600 $HOME/Tools/.github_tokens
```
***
## Module Toggles
### OSINT Module
```bash
OSINT=true # Master toggle for OSINT module
GOOGLE_DORKS=true # Google dorking
GITHUB_DORKS=true # GitHub secret searching
GITHUB_REPOS=true # GitHub repository analysis
METADATA=true # Document metadata extraction
EMAILS=true # Email harvesting
DOMAIN_INFO=true # WHOIS lookups
IP_INFO=true # IP reverse lookup and geolocation
API_LEAKS=true # Postman/Swagger leak detection
THIRD_PARTIES=true # Third-party misconfiguration checks
SPOOF=true # Domain spoofing checks
MAIL_HYGIENE=true # SPF/DMARC analysis
CLOUD_ENUM=true # Cloud storage enumeration
METAFINDER_LIMIT=20 # Max documents to analyze (max 250)
```
### Subdomain Module
```bash
SUBDOMAINS_GENERAL=true # Master toggle for subdomain module
SUBPASSIVE=true # Passive enumeration (APIs, CT logs)
SUBCRT=true # Certificate transparency search
CTR_LIMIT=999999 # Max CT results
DNS_TIME_FENCE_DAYS=0 # Filter CT results to last N days (0=disabled)
DEEP_WILDCARD_FILTER=false # Multi-level wildcard detection
EXCLUDE_SENSITIVE=false # Skip gov/mil/edu domains
SUBNOERROR=false # DNS NOERROR response checking
SUBANALYTICS=true # Google Analytics correlation
SUBBRUTE=true # DNS bruteforcing
SUBSCRAPING=true # Web scraping for subdomains
SUBPERMUTE=true # DNS permutations
SUBIAPERMUTE=true # AI-powered permutations
SUBREGEXPERMUTE=true # Regex-based permutations
SUBTAKEOVER=true # Subdomain takeover checks
SUB_RECURSIVE_PASSIVE=false # Recursive passive (uses many API queries)
DEEP_RECURSIVE_PASSIVE=10 # Top N subdomains for recursion
SUB_RECURSIVE_BRUTE=false # Recursive bruteforce (disk/time intensive)
ZONETRANSFER=true # DNS zone transfer checks
S3BUCKETS=true # S3 bucket misconfiguration checks
REVERSE_IP=false # Reverse IP lookups (enable for IP/CIDR targets)
INSCOPE=false # Apply inscope filtering
```
#### DNS\_TIME\_FENCE\_DAYS
Filters Certificate Transparency (crt.sh) results to certificates issued within the last N days.
```bash
DNS_TIME_FENCE_DAYS=90 # Only certificates from last 90 days
DNS_TIME_FENCE_DAYS=0 # Disabled (default) - return all results
```
**Why use this:**
* CT logs contain historical certificates, including expired and decommissioned domains
* Old certificates often point to infrastructure that no longer exists
* Setting to 90 days typically reduces noise by 20-40% while keeping relevant results
#### DEEP\_WILDCARD\_FILTER
Enables iterative wildcard detection at all subdomain levels, not just the root.
```bash
DEEP_WILDCARD_FILTER=true # Enable multi-level wildcard detection
DEEP_WILDCARD_FILTER=false # Standard wildcard detection only (default)
```
**How it works:**
1. Extracts unique parent domains from resolved subdomains
2. Generates random probe hostname for each parent (e.g., `a1b2c3d4.api.example.com`)
3. If random probe resolves, parent is a wildcard
4. Filters all subdomains under detected wildcard parents
5. Repeats up to 5 iterations to catch nested wildcards
**Why use this:**
* Enterprise targets often have deep wildcards (e.g., `*.na45.salesforce.com`)
* Standard detection only checks `*.example.com`
* Removes 50-80% false positives on enterprise infrastructure
* Detected wildcards saved to `subdomains/wildcards_detected.txt`
#### EXCLUDE\_SENSITIVE
Prevents scanning domains that match patterns in `config/sensitive_domains.txt`.
```bash
EXCLUDE_SENSITIVE=true # Skip sensitive domains
EXCLUDE_SENSITIVE=false # Scan all domains (default)
```
**Excluded patterns include:**
* Government: `*.gov`, `*.gob.*`, `*.gouv.*`
* Military: `*.mil`, `*.defense.*`
* Educational: `*.edu`, `*.ac.*`
* Financial: `*.bank`, `*.banking.*`
* Critical infrastructure: `*.nhs.*`, `*.hospital.*`, `*.police.*`
**Why use this:**
* Legal protection when scanning wildcard scopes
* Prevents accidental contact with sensitive infrastructure
* Patterns can be customized in `config/sensitive_domains.txt`
### Permutation Settings
```bash
# Permutation tool: "gotator" (deeper) or "ripgen" (faster)
PERMUTATIONS_OPTION=gotator
# Gotator flags
GOTATOR_FLAGS=" -depth 1 -numbers 3 -mindup -adv -md"
```
### TLS Port Discovery
```bash
# Ports to check for TLS certificates
TLS_PORTS="21,22,25,80,110,135,143,261,443,465,563,587,636,853,990,993,995,..."
```
### Web Detection Module
```bash
WEBPROBESIMPLE=true # Probe ports 80/443
WEBPROBEFULL=true # Probe uncommon web ports
WEBSCREENSHOT=true # Capture screenshots
VIRTUALHOSTS=false # Virtual host fuzzing (slower)
# Uncommon web ports to probe
UNCOMMON_PORTS_WEB="81,300,591,593,832,981,1010,1311,..."
```
### Host Module
```bash
FAVICON=true # Favicon-based IP discovery
PORTSCANNER=true # Port scanning module
GEO_INFO=true # IP geolocation
PORTSCAN_PASSIVE=true # Shodan passive port scan
PORTSCAN_ACTIVE=true # Nmap active port scan
CDN_IP=true # CDN detection
# Nmap options
PORTSCAN_ACTIVE_OPTIONS="--top-ports 200 -sV -n -Pn --open --max-retries 2 --script vulners"
```
### Web Analysis Module
```bash
WAF_DETECTION=true # WAF detection
NUCLEICHECK=true # Nuclei vulnerability scanning
URL_CHECK=true # URL collection
URL_CHECK_PASSIVE=true # Passive URL collection (archives)
URL_CHECK_ACTIVE=true # Active URL crawling
URL_GF=true # URL pattern matching
URL_EXT=true # File extension sorting
JSCHECKS=true # JavaScript analysis
FUZZ=true # Directory fuzzing
IIS_SHORTNAME=true # IIS shortname scanning
CMS_SCANNER=true # CMS detection
WORDLIST=true # Custom wordlist generation
ROBOTSWORDLIST=true # Robots.txt historical analysis
PASSWORD_DICT=true # Password dictionary generation
PASSWORD_MIN_LENGTH=5 # Min password length
PASSWORD_MAX_LENGTH=14 # Max password length
GRAPHQL_CHECK=true # GraphQL endpoint detection
GQLSPECTION=false # Deep GraphQL introspection
PARAM_DISCOVERY=true # Parameter discovery with Arjun
GRPC_SCAN=false # gRPC reflection probing
```
### Vulnerability Module
```bash
VULNS_GENERAL=false # Master toggle for vuln scanning
XSS=true # XSS testing
CORS=true # CORS misconfiguration
TEST_SSL=true # SSL/TLS analysis
OPEN_REDIRECT=true # Open redirect detection
SSRF_CHECKS=true # SSRF testing
CRLF_CHECKS=true # CRLF injection
LFI=true # Local file inclusion
SSTI=true # Server-side template injection
SQLI=true # SQL injection
SQLMAP=true # SQLMap testing
GHAURI=false # Ghauri SQLi testing
BROKENLINKS=true # Broken link detection
SPRAY=true # Password spraying
COMM_INJ=true # Command injection
PROTO_POLLUTION=true # Prototype pollution
SMUGGLING=true # HTTP request smuggling
WEBCACHE=true # Web cache issues
BYPASSER4XX=true # 4XX bypass attempts
FUZZPARAMS=true # Parameter fuzzing
```
### Nuclei Configuration
```bash
# Nuclei templates path
NUCLEI_TEMPLATES_PATH="$HOME/nuclei-templates"
# Severity levels to run
NUCLEI_SEVERITY="info,low,medium,high,critical"
# Extra arguments (exclusions, etc.)
NUCLEI_EXTRA_ARGS=""
# Example with exclusions:
# NUCLEI_EXTRA_ARGS="-etags openssh,ssl -eid node-express-dev-env"
# Standard flags
NUCLEI_FLAGS="-silent -retries 2"
# JS secret scanning flags
NUCLEI_FLAGS_JS="-silent -tags exposure,token -severity info,low,medium,high,critical"
```
***
## Threading and Rate Limits
### Thread Configuration
```bash
FFUF_THREADS=40 # Directory fuzzing
HTTPX_THREADS=50 # HTTP probing
HTTPX_UNCOMMONPORTS_THREADS=100 # Uncommon port probing
KATANA_THREADS=20 # Web crawling
BRUTESPRAY_THREADS=20 # Password spraying
BRUTESPRAY_CONCURRENCE=10 # Concurrent targets
DNSTAKE_THREADS=100 # DNS takeover checks
DALFOX_THREADS=200 # XSS testing
TLSX_THREADS=1000 # TLS certificate scanning
INTERLACE_THREADS=10 # Parallel tool execution
RESOLVE_DOMAINS_THREADS=150 # DNS resolution
DNSVALIDATOR_THREADS=200 # Resolver validation
XNLINKFINDER_DEPTH=3 # Link finder depth
ARJUN_THREADS=10 # Parameter discovery
```
### Rate Limits
```bash
HTTPX_RATELIMIT=150 # HTTP requests/second
NUCLEI_RATELIMIT=150 # Nuclei requests/second
FFUF_RATELIMIT=0 # Fuzzing requests/second (0=unlimited)
```
### PureDNS Limits
```bash
PUREDNS_PUBLIC_LIMIT=0 # Public resolver limit (0=unlimited)
PUREDNS_TRUSTED_LIMIT=400 # Trusted resolver limit
PUREDNS_WILDCARDTEST_LIMIT=30 # Wildcard detection limit
PUREDNS_WILDCARDBATCH_LIMIT=1500000 # Wildcard batch size
```
### Adaptive Rate Limiting
```bash
ADAPTIVE_RATE_LIMIT=false # Auto-adjust on errors
MIN_RATE_LIMIT=10 # Minimum rate limit
MAX_RATE_LIMIT=500 # Maximum rate limit
RATE_LIMIT_BACKOFF_FACTOR=0.5 # Reduce by 50% on error
RATE_LIMIT_INCREASE_FACTOR=1.2 # Increase by 20% on success
```
***
## Timeouts
```bash
SUBFINDER_ENUM_TIMEOUT=180 # Subfinder timeout (minutes)
CMSSCAN_TIMEOUT=3600 # CMS scan timeout (seconds)
FFUF_MAXTIME=900 # Fuzzing timeout (seconds)
HTTPX_TIMEOUT=10 # HTTP request timeout (seconds)
HTTPX_UNCOMMONPORTS_TIMEOUT=10 # Uncommon port timeout (seconds)
PERMUTATIONS_LIMIT=21474836480 # Max permutation file size (bytes, 20GB)
```
***
## Wordlists
```bash
# Fuzzing wordlist
fuzz_wordlist=${tools}/fuzz_wordlist.txt
# LFI payloads
lfi_wordlist=${tools}/lfi_wordlist.txt
# SSTI payloads
ssti_wordlist=${tools}/ssti_wordlist.txt
# Subdomain wordlists
subs_wordlist=${tools}/subdomains.txt
subs_wordlist_big=${tools}/subdomains_n0kovo_big.txt
# Resolver lists
resolvers=${tools}/resolvers.txt
resolvers_trusted=${tools}/resolvers_trusted.txt
```
### Cloud Hunter Settings
```bash
# Cloud permutation depth: DEEP, NORMAL, or NONE
CLOUDHUNTER_PERMUTATION=NORMAL
```
***
## DEEP Mode Settings
```bash
DEEP=false # Deep scanning mode
DEEP_LIMIT=500 # First auto-deep threshold
DEEP_LIMIT2=1500 # Second auto-deep threshold
```
**Behavior:**
* If subdomain count < DEEP\_LIMIT, additional techniques run
* If < DEEP\_LIMIT2, even more intensive techniques run
***
## Axiom Settings
```bash
# Axiom fleet configuration
AXIOM_FLEET_LAUNCH=true # Auto-launch fleet
AXIOM_FLEET_NAME="reconFTW" # Fleet name prefix
AXIOM_FLEET_COUNT=10 # Number of instances
AXIOM_FLEET_REGIONS="eu-central" # Cloud regions
AXIOM_FLEET_SHUTDOWN=true # Auto-shutdown after scan
# Resolver paths on Axiom instances
AXIOM_RESOLVERS_PATH="/home/op/lists/resolvers.txt"
AXIOM_RESOLVERS_TRUSTED_PATH="/home/op/lists/resolvers_trusted.txt"
# Post-start script (optional)
#AXIOM_POST_START="~/Tools/axiom_config.sh"
# Extra arguments
AXIOM_EXTRA_ARGS=""
```
***
## Faraday Settings
```bash
FARADAY=false # Enable Faraday integration
FARADAY_SERVER="http://localhost:5985"
FARADAY_USER="faraday"
FARADAY_PASS="FARADAY_PASSWORD"
FARADAY_WORKSPACE="reconftw"
```
***
## AI Settings
```bash
AI_MODEL="llama3:8b" # AI model to use
AI_REPORT_TYPE="md" # Report format (md, txt)
AI_REPORT_PROFILE="bughunter" # Profile: executive, brief, bughunter
```
***
## Extra Features
### Notification Settings
```bash
NOTIFICATION=false # Notifications for every function
SOFT_NOTIFICATION=false # Only start/end notifications
SENDZIPNOTIFY=false # Send zipped results via notify
```
### Diff/Incremental Mode
```bash
DIFF=false # Differential scanning
INCREMENTAL_MODE=false # Incremental scanning
```
### Cleanup Settings
```bash
REMOVETMP=false # Delete .tmp after scan
REMOVELOG=false # Delete logs after scan
PRESERVE=true # Keep .called_fn markers
```
### Cache Settings
```bash
CACHE_MAX_AGE_DAYS=30 # Cache validity (days)
```
### Log Rotation
```bash
MAX_LOG_FILES=10 # Max log files per target
MAX_LOG_AGE_DAYS=30 # Delete logs older than this
```
### Structured Logging
```bash
STRUCTURED_LOGGING=false # JSON format logging
```
### Asset Tracking
```bash
ASSET_STORE=true # Append to assets.jsonl
QUICK_RESCAN=false # Skip heavy steps if no new assets
CHUNK_LIMIT=2000 # Split large lists
HOTLIST_TOP=50 # Top risky assets to highlight
```
### IPv6
```bash
IPV6_SCAN=true # Enable IPv6 discovery
```
### Intrusive Mode
```bash
INTRUSIVE=false # Dangerous cloud/CORS tests
```
***
## HTTP Options
```bash
# Default User-Agent header
HEADER="User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0"
```
### Tool Flags
```bash
# FFUF default flags
FFUF_FLAGS=" -mc all -fc 404 -sf -noninteractive -of json"
# HTTPX probing flags
HTTPX_FLAGS=" -follow-redirects -random-agent -status-code -silent -title -web-server -tech-detect -location -content-length"
```
***
## Color Configuration
```bash
# Terminal colors (ANSI codes)
bred='\033[1;31m' # Bold red
bblue='\033[1;34m' # Bold blue
bgreen='\033[1;32m' # Bold green
byellow='\033[1;33m' # Bold yellow
red='\033[0;31m' # Red
blue='\033[0;34m' # Blue
green='\033[0;32m' # Green
yellow='\033[0;33m' # Yellow
reset='\033[0m' # Reset
```
***
## Debug Settings
```bash
DEBUG_STD="&>/dev/null" # Skip stdout in installer
DEBUG_ERROR="2>/dev/null" # Skip stderr in installer
```
***
## Configuration Examples
### Stealth Configuration
```bash
# Minimal noise configuration
SUBBRUTE=false
SUBPERMUTE=false
PORTSCAN_ACTIVE=false
FUZZ=false
VULNS_GENERAL=false
HTTPX_RATELIMIT=10
NUCLEI_RATELIMIT=10
```
### Aggressive Configuration
```bash
# Maximum coverage
DEEP=true
SUBBRUTE=true
SUBPERMUTE=true
SUB_RECURSIVE_BRUTE=true
VULNS_GENERAL=true
FUZZ=true
HTTPX_THREADS=100
NUCLEI_RATELIMIT=500
```
### Bug Bounty Configuration
```bash
# Balanced for bug bounty
OSINT=true
SUBDOMAINS_GENERAL=true
VULNS_GENERAL=false # Enable with -a flag
NOTIFICATION=true
DIFF=true
```
***
## Using Custom Config Files
```bash
# Create custom config
cp reconftw.cfg client_config.cfg
# Edit for specific client
vim client_config.cfg
# Use custom config
./reconftw.sh -d target.com -r -f client_config.cfg
```
***
## Environment Variable Priority
Environment variables override config file settings:
```bash
# Override via environment
export SHODAN_API_KEY="my_key"
export NUCLEI_RATELIMIT=50
# Run scan (uses environment values)
./reconftw.sh -d target.com -r
```
***
## Next Steps
* [**Module Documentation**](/modules/05-modules) - Understand each module in detail
* [**Tools Reference**](/tools-reference/tools) - Learn about integrated tools
* [**Advanced Usage**](/advanced/advanced) - Custom functions and optimization
***
> **Documentation Info**\
> Branch: `dev` | Version: `v3.0.0+` | Last updated: February 2026\
> Variables documented match `reconftw.cfg` in the repository root.
# Modules Overview
reconFTW is organized into specialized modules, each handling a specific phase of reconnaissance. This page provides an overview and quick navigation to each module's detailed documentation.
***
## Module Architecture
```
┌─────────────────────────────────────────────────────────────────────┐
│ reconFTW Module System │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────┐ │
│ │ Target │ │
│ │ Input │ │
│ └──────┬───────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ Intelligence gathering │
│ │ OSINT │────▶ Dorks, emails, metadata, leaks │
│ └──────┬───────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ Asset discovery │
│ │ Subdomains │────▶ Passive, brute, permutations, takeover │
│ └──────┬───────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ Infrastructure analysis │
│ │ Hosts │────▶ Ports, CDN, WAF, geolocation │
│ └──────┬───────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ Web application analysis │
│ │ Web Analysis │────▶ Probing, screenshots, JS, fuzzing │
│ └──────┬───────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ Security testing │
│ │Vulnerabilities│───▶ Nuclei, XSS, SQLi, SSRF, etc. │
│ └──────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘
```
***
## Module Summary
| Module | Functions | Primary Tools | Output Directory |
| ------------------------------------------- | --------- | ------------------------------------ | -------------------------- |
| [OSINT](/modules/osint) | 12 | theHarvester, gitdorker, trufflehog | `osint/` |
| [Subdomains](/modules/subdomains) | 17 | subfinder, amass, puredns, dnsx | `subdomains/` |
| [Hosts](/modules/hosts) | 6 | nmap, smap, cdncheck, wafw00f | `hosts/` |
| [Web Analysis](/modules/web-analysis) | 17 | httpx, katana, ffuf, gowitness | `webs/`, `fuzzing/`, `js/` |
| [Vulnerabilities](/modules/vulnerabilities) | 18 | nuclei, dalfox, sqlmap, ssrf-sheriff | `vulns/` |
***
## OSINT Module
**Purpose:** Gather intelligence about the target organization without direct interaction.
**Key Capabilities:**
* Google dorking for sensitive files
* GitHub secret scanning
* Email harvesting
* Document metadata extraction
* Cloud storage enumeration
* API leak detection
**When to use:** At the beginning of an engagement for initial intelligence gathering.
➡️ [**Full OSINT Documentation**](/modules/osint)
***
## Subdomains Module
**Purpose:** Discover all subdomains associated with the target domain.
**Key Capabilities:**
* Passive enumeration (40+ sources)
* Certificate Transparency logs
* DNS brute-forcing
* Permutation generation
* Recursive enumeration
* Subdomain takeover detection
**When to use:** After OSINT, to map the attack surface.
➡️ [**Full Subdomains Documentation**](/modules/subdomains)
***
## Hosts Module
**Purpose:** Analyze infrastructure behind discovered assets.
**Key Capabilities:**
* Port scanning (passive + active)
* CDN detection and filtering
* WAF identification
* IP geolocation
* Favicon-based IP discovery
**When to use:** After subdomain enumeration, to understand infrastructure.
➡️ [**Full Hosts Documentation**](/modules/hosts)
***
## Web Analysis Module
**Purpose:** Analyze web applications and discover endpoints.
**Key Capabilities:**
* HTTP probing and status detection
* Screenshot capture
* URL extraction from archives
* JavaScript analysis for secrets
* Directory/file fuzzing
* Technology detection
**When to use:** After identifying live web servers.
➡️ [**Full Web Analysis Documentation**](/modules/web-analysis)
***
## Vulnerabilities Module
**Purpose:** Identify security vulnerabilities in discovered assets.
**Key Capabilities:**
* Template-based scanning (Nuclei)
* XSS testing
* SQL injection detection
* SSRF testing
* CORS misconfiguration
* SSL/TLS analysis
* And many more...
**When to use:** Final phase, after mapping all assets.
➡️ [**Full Vulnerabilities Documentation**](/modules/vulnerabilities)
***
## Module Execution Order
In a full scan (`-a` flag), modules execute in this order:
```
1. OSINT → Intelligence gathering
2. Subdomains → Asset discovery
3. Hosts → Infrastructure analysis
4. Web Analysis → Application mapping
5. Vulnerabilities → Security testing
```
Each module builds on the previous one's output, creating a full reconnaissance pipeline.
***
## Enabling/Disabling Modules
### Via Configuration
```bash
# In reconftw.cfg
OSINT=true
SUBDOMAINS_GENERAL=true
PORTSCANNER=true
WEBPROBESIMPLE=true
WEBPROBEFULL=true
NUCLEICHECK=true
# Use VULNS_GENERAL=true if you want to enable the full vulnerability module by config
```
### Via Command Line
```bash
# Run only specific modules
./reconftw.sh -d example.com -s # Subdomains only
./reconftw.sh -d example.com -n # OSINT only
./reconftw.sh -d example.com -w # Web analysis only
# Custom function selection
./reconftw.sh -d example.com -c sub_passive
./reconftw.sh -d example.com -c webprobe_simple
```
***
## Module Dependencies
Some modules depend on outputs from others:
```
OSINT ─────────────────────────────────────┐
│
Subdomains ───────┬────────────────────────┤
│ │
▼ │
Hosts ───────────────────────┤
│ │
▼ │
Web Analysis ───────────────────┤
│ │
▼ │
Vulnerabilities ◄────────────────┘
```
***
## Next Steps
Choose a module to explore in detail:
* [**OSINT Module**](/modules/osint) - Start with intelligence gathering
* [**Subdomains Module**](/modules/subdomains) - Discover your attack surface
* [**Hosts Module**](/modules/hosts) - Understand the infrastructure
* [**Web Analysis Module**](/modules/web-analysis) - Map web applications
* [**Vulnerabilities Module**](/modules/vulnerabilities) - Find security issues
# OSINT Module
The OSINT (Open Source Intelligence) module gathers publicly available information about the target without direct interaction. This passive intelligence gathering helps understand the target's digital footprint.
***
## Why OSINT First?
OSINT is executed before any other module for strategic reasons:
1. **Zero Target Interaction**: All queries go to third-party services (Google, GitHub, crt.sh), not the target. This means:
* No logs generated on target systems
* No risk of detection or blocking
* No rate limiting concerns from the target
2. **Context Building**: Information gathered here informs later phases:
* Email patterns → potential usernames for login bruteforce
* Exposed API keys → direct access without exploitation
* Related domains → expanded attack surface
3. **Quick Wins**: OSINT often reveals immediate vulnerabilities:
* Leaked credentials in GitHub
* Exposed admin panels via Google dorks
* Misconfigured cloud storage buckets
4. **Scope Discovery**: May reveal additional targets:
* Acquisitions mentioned in documents
* Azure tenant domains
* Related domains via registrant data
***
## Module Overview
| Function | Purpose | Tools Used |
| ------------------------ | ----------------------------------- | ------------------------------- |
| `google_dorks` | Find exposed files/pages via Google | dorks\_hunter |
| `github_dorks` | Search GitHub for leaked secrets | gitdorks\_go |
| `github_repos` | Analyze organization repositories | enumerepo, gitleaks, trufflehog |
| `metadata` | Extract document metadata | metagoofil, exiftool |
| `apileaks` | Detect exposed APIs | porch-pirate, SwaggerSpy |
| `emails` | Harvest email addresses | EmailHarvester, LeakSearch |
| `domain_info` | WHOIS and domain intelligence | whois, msftrecon, scopify |
| `third_party_misconfigs` | Third-party service misconfigs | misconfig-mapper |
| `spoof` | Email spoofing vulnerability | spoofy |
| `mail_hygiene` | SPF/DMARC analysis | dig |
| `cloud_enum_scan` | Cloud storage enumeration | cloud\_enum |
| `ip_info` | IP intelligence (for IP targets) | WhoisXML API |
***
## Configuration Options
```bash
# In reconftw.cfg
# Master toggle
OSINT=true
# Individual toggles
GOOGLE_DORKS=true
GITHUB_DORKS=true
GITHUB_REPOS=true
METADATA=true
EMAILS=true
DOMAIN_INFO=true
IP_INFO=true
API_LEAKS=true
THIRD_PARTIES=true
SPOOF=true
MAIL_HYGIENE=true
CLOUD_ENUM=true
# Limits
METAFINDER_LIMIT=20 # Max documents to fetch (max 250)
```
***
## Google Dorks
### What It Does
Searches Google for sensitive files, pages, and information exposure using predefined dork queries.
### How It Works
```
Target domain → dorks_hunter → Google search → Results filtered
```
### Example Dorks Searched
* `site:example.com filetype:pdf`
* `site:example.com filetype:sql`
* `site:example.com inurl:admin`
* `site:example.com intitle:"index of"`
* `site:example.com ext:log`
### Output
```
osint/dorks.txt
```
**Sample Output:**
```
[+] site:example.com filetype:pdf
- https://example.com/docs/report.pdf
- https://example.com/files/manual.pdf
[+] site:example.com inurl:login
- https://admin.example.com/login
- https://portal.example.com/user/login
```
### Configuration
```bash
GOOGLE_DORKS=true
```
> **Note:** Google may rate-limit or block automated queries. Results vary based on Google's indexing.
***
## GitHub Analysis
### GitHub Dorks (`github_dorks`)
Searches GitHub for secrets, credentials, and sensitive information related to the target.
**Requires:** GitHub tokens in `$GITHUB_TOKENS` file
**How It Works:**
```
Target domain → gitdorks_go → GitHub API → Secret patterns matched
```
**Dork Categories:**
* API keys and tokens
* Passwords and credentials
* Configuration files
* Database connection strings
* Private keys
**Output:**
```
osint/gitdorks.txt
```
**Sample Output:**
```
https://github.com/user/repo/blob/main/config.js - "api_key": "sk_live_xxxxx"
https://github.com/org/project/blob/master/.env - DATABASE_URL=postgres://user:pass@host
```
### GitHub Repos (`github_repos`)
Analyzes organization repositories for leaked secrets using multiple detection tools.
**How It Works:**
```
Target domain → Extract org name → enumerepo (find repos) → Clone repos →
→ gitleaks (scan) → trufflehog (scan) → Combine results
```
**Output:**
```
osint/github_company_secrets.json
```
**Sample Output:**
```json
{
"Description": "AWS API Key",
"File": "deploy/config.yaml",
"Commit": "a1b2c3d4",
"Match": "AKIA...",
"Repository": "https://github.com/example-org/infra"
}
```
### Configuration
```bash
GITHUB_DORKS=true
GITHUB_REPOS=true
# Token file path
GITHUB_TOKENS=${tools}/.github_tokens
```
**Creating Token File:**
```bash
# Create file with one token per line
cat > ~/Tools/.github_tokens << EOF
ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ghp_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
EOF
# Secure permissions
chmod 600 ~/Tools/.github_tokens
```
> **Tip:** Multiple tokens help avoid rate limiting. Create tokens with `read:org` and `repo` scopes.
***
## Metadata Extraction
### What It Does
Downloads indexed documents (PDF, DOCX, XLSX) and extracts metadata that may reveal:
* Author names (potential usernames)
* Email addresses
* Software versions
* Internal paths
* Creation/modification dates
### How It Works
```
Target domain → metagoofil (download docs) → exiftool (extract metadata) → Filter results
```
### Output
```
osint/metadata_results.txt
```
**Sample Output:**
```
Author : John Smith
Creator : Microsoft® Word 2019
Producer : Microsoft® Word 2019
Template : C:\Users\jsmith\Templates\Report.dotx
Email : john.smith@example.com
```
### Configuration
```bash
METADATA=true
METAFINDER_LIMIT=20 # Max documents to download (max 250)
```
> **Note:** Downloading many documents can be slow. Adjust `METAFINDER_LIMIT` based on needs.
***
## API Leaks
### What It Does
Searches for exposed API documentation and collections in:
* **Postman** - Public workspaces and collections
* **SwaggerHub** - Public API specifications
### How It Works
```
Target domain → porch-pirate (Postman) → SwaggerSpy (Swagger) →
→ trufflehog (analyze for secrets) → Combined results
```
### Output
```
osint/postman_leaks.txt # Raw Postman findings
osint/swagger_leaks.txt # Raw Swagger findings
osint/postman_leaks_trufflehog.json # Secrets from Postman
osint/swagger_leaks_trufflehog.json # Secrets from Swagger
```
**Sample Postman Output:**
```
[Collection] Example API v2
Environment: Production
Variables:
- api_key: sk_live_xxxxx
- base_url: https://api.example.com
[Request] POST /auth/login
Body: {"username": "admin", "password": "{{password}}"}
```
### Configuration
```bash
API_LEAKS=true
```
***
## Email Harvesting
### What It Does
Discovers email addresses associated with the target domain through:
* Search engine results
* Public databases
* Leaked credential databases
### How It Works
```
Target domain → EmailHarvester (search engines) → LeakSearch (breach data) →
→ Deduplicate → Output
```
### Output
```
osint/emails.txt # Discovered email addresses
osint/passwords.txt # Leaked credentials (if found)
```
**Sample Output:**
```
# emails.txt
admin@example.com
support@example.com
john.doe@example.com
careers@example.com
# passwords.txt
john.doe@example.com:password123
admin@example.com:admin2020
```
### Configuration
```bash
EMAILS=true
```
> **⚠️ Ethics:** Handle leaked credentials responsibly. Only use for authorized testing.
***
## Domain Intelligence
### What It Does
Gathers complete domain information:
* WHOIS registration data
* Microsoft 365/Azure tenant domains
* Related domains via Scopify
### How It Works
```
Target domain → whois → WHOIS data
→ msftrecon → Azure/M365 tenants
→ scopify → Related domains
```
### Output
```
osint/domain_info_general.txt # WHOIS data
osint/azure_tenant_domains.txt # Microsoft tenant domains
osint/scopify.txt # Related scope domains
```
**Sample WHOIS Output:**
```
Domain Name: EXAMPLE.COM
Registry Domain ID: 123456789_DOMAIN_COM-VRSN
Registrar: Example Registrar, Inc.
Creation Date: 1995-08-14T04:00:00Z
Registrant Organization: Example Corporation
Registrant Country: US
Name Server: NS1.EXAMPLE.COM
```
### Configuration
```bash
DOMAIN_INFO=true
```
***
## Third-Party Misconfigurations
### What It Does
Checks for misconfigurations in third-party services used by the target:
* Atlassian (Jira, Confluence)
* Slack
* Zendesk
* HubSpot
* And many more...
### How It Works
```
Target domain → Extract company name → misconfig-mapper →
→ Check all services → Report findings
```
### Output
```
osint/3rdparts_misconfigurations.txt
```
**Sample Output:**
```
[+] Jira: Open project listing found
URL: https://example.atlassian.net/browse
[+] Slack: Workspace enumeration possible
Workspace: example-company
[+] Zendesk: Public support tickets accessible
URL: https://example.zendesk.com/hc
```
### Configuration
```bash
THIRD_PARTIES=true
```
***
## Email Spoofing Check
### What It Does
Analyzes if the domain is vulnerable to email spoofing attacks by checking:
* SPF record configuration
* DMARC policy strength
* DKIM presence
### How It Works
```
Target domain → spoofy → Analyze DNS records →
→ Determine spoofability → Report
```
### Output
```
osint/spoof.txt
```
**Sample Output:**
```
Domain: example.com
SPF Record: v=spf1 include:_spf.google.com ~all
DMARC Record: v=DMARC1; p=none; rua=mailto:dmarc@example.com
Result: POTENTIALLY SPOOFABLE
Reason: DMARC policy is 'none' (not enforced)
```
### Configuration
```bash
SPOOF=true
```
***
## Mail Hygiene
### What It Does
Performs a quick check of email security DNS records:
* TXT records (SPF)
* DMARC records
### How It Works
```
Target domain → dig TXT → SPF record
→ dig TXT _dmarc → DMARC record
```
### Output
```
osint/mail_hygiene.txt
```
**Sample Output:**
```
Domain: example.com
TXT records:
"v=spf1 include:_spf.google.com include:amazonses.com ~all"
DMARC record:
"v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.com"
```
### Configuration
```bash
MAIL_HYGIENE=true
```
***
## Cloud Enumeration
### What It Does
Searches for exposed cloud storage buckets across multiple providers:
* Amazon S3
* Azure Blob Storage
* Google Cloud Storage
* DigitalOcean Spaces
### How It Works
```
Target domain → Extract keywords → cloud_enum →
→ Check all providers → Report accessible buckets
```
### Output
```
osint/cloud_enum.txt
```
**Sample Output:**
```
[+] S3 Bucket Found: example-backups.s3.amazonaws.com
Status: Public (READ)
[+] Azure Blob Found: exampledata.blob.core.windows.net
Status: Public (LIST)
[+] GCS Bucket Found: example-assets.storage.googleapis.com
Status: Authenticated Users
```
### Configuration
```bash
CLOUD_ENUM=true
```
***
## IP Information
### What It Does
For IP address targets, gathers:
* Reverse IP lookups (domains on same IP)
* WHOIS information
* Geolocation data
**Requires:** `WHOISXML_API` key
### How It Works
```
IP target → WhoisXML API → Reverse IP
→ WHOIS data
→ Geolocation
```
### Output
```
osint/ip__relations.txt # Domains on IP
osint/ip__whois.txt # WHOIS data
osint/ip__location.txt # Geolocation
```
**Sample Output:**
```
# ip_192.168.1.1_relations.txt
example.com 192.168.1.1
test.com 192.168.1.1
demo.org 192.168.1.1
# ip_192.168.1.1_location.txt
192.168.1.1
{
"city": "San Francisco",
"region": "California",
"country": "US",
"org": "Example Hosting Inc."
}
```
### Configuration
```bash
IP_INFO=true
WHOISXML_API="your_api_key" # In secrets.cfg
```
***
## Running OSINT Only
```bash
# Run only OSINT module
./reconftw.sh -d example.com -n
```
This executes all enabled OSINT functions without subdomain enumeration or vulnerability scanning.
***
## Output Summary
| Function | Output File(s) |
| ------------------------ | ------------------------------------------------------ |
| google\_dorks | `osint/dorks.txt` |
| github\_dorks | `osint/gitdorks.txt` |
| github\_repos | `osint/github_company_secrets.json` |
| metadata | `osint/metadata_results.txt` |
| apileaks | `osint/postman_leaks*.txt`, `osint/swagger_leaks*.txt` |
| emails | `osint/emails.txt`, `osint/passwords.txt` |
| domain\_info | `osint/domain_info_*.txt`, `osint/scopify.txt` |
| third\_party\_misconfigs | `osint/3rdparts_misconfigurations.txt` |
| spoof | `osint/spoof.txt` |
| mail\_hygiene | `osint/mail_hygiene.txt` |
| cloud\_enum\_scan | `osint/cloud_enum.txt` |
| ip\_info | `osint/ip_*_*.txt` |
***
## Best Practices
1. **Configure API Keys:** Many OSINT functions work better with API keys (GitHub, WhoisXML)
2. **Rate Limiting:** Google may block automated searches; space out scans
3. **Legal Considerations:** OSINT is generally legal but respect terms of service
4. **Credential Handling:** Handle any discovered credentials responsibly
5. **Verification:** Always verify OSINT findings with additional sources
***
## Next Steps
* [**Subdomain Module**](/modules/subdomains) - Discover attack surface
* [**Output Interpretation**](/output/output) - Understand results
# Subdomain Module
The subdomain enumeration module is the cornerstone of reconFTW, discovering all subdomains associated with a target using multiple complementary techniques.
***
## Module Overview
| Function | Type | Purpose | Tools |
| ----------------------- | ----------- | ----------------------------- | ---------------------------- |
| `sub_passive` | Passive | API-based subdomain discovery | subfinder, github-subdomains |
| `sub_crt` | Passive | Certificate transparency logs | crt.sh |
| `sub_noerror` | Active | DNS NOERROR response analysis | dnsx |
| `sub_brute` | Active | DNS bruteforce with wordlists | puredns |
| `sub_permut` | Active | Permutation generation | gotator, ripgen |
| `sub_ia_permut` | Active | AI-powered permutations | subwiz |
| `sub_regex_permut` | Active | Regex-based permutations | regulator |
| `sub_recursive_passive` | Passive | Recursive passive enum | subfinder |
| `sub_recursive_brute` | Active | Recursive bruteforce | puredns |
| `sub_scraping` | Semi-active | Web scraping extraction | katana |
| `sub_analytics` | Passive | Google Analytics correlation | AnalyticsRelationships |
| `sub_tls` | Active | TLS certificate discovery | tlsx |
| `sub_dns` | Active | DNS record resolution | dnsx |
| `subtakeover` | Active | Subdomain takeover detection | nuclei, dnstake |
| `zonetransfer` | Active | DNS zone transfer check | dig |
| `s3buckets` | Active | S3 bucket enumeration | S3Scanner, CloudHunter |
***
## Configuration Options
```bash
# In reconftw.cfg
# Master toggle
SUBDOMAINS_GENERAL=true
# Passive techniques
SUBPASSIVE=true # API-based enumeration
SUBCRT=true # Certificate transparency
CTR_LIMIT=999999 # Max CT log results
DNS_TIME_FENCE_DAYS=0 # Filter CT to last N days (0=disabled)
SUBANALYTICS=true # Google Analytics
# Active techniques
SUBNOERROR=false # DNS NOERROR (can be slow)
SUBBRUTE=true # DNS bruteforcing
SUBSCRAPING=true # Web scraping
SUBPERMUTE=true # Permutations
SUBIAPERMUTE=true # AI permutations
SUBREGEXPERMUTE=true # Regex permutations
# Recursive
SUB_RECURSIVE_PASSIVE=false # Uses many API queries
DEEP_RECURSIVE_PASSIVE=10 # Top N for recursion
SUB_RECURSIVE_BRUTE=false # Very resource intensive
# Filtering
DEEP_WILDCARD_FILTER=false # Multi-level wildcard detection
EXCLUDE_SENSITIVE=false # Skip gov/mil/edu domains
# Other
SUBTAKEOVER=true # Takeover detection
ZONETRANSFER=true # Zone transfer
S3BUCKETS=true # S3 enumeration
REVERSE_IP=false # Enable for IP targets
INSCOPE=false # Scope filtering
# Permutation options
PERMUTATIONS_OPTION=gotator # or "ripgen"
GOTATOR_FLAGS=" -depth 1 -numbers 3 -mindup -adv -md"
```
***
## New Features (v3.x)
### Time Fencing (`DNS_TIME_FENCE_DAYS`)
Filters Certificate Transparency results to recent certificates only.
```bash
DNS_TIME_FENCE_DAYS=90 # Only certs from last 90 days
```
**Problem solved:** CT logs contain years of historical data including certificates for decommissioned infrastructure. This creates noise in results.
**Impact:** Typically reduces false positives by 20-40% on established targets.
### Deep Wildcard Detection (`DEEP_WILDCARD_FILTER`)
Detects wildcard DNS records at all subdomain levels, not just the root domain.
```bash
DEEP_WILDCARD_FILTER=true
```
**Problem solved:** Standard wildcard detection only checks `*.example.com`. Enterprise environments often have nested wildcards like `*.na45.salesforce.com` or `*.api.prod.example.com`.
**How it works:**
1. Extract unique parent domains from discovered subdomains
2. For each parent, generate a random probe: `randomstring.parent.example.com`
3. If the random probe resolves, that parent has a wildcard record
4. Remove all subdomains under wildcard parents
5. Repeat up to 5 iterations to catch multiple levels
**Output:** Detected wildcards are saved to `subdomains/wildcards_detected.txt`
**Impact:** Removes 50-80% false positives on enterprise targets with wildcard DNS.
### Sensitive Domain Exclusion (`EXCLUDE_SENSITIVE`)
Prevents scanning government, military, educational, and financial domains.
```bash
EXCLUDE_SENSITIVE=true
```
**Patterns file:** `config/sensitive_domains.txt`
**Excluded by default:**
* Government: `*.gov`, `*.gob.*`, `*.gouv.*`, `*.govt.*`
* Military: `*.mil`, `*.defense.*`, `*.army.*`
* Educational: `*.edu`, `*.ac.*`, `*.university.*`
* Financial: `*.bank`, `*.banking.*`
* Critical: `*.nhs.*`, `*.hospital.*`, `*.police.*`
**Use case:** When scanning wildcard scopes (e.g., `*.company.com`), this prevents accidental enumeration of acquired government or educational assets.
***
## Passive Enumeration
### `sub_passive` - API-Based Discovery
The primary passive enumeration function querying multiple data sources.
**Sources Queried:**
* Subfinder (50+ sources including):
* VirusTotal
* SecurityTrails
* Shodan
* Censys
* AlienVault
* Chaos
* And many more...
* GitHub subdomains
**How It Works:**
```
Target domain → subfinder (API queries) → github-subdomains →
→ Deduplicate → subdomains_passive.txt
```
**Output:**
```
subdomains/subdomains_passive.txt
```
**Configuration:**
```bash
SUBPASSIVE=true
SUBFINDER_ENUM_TIMEOUT=180 # Timeout in minutes
```
> **Tip:** Configure API keys in `~/.config/subfinder/provider-config.yaml` for better results.
***
### `sub_crt` - Certificate Transparency
Queries certificate transparency logs for issued certificates.
**How It Works:**
```
Target domain → crt.sh API → Parse certificates →
→ Extract subdomains → subdomains_crt.txt
```
**Output:**
```
subdomains/subdomains_crt.txt
```
**Sample Findings:**
```
www.example.com
api.example.com
mail.example.com
staging.example.com
*.dev.example.com # Wildcard certificates
```
**Configuration:**
```bash
SUBCRT=true
CTR_LIMIT=999999 # Max results to fetch
```
***
### `sub_analytics` - Google Analytics Correlation
Discovers related domains through shared Google Analytics IDs.
**How It Works:**
```
Target domain → Extract GA ID from website →
→ Find other domains with same GA ID → Output
```
**Output:**
```
subdomains/subdomains_analytics.txt
```
**Why It Works:** Organizations often use the same Google Analytics ID across multiple properties, revealing:
* Related domains
* Acquired companies
* Partner sites
* Development environments
**Configuration:**
```bash
SUBANALYTICS=true
```
***
## Active Enumeration
### `sub_brute` - DNS Bruteforcing
Performs DNS bruteforce using wordlists to discover subdomains.
**How It Works:**
```
Wordlist → Generate DNS queries → puredns (with resolvers) →
→ Filter wildcards → Validate responses → subdomains_brute.txt
```
**Wordlists Used:**
* Standard: `$subs_wordlist` (\~10k entries)
* Deep mode: `$subs_wordlist_big` (\~100k+ entries)
**Output:**
```
subdomains/subdomains_brute.txt
```
**Configuration:**
```bash
SUBBRUTE=true
subs_wordlist=${tools}/subdomains.txt
subs_wordlist_big=${tools}/subdomains_n0kovo_big.txt
# PureDNS settings
PUREDNS_PUBLIC_LIMIT=0 # 0 = unlimited
PUREDNS_TRUSTED_LIMIT=400
PUREDNS_WILDCARDTEST_LIMIT=30
```
> **Performance:** Bruteforcing can generate significant DNS traffic. Adjust rate limits for your environment.
***
### `sub_noerror` - DNS NOERROR Analysis
Discovers subdomains by analyzing DNS NOERROR responses (domain exists but no record type).
**How It Works:**
```
Known subdomains → Query non-existent record types →
→ NOERROR response = subdomain exists →
→ Bruteforce variations → New subdomains
```
**Why It Works:** Some DNS servers return NOERROR for existing domains even without specific records, revealing domains that standard bruteforce might miss.
**Output:**
```
subdomains/subdomains_noerror.txt
```
**Configuration:**
```bash
SUBNOERROR=false # Disabled by default (can be slow)
```
***
### `sub_scraping` - Web Scraping
Extracts subdomains from web pages, JavaScript files, and crawled content.
**How It Works:**
```
Known web servers → katana (crawl) →
→ Extract URLs → Parse for subdomains → Output
```
**What It Finds:**
* Links in HTML
* API endpoints in JavaScript
* References in source maps
* Hardcoded URLs
**Output:**
```
subdomains/subdomains_scraping.txt
```
**Configuration:**
```bash
SUBSCRAPING=true
KATANA_THREADS=20
```
***
### `sub_tls` - TLS Certificate Discovery
Discovers subdomains by connecting to TLS ports and extracting certificate information.
**How It Works:**
```
IP addresses → Connect to TLS ports →
→ Extract certificate CN/SAN → Filter in-scope → Output
```
**Ports Checked:**
```bash
TLS_PORTS="21,22,25,80,110,443,465,587,636,993,995,8443,..."
```
**Output:**
```
subdomains/subdomains_tls.txt
```
**Configuration:**
```bash
TLSX_THREADS=1000
```
***
## Permutation Techniques
### `sub_permut` - Standard Permutations
Generates subdomain variations from discovered subdomains.
**Permutation Types:**
* Prefix: `dev-api`, `staging-api`, `api-v2`
* Suffix: `api-dev`, `api-staging`, `api-2`
* Word insertion: `api-internal`, `api-test`
* Number variations: `api1`, `api2`, `api3`
**Tools:**
* **gotator**: Deep permutations (slower, more thorough)
* **ripgen**: Fast permutations (faster, less thorough)
**How It Works:**
```
Known subdomains → gotator/ripgen → Generate permutations →
→ puredns (resolve) → Filter valid → Output
```
**Output:**
```
subdomains/subdomains_permut.txt
```
**Configuration:**
```bash
SUBPERMUTE=true
PERMUTATIONS_OPTION=gotator # or "ripgen"
GOTATOR_FLAGS=" -depth 1 -numbers 3 -mindup -adv -md"
PERMUTATIONS_LIMIT=21474836480 # Max file size (20GB)
```
***
### `sub_ia_permut` - AI-Powered Permutations
Uses machine learning to generate intelligent permutations based on patterns.
**How It Works:**
```
Known subdomains → subwiz (AI model) →
→ Learn patterns → Generate smart variations → Resolve → Output
```
**Output:**
```
subdomains/subdomains_ai_permut.txt
```
**Configuration:**
```bash
SUBIAPERMUTE=true
```
***
### `sub_regex_permut` - Regex-Based Permutations
Analyzes subdomain patterns and generates variations using regex.
**How It Works:**
```
Known subdomains → regulator (pattern analysis) →
→ Generate regex-based variations → Resolve → Output
```
**Output:**
```
subdomains/subdomains_regex_permut.txt
```
**Configuration:**
```bash
SUBREGEXPERMUTE=true
```
***
## Recursive Enumeration
### `sub_recursive_passive`
Performs passive enumeration on discovered subdomains.
**How It Works:**
```
Top N subdomains (by depth) → Run sub_passive on each →
→ Combine results → More subdomains
```
**Example:**
```
example.com → api.example.com, dev.example.com
api.example.com → internal.api.example.com, v2.api.example.com
```
**Configuration:**
```bash
SUB_RECURSIVE_PASSIVE=false # Disabled by default (API heavy)
DEEP_RECURSIVE_PASSIVE=10 # Top N subdomains for recursion
```
> **Warning:** This uses many API queries. Ensure you have adequate API credits.
***
### `sub_recursive_brute`
Performs DNS bruteforce on discovered subdomains.
**How It Works:**
```
Top N subdomains → Bruteforce each with wordlist →
→ Combine results → Even more subdomains
```
**Configuration:**
```bash
SUB_RECURSIVE_BRUTE=false # Disabled by default (very slow)
```
> **Warning:** This is extremely resource-intensive. Only enable for high-value targets.
***
## DNS Analysis
### `sub_dns` - DNS Resolution
Resolves all discovered subdomains to IP addresses and extracts DNS records.
**Records Extracted:**
* A records (IPv4)
* AAAA records (IPv6)
* CNAME records
* MX records
* TXT records
* NS records
**Output:**
```
subdomains/subdomains.txt # Final subdomain list
subdomains/subdomains_dnsrecords.txt # Full DNS records
hosts/ips.txt # Resolved IP addresses
```
**Sample DNS Records Output:**
```
api.example.com [A] 192.168.1.10
api.example.com [CNAME] api.example.com.cdn.cloudflare.net
mail.example.com [MX] 10 mail.example.com
mail.example.com [A] 192.168.1.20
```
**Configuration:**
```bash
RESOLVE_DOMAINS_THREADS=150
```
***
## Security Checks
### `subtakeover` - Subdomain Takeover Detection
Identifies subdomains vulnerable to takeover.
**What It Checks:**
* Dangling CNAME records
* Unclaimed cloud resources
* Expired services
* Misconfigured DNS
**Tools Used:**
* **nuclei**: Takeover templates
* **dnstake**: Additional checks
**How It Works:**
```
Subdomains → Check CNAME targets →
→ Verify if target is claimable → Report vulnerable
```
**Output:**
```
webs/takeover.txt
```
**Sample Output:**
```
[TAKEOVER] old-app.example.com → herokuapp.com (No such app)
[TAKEOVER] cdn.example.com → cloudfront.net (Bad request)
```
**Configuration:**
```bash
SUBTAKEOVER=true
DNSTAKE_THREADS=100
```
***
### `zonetransfer` - DNS Zone Transfer
Checks if DNS servers allow zone transfers (AXFR).
**What It Does:** Attempts zone transfer against all NS records. Successful transfers reveal all DNS records.
**Output:**
```
subdomains/subdomains_zonetransfer.txt
```
**Configuration:**
```bash
ZONETRANSFER=true
```
> **Note:** Zone transfers are rarely successful but when they work, they reveal everything.
***
### `s3buckets` - S3 Bucket Enumeration
Discovers S3 buckets related to the target.
**Tools Used:**
* **S3Scanner**: Bucket discovery and permission check
* **CloudHunter**: Additional cloud enumeration
**Output:**
```
subdomains/s3buckets.txt
```
**Sample Output:**
```
[PUBLIC-READ] example-backups.s3.amazonaws.com
[PUBLIC-LIST] example-assets.s3.amazonaws.com
[PRIVATE] example-data.s3.amazonaws.com
```
**Configuration:**
```bash
S3BUCKETS=true
CLOUDHUNTER_PERMUTATION=NORMAL # DEEP, NORMAL, or NONE
```
***
## Data Flow
```
┌─────────────────────────────────────────────────────────────────────┐
│ Subdomain Enumeration Flow │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌────────────┐ ┌────────────┐ ┌────────────┐ │
│ │ Passive │ │ Active │ │ Permutations│ │
│ │ sub_passive│ │ sub_brute │ │ sub_permut │ │
│ │ sub_crt │ │ sub_noerror│ │ sub_ia_perm │ │
│ │ sub_analyt │ │ sub_scrape │ │ sub_regex │ │
│ └─────┬──────┘ └─────┬──────┘ └─────┬───────┘ │
│ │ │ │ │
│ └────────────────┼────────────────┘ │
│ ▼ │
│ ┌──────────────────┐ │
│ │ Combine All │ │
│ │ Deduplicate │ │
│ └────────┬─────────┘ │
│ ▼ │
│ ┌──────────────────┐ │
│ │ sub_dns │ │
│ │ DNS Resolution │ │
│ └────────┬─────────┘ │
│ ▼ │
│ ┌───────────────┼───────────────┐ │
│ ▼ ▼ ▼ │
│ ┌──────────┐ ┌──────────────┐ ┌──────────┐ │
│ │subdomains│ │ DNS Records │ │ IPs │ │
│ │ .txt │ │ .txt │ │ .txt │ │
│ └──────────┘ └──────────────┘ └──────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘
```
***
## Output Files Summary
| File | Content |
| ---------------------------------------- | ---------------------------------- |
| `subdomains/subdomains.txt` | Final deduplicated subdomain list |
| `subdomains/subdomains_passive.txt` | Passive enumeration results |
| `subdomains/subdomains_crt.txt` | Certificate transparency results |
| `subdomains/subdomains_brute.txt` | Bruteforce results |
| `subdomains/subdomains_permut.txt` | Permutation results |
| `subdomains/subdomains_scraping.txt` | Web scraping results |
| `subdomains/subdomains_analytics.txt` | Analytics correlation |
| `subdomains/subdomains_tls.txt` | TLS discovery results |
| `subdomains/subdomains_dnsrecords.txt` | Full DNS records |
| `subdomains/subdomains_zonetransfer.txt` | Zone transfer results |
| `subdomains/s3buckets.txt` | S3 bucket enumeration |
| `hosts/ips.txt` | Resolved IP addresses |
| `webs/takeover.txt` | Subdomain takeover vulnerabilities |
***
## Running Subdomain Enumeration Only
```bash
# Quick subdomain enumeration
./reconftw.sh -d example.com -s
# With deep mode
./reconftw.sh -d example.com -s --deep
```
***
## Best Practices
1. **Use Fresh Resolvers:** Update resolvers regularly for accurate results
2. **Enable API Keys:** Configure subfinder providers for full coverage
3. **Adjust Threads:** Balance speed vs. accuracy based on target size
4. **Monitor Resources:** Bruteforce and permutations can use significant disk/memory
5. **Review Wildcards:** Check for wildcard DNS that may cause false positives
6. **Verify Takeovers:** Always manually verify takeover vulnerabilities before reporting
***
## Next Steps
* [**Web Analysis Module**](/modules/web-analysis) - Analyze discovered web assets
* [**Host Module**](/modules/hosts) - Port scanning and host analysis
* [**Output Interpretation**](/output/output) - Understand your results
# Subdomain Deep Dive
This guide explains the technical foundations behind each subdomain enumeration technique used in reconFTW.
***
## Execution Pipeline
reconFTW executes subdomain enumeration in a specific order based on data dependencies:
```
Phase 1: Passive Sources (no target contact)
├── sub_passive → API queries (subfinder, github-subdomains)
└── sub_crt → Certificate Transparency logs
Phase 2: DNS Resolution (validates passive results)
├── sub_active → Resolve collected subdomains with puredns
├── sub_noerror → DNSSEC NOERROR response analysis
└── sub_dns → DNS record extraction
Phase 3: Post-Resolution Analysis (requires resolved subdomains)
├── sub_tls → TLS certificate extraction from live hosts
└── sub_analytics → Google Analytics ID correlation
Phase 4: Bruteforce (resource intensive)
├── sub_brute → DNS bruteforce with wordlists
├── sub_permut → Permutation generation (gotator/ripgen)
├── sub_regex_permut → Regex-based pattern permutations
└── sub_ia_permut → AI-powered permutation generation
Phase 5: Recursive (multiplies work)
├── sub_recursive_passive → Passive enum on discovered subdomains
├── sub_recursive_brute → Bruteforce on discovered subdomains
└── sub_scraping → Web scraping for subdomain extraction
```
***
## Passive Techniques
### sub\_passive
Queries multiple APIs and databases that aggregate DNS data globally.
**Tools used:**
* `subfinder` - Queries 50+ passive sources
* `github-subdomains` - Searches GitHub code for subdomains
* `gitlab-subdomains` - Searches GitLab code for subdomains
**Data sources include:**
* SecurityTrails, VirusTotal, AlienVault OTX
* Shodan, Censys, BinaryEdge
* Wayback Machine, Common Crawl
* DNS aggregators (DNSDB, PassiveTotal)
**Why multiple sources:** Each source has different coverage. A subdomain may appear in VirusTotal but not SecurityTrails. Combining sources maximizes discovery.
### sub\_crt
Queries Certificate Transparency (CT) logs via crt.sh API.
**How CT works:**
* Certificate Authorities must log every issued certificate to public logs
* Logs are append-only and publicly queryable
* Certificates contain Subject Alternative Names (SANs) listing all domains
**What it reveals:**
* Internal subdomains (admins often request certs for internal tools)
* Wildcard certificate patterns
* Historical infrastructure (old certificates remain in logs)
**Time fencing (`DNS_TIME_FENCE_DAYS`):**
```bash
# Filter to last 90 days
DNS_TIME_FENCE_DAYS=90
```
CT logs contain years of historical data. Time fencing filters results to recent certificates, reducing dead subdomain noise.
**Implementation:**
```bash
crt -s -json -l "${CTR_LIMIT}" "$domain" \
| jq -r --arg cutoff "$cutoff_date" \
'[.[] | select(.not_before >= $cutoff)] | .[].subdomain'
```
***
## Active DNS Resolution
### sub\_active
Resolves all collected subdomains to filter non-existent ones.
**Tool used:** `puredns` with massdns backend
**Process:**
1. Combine all passive results into single file
2. Resolve against trusted resolvers
3. Filter wildcards using random probe technique
4. Output only subdomains that resolve
**Wildcard handling:**
```bash
puredns resolve input.txt \
--wildcard-tests 30 \
--wildcard-batch 1500000 \
-r "$resolvers_trusted"
```
**Why wildcard detection matters:** A wildcard DNS record (`*.example.com`) returns a valid response for ANY subdomain. Without filtering, you get thousands of false positives.
### sub\_noerror
Exploits DNSSEC NOERROR responses to enumerate subdomains.
**Technical background:**
* Normal DNS returns NXDOMAIN for non-existent domains
* Some DNSSEC-signed zones return NOERROR instead (black lies technique)
* This allows enumeration via response code analysis
**When useful:**
* Targets with DNSSEC-signed zones
* Can find subdomains not in any passive source
### sub\_dns
Extracts additional information from DNS records.
**Records analyzed:**
* A/AAAA → IP addresses
* CNAME → Alias targets (potential takeover)
* MX → Mail servers
* TXT → SPF, DKIM, verification records
* NS → Nameservers
***
## Post-Resolution Techniques
### sub\_tls
Connects to discovered hosts and extracts TLS certificate SANs.
**Tool used:** `tlsx`
**Ports checked:**
```bash
TLS_PORTS="21,22,25,80,110,135,143,261,443,465,563,587,636,853,990,993,995,..."
```
**What it finds:**
* Additional domains sharing the same certificate
* Internal names in SAN fields
* Related infrastructure
**Why run after resolution:** Requires IP addresses from resolved subdomains. Must run after `sub_active`.
### sub\_analytics
Finds domains sharing the same Google Analytics or Tag Manager ID.
**Tool used:** `AnalyticsRelationships`
**How it works:**
1. Extract analytics IDs from resolved web pages
2. Query databases for other domains with same ID
3. Related domains likely owned by same organization
**Why run after resolution:** Requires web-accessible hosts to extract analytics IDs.
***
## Bruteforce Techniques
### sub\_brute
DNS bruteforce using wordlists.
**Tool used:** `puredns` with optimized wordlists
**Wordlist strategy:**
* Default: `~100K` common subdomain names
* DEEP mode: `~1M+` extended wordlist
**When useful:**
* New subdomains not yet indexed by passive sources
* Internal naming conventions (dev, staging, prod)
* Non-web services without certificates
### sub\_permut
Generates permutations based on discovered subdomains.
**Tool used:** `gotator` or `ripgen`
**Example:**
```
Found: api-v1.example.com
Generates:
- api-v2.example.com
- api-v3.example.com
- api-dev.example.com
- api-staging.example.com
- api-prod.example.com
```
**Configuration:**
```bash
PERMUTATIONS_OPTION=gotator # Deeper but slower
PERMUTATIONS_OPTION=ripgen # Faster but less thorough
```
### sub\_regex\_permut
Uses regex pattern learning to generate permutations.
**Tool used:** `regulator`
**How it works:**
1. Analyze discovered subdomain patterns
2. Learn regex rules from patterns
3. Generate new candidates matching rules
### sub\_ia\_permut
AI-powered permutation generation.
**Tool used:** `subwiz`
**Approach:** Uses machine learning models trained on subdomain patterns to generate likely candidates.
***
## Deep Wildcard Detection
Standard wildcard detection only checks the root level (`*.example.com`). Enterprise environments often have nested wildcards.
**Problem example:**
```
*.na45.salesforce.com → All subdomains under na45 resolve
*.api.prod.example.com → All API subdomains in prod resolve
```
**How `deep_wildcard_filter()` works:**
```
Iteration 1:
Input: a.b.c.example.com, x.b.c.example.com, y.c.example.com
Test: random123.b.c.example.com
Result: Resolves → b.c.example.com is wildcard
Filter: Remove all *.b.c.example.com
Iteration 2:
Input: y.c.example.com
Test: random456.c.example.com
Result: Does not resolve → c.example.com is not wildcard
Filter: Keep y.c.example.com
Final: y.c.example.com
```
**Implementation details:**
* Maximum 5 iterations
* Uses `dnsx` with trusted resolvers
* Random probe: 12-character alphanumeric string
* Results saved to `subdomains/wildcards_detected.txt`
***
## Sensitive Domain Exclusion
The `_is_sensitive_domain()` function checks domains against patterns in `config/sensitive_domains.txt`.
**Pattern format:**
```
*.gov → Matches any .gov domain
*.gov.* → Matches any .gov.XX domain
*.mil → Matches military domains
*.edu → Matches educational domains
```
**Matching logic:**
```bash
# Wildcard pattern (*.gov)
if [[ "$domain" == *".$suffix" ]] || [[ "$domain" == "$suffix" ]]; then
return 0 # Is sensitive
fi
```
**Use case:** When scanning wildcard scopes, prevents enumeration of government or military subdomains that may be part of the target's acquired assets.
***
## Output Files
| File | Description |
| ----------------------------------- | ------------------------------------------- |
| `subdomains/subdomains.txt` | Final deduplicated subdomain list |
| `subdomains/subdomains_new.txt` | New subdomains since last run (incremental) |
| `subdomains/wildcards_detected.txt` | Detected wildcard parent domains |
| `.tmp/passive_subs.txt` | Raw passive enumeration results |
| `.tmp/crtsh_subs.txt` | Certificate transparency results |
| `.tmp/subs_no_resolved.txt` | Subdomains before resolution |
***
## Performance Considerations
| Technique | Speed | Resource Usage | When to Disable |
| ---------------------- | --------- | --------------- | --------------- |
| sub\_passive | Fast | Low (API calls) | Never |
| sub\_crt | Fast | Low | Never |
| sub\_active | Medium | Medium | Never |
| sub\_brute | Slow | High | Large targets |
| sub\_permut | Slow | High | Large targets |
| sub\_recursive\_\* | Very slow | Very high | Most scans |
| DEEP\_WILDCARD\_FILTER | Medium | Medium | Small targets |
**Parallel mode (`--parallel`):** Runs independent functions concurrently. Phases maintain dependencies:
1. Passive functions run in parallel
2. Wait for passive to complete
3. Active functions run in parallel
4. Post-active functions run after resolution
5. Bruteforce runs with limited parallelism (resource intensive)
# Web Analysis Module
The web analysis module examines discovered web assets to identify technologies, extract content, and prepare targets for vulnerability testing.
***
## Why Web Analysis?
Before scanning for vulnerabilities, you need to understand what you're scanning:
1. **Target Validation**: Not all subdomains run web servers. HTTP probing identifies which hosts actually serve web content on which ports.
2. **Technology Fingerprinting**: Different technologies have different vulnerabilities. Knowing that a target runs WordPress vs Django changes your attack approach.
3. **Attack Surface Mapping**: URL collection reveals:
* Hidden endpoints not linked in the UI
* API routes
* Admin panels
* Legacy code paths
4. **Input Discovery**: Parameters and endpoints found here become test targets for vulnerability scanning. Without URL collection, scanners miss most of the attack surface.
5. **Efficiency**: Analyzing JavaScript and crawling once, then reusing results for multiple vulnerability tests, is more efficient than having each scanner crawl independently.
***
## Module Overview
| Function | Purpose | Tools |
| --------------------------- | --------------------------------- | ------------------------------------ |
| `webprobe_simple` | Probe ports 80/443 | httpx |
| `webprobe_full` | Probe uncommon web ports | httpx |
| `screenshot` | Capture web screenshots | nuclei |
| `virtualhosts` | Virtual host discovery | VhostFinder |
| `urlchecks` | URL collection (passive + active) | urlfinder, katana, JSA |
| `url_gf` | URL pattern classification | gf, urless |
| `url_ext` | File extension sorting | custom |
| `jschecks` | JavaScript analysis | subjs, xnLinkFinder, mantra, jsluice |
| `fuzz` | Directory fuzzing | ffuf |
| `cms_scanner` | CMS detection | CMSeeK |
| `wordlist_gen` | Custom wordlist generation | custom |
| `wordlist_gen_roboxtractor` | Robots.txt wordlist | roboxtractor |
| `password_dict` | Password dictionary generation | pydictor |
| `iishortname` | IIS shortname scanning | shortscan, sns |
| `graphql_scan` | GraphQL endpoint detection | nuclei, GQLSpection |
| `grpc_reflection` | gRPC reflection probing | grpcurl |
| `param_discovery` | Parameter discovery | arjun |
| `websocket_checks` | WebSocket auditing | custom |
***
## Configuration Options
```bash
# In reconftw.cfg
# Web probing
WEBPROBESIMPLE=true # Probe 80/443
WEBPROBEFULL=true # Probe uncommon ports
WEBSCREENSHOT=true # Screenshots
VIRTUALHOSTS=false # Virtual host fuzzing
# URL analysis
URL_CHECK=true # URL collection
URL_CHECK_PASSIVE=true # Passive URL sources
URL_CHECK_ACTIVE=true # Active crawling
URL_GF=true # Pattern matching
URL_EXT=true # Extension sorting
# JavaScript
JSCHECKS=true # JS analysis
XNLINKFINDER_DEPTH=3 # Link finder depth
# Fuzzing
FUZZ=true # Directory fuzzing
FFUF_THREADS=40
FFUF_RATELIMIT=0
FFUF_MAXTIME=900
FFUF_FLAGS=" -mc all -fc 404 -sf -noninteractive -of json"
# CMS
CMS_SCANNER=true
CMSSCAN_TIMEOUT=3600
# Other
WORDLIST=true
ROBOTSWORDLIST=true # Robots.txt wordlist generation
PASSWORD_DICT=true # Password dictionary generation
PASSWORD_MIN_LENGTH=5 # Min password length
PASSWORD_MAX_LENGTH=14 # Max password length
IIS_SHORTNAME=true
GRAPHQL_CHECK=true
GQLSPECTION=false
PARAM_DISCOVERY=true
GRPC_SCAN=false # gRPC reflection probing
```
***
## HTTP Probing
### `webprobe_simple` - Standard Port Probing
Identifies live web servers on standard ports (80, 443).
**How It Works:**
```
Subdomains → httpx (80, 443) → Filter responses →
→ Extract metadata → webs.txt
```
**Information Extracted:**
* Status codes
* Page titles
* Web server type
* Technologies detected
* Content length
* Redirect locations
**Output:**
```
webs/webs.txt # Live web servers
webs/webs_info.txt # Detailed probe results
```
**Sample Output (webs\_info.txt):**
```
https://www.example.com [200] [Example Site] [nginx] [PHP,WordPress]
https://api.example.com [401] [API Gateway] [cloudflare]
https://admin.example.com [403] [Forbidden] [Apache]
```
**Configuration:**
```bash
WEBPROBESIMPLE=true
HTTPX_THREADS=50
HTTPX_RATELIMIT=150
HTTPX_TIMEOUT=10
HTTPX_FLAGS=" -follow-redirects -random-agent -status-code -silent -title -web-server -tech-detect -location -content-length"
```
***
### `webprobe_full` - Uncommon Port Probing
Probes an extended list of ports commonly used for web services.
**Ports Checked:**
```
81,300,591,593,832,981,1010,1311,1099,2082,2095,2096,2480,3000,
3001,3002,3003,3128,3333,4243,4567,4711,4712,4993,5000,5104,5108,
5280,5281,5601,5800,6543,7000,7001,7396,7474,8000,8001,8008,8014,
8042,8060,8069,8080,8081,8083,8088,8090,8091,8095,8118,8123,8172,
8181,8222,8243,8280,8281,8333,8337,8443,8500,8834,8880,8888,8983,
9000,9001,9043,9060,9080,9090,9091,9092,9200,9443,9502,9800,9981,
10000,10250,11371,12443,15672,16080,17778,18091,18092,20720,32000,
55440,55672
```
**Output:**
```
webs/webs_uncommon_ports.txt
```
**Configuration:**
```bash
WEBPROBEFULL=true
HTTPX_UNCOMMONPORTS_THREADS=100
HTTPX_UNCOMMONPORTS_TIMEOUT=10
UNCOMMON_PORTS_WEB="81,300,591,..."
```
***
## Screenshots
### `screenshot` - Web Screenshot Capture
Captures screenshots of all discovered web servers for visual analysis.
**How It Works:**
```
webs.txt → nuclei (headless browser) → PNG screenshots
```
**Output:**
```
screenshots/
├── screenshot_www.example.com_443.png
├── screenshot_api.example.com_443.png
├── screenshot_admin.example.com_8080.png
└── hashes.txt # For change detection
```
**Change Detection:**
reconFTW creates SHA256 hashes of screenshots to detect visual changes between scans:
```
screenshots/hashes.txt # Current scan hashes
screenshots/hashes_prev.txt # Previous scan hashes
screenshots/diff_changed.txt # Changed screenshots
```
**Configuration:**
```bash
WEBSCREENSHOT=true
```
***
## Virtual Hosts
### `virtualhosts` - Virtual Host Discovery
Discovers virtual hosts by fuzzing the HTTP Host header.
**How It Works:**
```
IP addresses → Fuzz Host header with subdomain wordlist →
→ Compare responses → Identify unique virtual hosts
```
**Why It's Useful:** Many servers host multiple websites on the same IP. Virtual host fuzzing reveals:
* Hidden admin panels
* Development sites
* Internal applications
* Additional attack surface
**Output:**
```
webs/virtualhosts.txt
```
**Configuration:**
```bash
VIRTUALHOSTS=false # Disabled by default (can be slow)
```
***
## URL Collection
### `urlchecks` - Full URL Extraction
Collects URLs from multiple sources for full coverage.
**Passive Sources:**
* Wayback Machine
* Common Crawl
* AlienVault OTX
* URLScan.io
**Active Sources:**
* Katana web crawler
* JavaScript parsing
* Sitemap analysis
**How It Works:**
```
┌─────────────────┐
│ webs.txt │
└────────┬────────┘
│
┌─────────────────┼─────────────────┐
▼ ▼ ▼
┌──────────┐ ┌──────────┐ ┌──────────┐
│ urlfinder│ │ katana │ │ JSA │
│ (passive)│ │ (active) │ │ (JS URLs)│
└────┬─────┘ └────┬─────┘ └────┬─────┘
│ │ │
└────────────────┼────────────────┘
▼
┌──────────────────┐
│ Combine & Dedup │
└────────┬─────────┘
▼
┌──────────────────┐
│ url_extract.txt │
└──────────────────┘
```
**Output:**
```
webs/url_extract.txt # All discovered URLs
webs/url_extract_comb.txt # Combined and cleaned
```
**Configuration:**
```bash
URL_CHECK=true
URL_CHECK_PASSIVE=true
URL_CHECK_ACTIVE=true
KATANA_THREADS=20
```
***
### `url_gf` - URL Pattern Classification
Classifies URLs by potential vulnerability patterns using gf patterns.
**Patterns Detected:**
| Pattern | Description |
| ------------- | -------------------------------- |
| `xss` | Potential XSS parameters |
| `sqli` | SQL injection candidates |
| `ssrf` | SSRF-prone URLs |
| `redirect` | Open redirect parameters |
| `rce` | Command injection candidates |
| `lfi` | Local file inclusion |
| `ssti` | Template injection |
| `idor` | Insecure direct object reference |
| `debug_logic` | Debug/admin endpoints |
**Output:**
```
gf/
├── xss.txt
├── sqli.txt
├── ssrf.txt
├── redirect.txt
├── rce.txt
├── lfi.txt
├── ssti.txt
├── idor.txt
└── debug_logic.txt
```
**Sample XSS Pattern Match:**
```
https://example.com/search?q=test
https://example.com/page?msg=hello
https://example.com/api?callback=func
```
**Configuration:**
```bash
URL_GF=true
```
***
### `url_ext` - File Extension Sorting
Organizes URLs by file extension for targeted analysis.
**Categories:**
```
webs/urls_by_extension/
├── js.txt # JavaScript files
├── json.txt # JSON endpoints
├── php.txt # PHP files
├── asp.txt # ASP/ASPX files
├── jsp.txt # JSP files
├── xml.txt # XML files
├── pdf.txt # PDF documents
├── config.txt # Configuration files
└── backup.txt # Backup files
```
**Configuration:**
```bash
URL_EXT=true
```
***
## JavaScript Analysis
### `jschecks` - Full JS Analysis
Extracts secrets, endpoints, and sensitive information from JavaScript files.
**What It Finds:**
* API keys and tokens
* AWS credentials
* Internal endpoints
* Hardcoded passwords
* Debug information
* Hidden functionality
**Tools Used:**
* **subjs**: JS file discovery
* **xnLinkFinder**: Endpoint extraction
* **mantra**: Secret patterns
* **jsluice**: Advanced JS parsing
* **nuclei**: JS secret templates
* **sourcemapper**: Source map extraction
**How It Works:**
```
webs.txt → subjs (find JS files) → Download JS →
→ Multiple analyzers → Extract secrets/endpoints → Output
```
**Output:**
```
js/
├── js_livelinks.txt # Extracted endpoints
├── js_secrets.txt # Discovered secrets
├── js_secrets_jsmap.txt # Sourcemap secrets
├── js_secrets_jsluice.txt # jsluice findings
└── js_getjswords.txt # Wordlist from JS
```
**Sample Secrets Found:**
```
[AWS_ACCESS_KEY] AKIA... in https://example.com/app.js
[API_KEY] sk_live_... in https://example.com/config.js
[PRIVATE_KEY] -----BEGIN RSA PRIVATE KEY----- in /bundle.js
```
**Configuration:**
```bash
JSCHECKS=true
XNLINKFINDER_DEPTH=3
NUCLEI_FLAGS_JS="-silent -tags exposure,token -severity info,low,medium,high,critical"
```
***
## Directory Fuzzing
### `fuzz` - Web Directory Fuzzing
Discovers hidden directories, files, and endpoints.
**How It Works:**
```
webs.txt → ffuf (with wordlist) → Filter responses →
→ Identify interesting paths → Output
```
**Wordlists:**
* Primary: `$fuzz_wordlist`
* Custom generated from target
**Output:**
```
fuzzing/
├── fuzzing_full.json # Complete results
└── fuzzing_interesting.txt # Filtered findings
```
**Sample Findings:**
```
/admin [200] [Admin Panel]
/backup [403] [Forbidden]
/.git/config [200] [Git Config]
/api/swagger [200] [Swagger UI]
/phpinfo.php [200] [PHP Info]
```
**Configuration:**
```bash
FUZZ=true
FFUF_THREADS=40
FFUF_RATELIMIT=0
FFUF_MAXTIME=900
FFUF_FLAGS=" -mc all -fc 404 -sf -noninteractive -of json"
fuzz_wordlist=${tools}/fuzz_wordlist.txt
```
***
## CMS Detection
### `cms_scanner` - CMS Identification
Identifies content management systems and their versions.
**CMS Detected:**
* WordPress
* Joomla
* Drupal
* Magento
* Shopify
* And 170+ more...
**Information Extracted:**
* CMS type and version
* Installed plugins/themes
* Known vulnerabilities
* Configuration issues
**Output:**
```
webs/cms_scanner.txt
```
**Sample Output:**
```
[WordPress] https://blog.example.com
Version: 6.2.1
Plugins: contact-form-7, yoast-seo
Theme: flavor
Users: admin, editor
[Drupal] https://cms.example.com
Version: 9.4.0
Modules: views, pathauto
```
**Configuration:**
```bash
CMS_SCANNER=true
CMSSCAN_TIMEOUT=3600
```
***
## Advanced Analysis
### `iishortname` - IIS Shortname Scanner
Exploits IIS shortname vulnerability to discover hidden files/directories.
**How It Works:**
Windows IIS servers may expose 8.3 format filenames through timing attacks, revealing:
* Hidden directories
* Backup files
* Configuration files
**Output:**
```
webs/iis_shortname.txt
```
**Sample Output:**
```
[FOUND] /BACKUP~1 -> likely: /backups, /backup_old
[FOUND] /CONFIG~1 -> likely: /config, /configuration
[FOUND] /ASPNET~1 -> likely: /aspnet_client
```
**Configuration:**
```bash
IIS_SHORTNAME=true
```
***
### `graphql_scan` - GraphQL Endpoint Detection
Discovers and analyzes GraphQL endpoints.
**What It Checks:**
* `/graphql`
* `/graphiql`
* `/api/graphql`
* Custom endpoints
**Analysis:**
* Introspection enabled?
* Schema extraction
* Query suggestions
**Output:**
```
webs/graphql_endpoints.txt
webs/graphql_introspection.json # If GQLSPECTION enabled
```
**Configuration:**
```bash
GRAPHQL_CHECK=true
GQLSPECTION=false # Deep introspection (heavier)
```
***
### `param_discovery` - Parameter Discovery
Discovers hidden parameters on web endpoints.
**How It Works:**
```
URLs with parameters → arjun → Fuzz parameter names →
→ Identify valid parameters → Output
```
**Output:**
```
webs/param_discovery.txt
```
**Sample Output:**
```
https://api.example.com/search
Found: q, page, limit, sort, debug, admin
https://example.com/user
Found: id, action, redirect, token
```
**Configuration:**
```bash
PARAM_DISCOVERY=true
ARJUN_THREADS=10
```
***
## Wordlist Generation
### `wordlist_gen` - Custom Wordlist Creation
Generates target-specific wordlists from discovered content.
**Sources:**
* JavaScript content
* HTML content
* URL paths
* Parameter names
* Domain-specific terms
**Output:**
```
webs/wordlist_custom.txt
```
**Configuration:**
```bash
WORDLIST=true
PASSWORD_DICT=true
PASSWORD_MIN_LENGTH=5
PASSWORD_MAX_LENGTH=14
```
***
### `wordlist_gen_roboxtractor` - Robots.txt Analysis
Extracts historical disallowed paths from Wayback Machine.
**How It Works:**
```
Target domain → Wayback Machine → Historical robots.txt →
→ Extract disallow paths → Custom wordlist
```
**Output:**
```
webs/robots_wordlist.txt
```
**Configuration:**
```bash
ROBOTSWORDLIST=true
```
***
### `password_dict` - Password Dictionary Generation
Generates target-specific password lists based on the domain name.
**How It Works:**
```
Domain name → Extract keywords → pydictor →
→ Apply leetspeak variations → Password wordlist
```
The function takes the first part of the domain (e.g., "target" from "target.com") and generates password variations using:
* Leetspeak transformations (a→4, e→3, etc.)
* Common suffixes (123, !, 2024, etc.)
* Length constraints
**Output:**
```
webs/password_dict.txt
```
**Sample Output (for target.com):**
```
target
Target
TARGET
t4rget
targ3t
target123
Target2024!
T4rg3t!
```
**Configuration:**
```bash
PASSWORD_DICT=true
PASSWORD_MIN_LENGTH=5 # Minimum password length
PASSWORD_MAX_LENGTH=14 # Maximum password length
```
**Use Cases:**
* Password spraying attacks (with authorization)
* Testing default/weak credential policies
* Generating custom wordlists for brute-force
***
### `grpc_reflection` - gRPC Reflection Probing
Discovers gRPC services with reflection enabled.
**What is gRPC Reflection?**
gRPC reflection allows clients to query a server for available services and methods without prior knowledge. When enabled (often for debugging), it exposes the entire API surface.
**How It Works:**
```
IPs from hosts/ips.txt → Probe gRPC ports (50051, 50052) →
→ grpcurl reflection query → List available services
```
**Output:**
```
hosts/grpc_reflection.txt
```
**Sample Output:**
```
[192.168.1.10:50051] grpc.reflection.v1alpha.ServerReflection
[192.168.1.10:50051] helloworld.Greeter
[192.168.1.10:50051] api.UserService
[192.168.1.10:50051] api.AdminService
```
**Configuration:**
```bash
GRPC_SCAN=false # Disabled by default (requires grpcurl)
```
**Security Implications:**
* Exposed reflection reveals internal API structure
* Service names may reveal business logic
* Combined with protobuf enumeration = full API mapping
**Requirements:**
* `grpcurl` installed
* Network access to gRPC ports
***
## Output Summary
| File | Content |
| ---------------------- | ------------------------- |
| `webs/webs.txt` | Live web servers |
| `webs/webs_info.txt` | Detailed probe results |
| `webs/url_extract.txt` | All discovered URLs |
| `screenshots/` | Web screenshots |
| `gf/*.txt` | Pattern-classified URLs |
| `js/js_secrets.txt` | JavaScript secrets |
| `fuzzing/` | Directory fuzzing results |
| `webs/cms_scanner.txt` | CMS detection results |
***
## Best Practices
1. **Rate Limiting:** Respect target resources with appropriate rate limits
2. **Scope Filtering:** Use `-x` flag to exclude out-of-scope URLs
3. **Screenshot Review:** Visual inspection often reveals interesting assets
4. **JS Analysis Priority:** JavaScript often contains the most valuable secrets
5. **Custom Wordlists:** Generated wordlists improve fuzzing effectiveness
***
## Next Steps
* [**Vulnerability Module**](/modules/vulnerabilities) - Test for security issues
* [**Output Interpretation**](/output/output) - Understand results
# Vulnerability Module
The vulnerability module performs active security testing to identify exploitable weaknesses. This module requires explicit authorization as it performs intrusive testing.
***
## ⚠️ Important Warning
> **LEGAL NOTICE:** This module performs active security testing that may:
>
> * Send malicious payloads to targets
> * Attempt to exploit vulnerabilities
> * Trigger security alerts
> * Potentially cause service disruption
>
> **Only use with explicit written authorization.**
***
## Why This Order of Tests?
Vulnerability checks run last in reconFTW's pipeline for important reasons:
1. **Dependency Chain**: Tests require data from previous phases:
* URLs from web analysis → XSS, SQLi, LFI testing
* Parameters from param\_discovery → Injection point testing
* JavaScript analysis → Prototype pollution candidates
2. **Detection Risk**: Vuln scanning generates suspicious traffic:
* SQL injection payloads like `' OR 1=1--`
* XSS payloads with `
Type: Reflected
Parameter: q
Payload: ">
```
**Configuration:**
```bash
XSS=true
XSS_SERVER="https://your.xss.hunter" # For blind XSS
DALFOX_THREADS=200
```
***
### `sqli` - SQL Injection
Tests for SQL injection using SQLMap and optionally Ghauri.
**How It Works:**
```
URLs with parameters → sqlmap/ghauri →
→ Test injection points → Identify vulnerable params → Report
```
**SQLi Types:**
* Error-based
* Union-based
* Blind (Boolean/Time-based)
* Stacked queries
**Output:**
```
vulns/sqli.txt
vulns/sqlmap_output/ # Detailed SQLMap results
```
**Sample Output:**
```
[VULNERABLE] https://example.com/user?id=1
Parameter: id
Type: Boolean-based blind
Backend: MySQL
```
**Configuration:**
```bash
SQLI=true
SQLMAP=true
GHAURI=false # Alternative SQLi tool
```
***
### `ssti` - Server-Side Template Injection
Tests for template injection vulnerabilities.
**How It Works:**
```
URLs with parameters → ffuf (SSTI payloads) →
→ Check for template execution → Report
```
**Payloads Tested:**
```
{{7*7}}
${7*7}
<%= 7*7 %>
{7*7}
${{7*7}}
```
**Output:**
```
vulns/ssti.txt
```
**Configuration:**
```bash
SSTI=true
ssti_wordlist=${tools}/ssti_wordlist.txt
```
***
### `lfi` - Local File Inclusion
Tests for LFI/path traversal vulnerabilities.
**How It Works:**
```
URLs with parameters → ffuf (LFI payloads) →
→ Check for file content → Report
```
**Payloads Tested:**
```
../../../etc/passwd
..%2f..%2f..%2fetc/passwd
....//....//....//etc/passwd
/etc/passwd
```
**Output:**
```
vulns/lfi.txt
```
**Configuration:**
```bash
LFI=true
lfi_wordlist=${tools}/lfi_wordlist.txt
```
***
### `command_injection` - Command Injection
Tests for OS command injection using Commix.
**How It Works:**
```
URLs with parameters → commix →
→ Test command separators → Verify execution → Report
```
**Injection Techniques:**
* Classic injection (`;`, `|`, `&`)
* Blind injection (time-based)
* File-based injection
**Output:**
```
vulns/command_injection.txt
```
**Configuration:**
```bash
COMM_INJ=true
```
***
## Server-Side Vulnerabilities
### `ssrf_checks` - Server-Side Request Forgery
Tests for SSRF vulnerabilities using callback servers.
**How It Works:**
```
URLs with parameters → Replace values with callback URL →
→ Monitor for callbacks → Report SSRF
```
**Requires:** Collaborator server (interactsh, Burp Collaborator)
**SSRF Payloads:**
```
http://callback.server/
http://169.254.169.254/ # AWS metadata
http://127.0.0.1/
```
**Output:**
```
vulns/ssrf.txt
```
**Configuration:**
```bash
SSRF_CHECKS=true
COLLAB_SERVER="https://your.interact.sh"
```
***
### `cors` - CORS Misconfiguration
Tests for CORS misconfigurations that allow unauthorized cross-origin access.
**Issues Detected:**
* Wildcard origin (`*`)
* Reflected origin
* Null origin allowed
* Credentials with wildcard
**How It Works:**
```
webs.txt → Corsy → Test CORS headers →
→ Check for misconfigs → Report
```
**Output:**
```
vulns/cors.txt
```
**Sample Output:**
```
[VULNERABLE] https://api.example.com
Issue: Origin Reflected
Impact: Attacker can read responses from any origin
```
**Configuration:**
```bash
CORS=true
```
***
### `crlf_checks` - CRLF Injection
Tests for HTTP header injection via CRLF.
**How It Works:**
```
URLs → crlfuzz → Inject CRLF sequences →
→ Check for header injection → Report
```
**Output:**
```
vulns/crlf.txt
```
**Configuration:**
```bash
CRLF_CHECKS=true
```
***
## Advanced Vulnerabilities
### `prototype_pollution` - Prototype Pollution
Tests for JavaScript prototype pollution in client-side code.
**How It Works:**
```
webs.txt → ppmap → Analyze JS →
→ Test pollution payloads → Report
```
**Output:**
```
vulns/prototype_pollution.txt
```
**Configuration:**
```bash
PROTO_POLLUTION=true
```
***
### `smuggling` - HTTP Request Smuggling
Tests for HTTP request smuggling vulnerabilities.
**Techniques Tested:**
* CL.TE (Content-Length vs Transfer-Encoding)
* TE.CL
* TE.TE
**Output:**
```
vulns/smuggling.txt
```
**Configuration:**
```bash
SMUGGLING=true
```
***
### `webcache` - Web Cache Poisoning
Tests for web cache poisoning vulnerabilities.
**Issues Detected:**
* Cache key manipulation
* Unkeyed header poisoning
* Parameter cloaking
**Output:**
```
vulns/webcache.txt
```
**Configuration:**
```bash
WEBCACHE=true
```
***
## Bypass Techniques
### `open_redirect` - Open Redirect
Tests for open redirect vulnerabilities.
**How It Works:**
```
URLs with redirect parameters → Oralyzer →
→ Test redirect payloads → Verify redirect → Report
```
**Output:**
```
vulns/open_redirect.txt
```
**Sample Output:**
```
[VULNERABLE] https://example.com/login?redirect=
Payload: //evil.com
Redirects to: https://evil.com
```
**Configuration:**
```bash
OPEN_REDIRECT=true
```
***
### `4xxbypass` - 403/401 Bypass
Attempts to bypass access controls returning 403/401 responses.
**Techniques:**
* Header manipulation (X-Forwarded-For, etc.)
* Path manipulation
* HTTP method changes
* Protocol downgrades
**How It Works:**
```
403/401 URLs → nomore403 → Try bypass techniques →
→ Check for successful access → Report
```
**Output:**
```
vulns/4xxbypass.txt
```
**Sample Output:**
```
[BYPASS] https://example.com/admin
Original: 403 Forbidden
Technique: X-Original-URL header
Result: 200 OK
```
**Configuration:**
```bash
BYPASSER4XX=true
```
***
## SSL/TLS Analysis
### `test_ssl` - SSL/TLS Security
Full SSL/TLS security analysis.
**Issues Detected:**
* Expired certificates
* Weak ciphers
* Protocol vulnerabilities (POODLE, BEAST, etc.)
* Certificate chain issues
* HSTS misconfigurations
**Output:**
```
vulns/testssl.txt
```
**Configuration:**
```bash
TEST_SSL=true
```
***
## Credential Testing
### `spraying` - Password Spraying
Attempts common passwords against discovered services.
**Services Tested:**
* SSH
* FTP
* HTTP Basic Auth
* Database ports
* And more...
**How It Works:**
```
hosts/portscan_active.xml → brutespray →
→ Test common creds → Report successful logins
```
**Output:**
```
vulns/brutespray.txt
```
**Configuration:**
```bash
SPRAY=true
BRUTESPRAY_THREADS=20
BRUTESPRAY_CONCURRENCE=10
```
> ⚠️ **Warning:** Password spraying can lock out accounts. Use with caution.
***
## Parameter Fuzzing
### `fuzzparams` - Parameter Value Fuzzing
Fuzzes parameter values with nuclei templates.
**How It Works:**
```
URLs with parameters → nuclei (fuzzing templates) →
→ Test injection points → Report findings
```
**Output:**
```
vulns/fuzzparams.txt
```
**Configuration:**
```bash
FUZZPARAMS=true
```
***
## Broken Links
### `brokenLinks` - Broken Link Hijacking
Identifies broken links that could be hijacked.
**How It Works:**
```
webs.txt → katana (crawl) → Check external links →
→ Identify dead/available domains → Report
```
**Output:**
```
vulns/broken_links.txt
```
**Configuration:**
```bash
BROKENLINKS=true
```
***
## Enabling Vulnerability Scanning
Vulnerability scanning is **disabled by default**. To enable:
### Method 1: Use `-a` Flag
```bash
# Full recon + all vulnerability checks
./reconftw.sh -d example.com -a
```
### Method 2: Enable in Config
```bash
# In reconftw.cfg
VULNS_GENERAL=true
```
### Method 3: Selective Enabling
```bash
# Enable only specific checks
VULNS_GENERAL=true
XSS=true
SQLI=true
CORS=false
SSRF_CHECKS=false
# ... etc
```
***
## Output Summary
| File | Content |
| ------------------------- | --------------------------- |
| `nuclei_output/*.txt` | Nuclei findings by severity |
| `vulns/xss.txt` | XSS vulnerabilities |
| `vulns/sqli.txt` | SQL injection |
| `vulns/cors.txt` | CORS misconfigs |
| `vulns/ssrf.txt` | SSRF vulnerabilities |
| `vulns/lfi.txt` | LFI/path traversal |
| `vulns/ssti.txt` | Template injection |
| `vulns/open_redirect.txt` | Open redirects |
| `vulns/4xxbypass.txt` | Access control bypasses |
| `vulns/testssl.txt` | SSL/TLS issues |
***
## Best Practices
1. **Authorization First:** Always have written permission before scanning
2. **Rate Limiting:** Use `-q` flag to avoid overwhelming targets
3. **Scope Awareness:** Use `-x` to exclude out-of-scope targets
4. **Verification:** Manually verify findings before reporting
5. **Responsible Disclosure:** Follow responsible disclosure practices
6. **Callback Servers:** Set up proper callback infrastructure for blind vulns
***
## Next Steps
* [**Host Module**](/modules/hosts) - Port scanning and host analysis
* [**Output Interpretation**](/output/output) - Understand results
# Host Module
The host analysis module examines the infrastructure behind discovered assets, including port scanning, CDN detection, WAF identification, cloud enumeration, and geolocation.
***
## Module Overview
| Function | Purpose | Tools |
| ----------------------- | --------------------------------- | ---------- |
| `portscan` | Port discovery (passive + active) | nmap, smap |
| `cdnprovider` | CDN detection and filtering | cdncheck |
| `waf_checks` | WAF detection | wafw00f |
| `favicon` | Real IP discovery via favicon | fav-up |
| `cloud_extra_providers` | Extra cloud storage enumeration | curl |
| `geo_info` | IP geolocation | ipinfo |
| `banner_grabber` | Service banner extraction | nmap |
***
## Configuration Options
```bash
# In reconftw.cfg
# Master toggle
PORTSCANNER=true
# Port scanning
PORTSCAN_PASSIVE=true # Shodan-based (requires API key)
PORTSCAN_ACTIVE=true # Nmap-based
# Nmap options
PORTSCAN_ACTIVE_OPTIONS="--top-ports 200 -sV -n -Pn --open --max-retries 2 --script vulners"
# Other host checks
FAVICON=true # Favicon IP discovery
CDN_IP=true # CDN detection
GEO_INFO=true # Geolocation
WAF_DETECTION=true # WAF detection
# IPv6
IPV6_SCAN=true # IPv6 discovery
```
***
## Port Scanning
### Passive Port Scanning (Shodan)
Uses Shodan API to retrieve port/service information without touching the target.
**How It Works:**
```
IP addresses → smap (Shodan query) →
→ Return known open ports → hosts/portscan_passive.txt
```
**Advantages:**
* No direct target interaction
* Historical data available
* Fast results
**Limitations:**
* Requires Shodan API key
* Data may be outdated
* Only indexed hosts
**Output:**
```
hosts/portscan_passive.txt
```
**Sample Output:**
```
192.168.1.10
22/tcp ssh OpenSSH 8.2
80/tcp http nginx 1.18
443/tcp https nginx 1.18
3306/tcp mysql MySQL 8.0
```
**Configuration:**
```bash
PORTSCAN_PASSIVE=true
SHODAN_API_KEY="your_key" # In secrets.cfg
```
***
### Active Port Scanning (Nmap)
Performs direct port scanning against target IPs.
**How It Works:**
```
IP addresses (non-CDN) → nmap →
→ Scan ports → Service detection → Vuln scripts → Output
```
**Default Scan Options:**
```bash
PORTSCAN_ACTIVE_OPTIONS="--top-ports 200 -sV -n -Pn --open --max-retries 2 --script vulners"
```
**Option Breakdown:**
| Option | Description |
| ------------------ | -------------------- |
| `--top-ports 200` | Scan top 200 ports |
| `-sV` | Version detection |
| `-n` | No DNS resolution |
| `-Pn` | Skip host discovery |
| `--open` | Show only open ports |
| `--max-retries 2` | Retry limit |
| `--script vulners` | Check for CVEs |
**Output:**
```
hosts/portscan_active.txt # Human readable
hosts/portscan_active.xml # Nmap XML format
hosts/portscan_active.gnmap # Greppable format
```
**Sample Output:**
```
Nmap scan report for 192.168.1.10
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1
| vulners:
| CVE-2020-15778 6.8
80/tcp open http nginx 1.18.0
443/tcp open ssl/https nginx 1.18.0
3306/tcp open mysql MySQL 8.0.26
```
**Configuration:**
```bash
PORTSCAN_ACTIVE=true
PORTSCAN_ACTIVE_OPTIONS="--top-ports 200 -sV -n -Pn --open"
```
**Custom Scan Profiles:**
```bash
# Quick scan (top 100 ports)
PORTSCAN_ACTIVE_OPTIONS="--top-ports 100 -Pn --open"
# Full port scan (all ports)
PORTSCAN_ACTIVE_OPTIONS="-p- -sV -sC -Pn --open"
# Stealth scan (slower, less detectable)
PORTSCAN_ACTIVE_OPTIONS="-sS -T2 --top-ports 1000 -Pn"
```
***
## CDN Detection
### `cdnprovider` - CDN Identification
Identifies IPs behind CDN providers to avoid scanning CDN infrastructure.
**Why It Matters:**
* CDN IPs don't represent the actual target
* Scanning CDNs wastes resources
* May violate CDN terms of service
* Focus on real infrastructure
**CDN Providers Detected:**
* Cloudflare
* Akamai
* Fastly
* CloudFront
* Incapsula
* And many more...
**How It Works:**
```
All IPs → cdncheck →
→ Identify CDN IPs → Separate into cdn.txt and non-cdn IPs
```
**Output:**
```
hosts/cdn.txt # CDN IPs (excluded from active scans)
hosts/ips.txt # Non-CDN IPs (scanned)
```
**Sample Output:**
```
# cdn.txt
104.16.132.229 [cloudflare]
151.101.1.195 [fastly]
13.32.123.45 [cloudfront]
# ips.txt (non-CDN, will be scanned)
192.168.1.10
10.0.0.5
```
**Configuration:**
```bash
CDN_IP=true
```
***
## WAF Detection
### `waf_checks` - Web Application Firewall Detection
Identifies WAF/security products protecting web applications.
**WAFs Detected:**
* Cloudflare
* AWS WAF
* Akamai
* Imperva/Incapsula
* ModSecurity
* Sucuri
* F5 BIG-IP
* And 100+ more...
**How It Works:**
```
webs.txt → wafw00f →
→ Send probe requests → Analyze responses → Identify WAF
```
**Output:**
```
hosts/waf.txt
```
**Sample Output:**
```
https://www.example.com
WAF: Cloudflare
Detected by: Response headers, Server header
https://api.example.com
WAF: AWS WAF
Detected by: Response behavior
https://admin.example.com
WAF: None detected
```
**Why It Matters:**
* Adjust attack strategies
* Understand defensive posture
* Identify bypass opportunities
* Report in findings
**Configuration:**
```bash
WAF_DETECTION=true
```
***
## Favicon Analysis
### `favicon` - Real IP Discovery
Discovers real IP addresses behind CDN/proxy by analyzing favicon hashes.
**How It Works:**
```
Known favicon hash → Shodan search →
→ Find servers with same favicon → Potential real IPs
```
**Technique:**
1. Download favicon from target
2. Calculate hash (MurmurHash3)
3. Search Shodan for matching hashes
4. Servers with same favicon may be the real origin
**Output:**
```
hosts/favicontest.txt
```
**Sample Output:**
```
# Favicon hash: -1234567890
Real IP candidates:
192.168.1.100 (Direct match)
10.0.0.50 (Partial match)
```
**Configuration:**
```bash
FAVICON=true
SHODAN_API_KEY="your_key" # Required
```
***
## Geolocation
### `geo_info` - IP Geolocation
Retrieves geographic information for discovered IP addresses.
**Information Gathered:**
* Country
* Region/State
* City
* Organization/ISP
* ASN
**How It Works:**
```
IP addresses → ipinfo.io API →
→ Geolocation data → hosts/geo.txt
```
**Output:**
```
hosts/geo.txt
```
**Sample Output:**
```
192.168.1.10
Country: United States
Region: California
City: San Francisco
Org: Example Hosting Inc.
ASN: AS12345
10.0.0.5
Country: Germany
Region: Hesse
City: Frankfurt
Org: AWS
ASN: AS16509
```
**Use Cases:**
* Understand infrastructure distribution
* Identify hosting providers
* Compliance/jurisdiction issues
* Attack surface mapping
**Configuration:**
```bash
GEO_INFO=true
```
***
## Cloud Storage Enumeration
### `cloud_extra_providers` - Extra Cloud Provider Checks
Discovers misconfigured cloud storage buckets beyond standard S3 enumeration.
**Cloud Providers Checked:**
* **Google Cloud Storage (GCS)**
* `https://storage.googleapis.com/{name}/`
* `https://{name}.storage.googleapis.com/`
* **Azure Blob Storage**
* `https://{name}.blob.core.windows.net/{container}`
* Tests common containers: public, static, media, images, assets, backup, files, cdn
**How It Works:**
```
Domain → Extract company/brand names →
→ Generate candidate bucket names → Test cloud URLs →
→ Check for public access (200/403) → Report findings
```
**Name Generation:**
1. Domain root (e.g., "example" from "example.com")
2. Company name variations
3. Subdomain prefixes (e.g., "api", "dev", "staging")
4. Combined with common container names
**Output:**
```
subdomains/cloud_extra.txt
```
**Sample Output:**
```
GCS examplecorp https://storage.googleapis.com/examplecorp/
GCS example-backup https://example-backup.storage.googleapis.com/
AZURE examplecorp/public https://examplecorp.blob.core.windows.net/public
AZURE example-dev/static https://example-dev.blob.core.windows.net/static
```
**What It Finds:**
* Publicly accessible storage buckets
* Buckets returning 403 (exist but restricted - worth manual testing)
* Misconfigured backup/static file storage
**Security Implications:**
* Public buckets may contain sensitive data
* 403 responses confirm bucket existence (enumeration value)
* Backup buckets often contain valuable data
**Note:** This complements the OSINT module's `cloud_enum` function by testing additional providers and name variations.
***
## IPv6 Scanning
### IPv6 Discovery and Scanning
Discovers and scans IPv6 addresses when available.
**How It Works:**
```
Subdomains → DNS AAAA records →
→ IPv6 addresses → Include in scanning
```
**Configuration:**
```bash
IPV6_SCAN=true
```
**Note:** IPv6 scanning may reveal additional attack surface not visible via IPv4.
***
## Data Flow
```
┌─────────────────────────────────────────────────────────────────────┐
│ Host Analysis Flow │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌────────────────┐ │
│ │ subdomains.txt │ │
│ └───────┬────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────┐ │
│ │ DNS Resolution│ (sub_dns) │
│ └───────┬────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────┐ │
│ │ All IPs │ │
│ └───────┬────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────┐ ┌────────────────┐ │
│ │ cdnprovider │────▶│ cdn.txt │ (excluded) │
│ └───────┬────────┘ └────────────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────┐ │
│ │ Non-CDN IPs │ │
│ └───────┬────────┘ │
│ │ │
│ ┌─────┴─────┬─────────────┬─────────────┐ │
│ ▼ ▼ ▼ ▼ │
│ ┌──────┐ ┌────────┐ ┌─────────┐ ┌─────────┐ │
│ │ nmap │ │ shodan │ │ wafw00f │ │ geo_info│ │
│ │active│ │passive │ │ (WAF) │ │ (geo) │ │
│ └──┬───┘ └───┬────┘ └────┬────┘ └────┬────┘ │
│ │ │ │ │ │
│ ▼ ▼ ▼ ▼ │
│ portscan_ portscan_ waf.txt geo.txt │
│ active.txt passive.txt │
│ │
└─────────────────────────────────────────────────────────────────────┘
```
***
## Output Files Summary
| File | Content |
| ----------------------------- | ----------------------------- |
| `hosts/ips.txt` | All resolved IP addresses |
| `hosts/cdn.txt` | IPs identified as CDN |
| `hosts/portscan_passive.txt` | Shodan port results |
| `hosts/portscan_active.txt` | Nmap scan results |
| `hosts/portscan_active.xml` | Nmap XML output |
| `hosts/portscan_active.gnmap` | Nmap greppable output |
| `hosts/waf.txt` | WAF detection results |
| `hosts/geo.txt` | Geolocation data |
| `hosts/favicontest.txt` | Favicon real IP discovery |
| `hosts/grpc_reflection.txt` | gRPC services with reflection |
| `subdomains/cloud_extra.txt` | Extra cloud storage findings |
***
## Integration with Vulnerability Scanning
Host analysis results feed into vulnerability scanning:
1. **Port scan results** → Password spraying targets
2. **Service versions** → CVE matching (vulners script)
3. **Non-CDN IPs** → Focus active testing
4. **WAF detection** → Adjust attack strategies
***
## Best Practices
1. **CDN Awareness:** Don't waste resources scanning CDN IPs
2. **Rate Limiting:** Aggressive port scans can trigger alerts
3. **Authorization:** Ensure port scanning is in scope
4. **Service Detection:** Version info helps identify vulnerabilities
5. **Passive First:** Start with Shodan to minimize noise
6. **IPv6 Coverage:** Don't forget IPv6 attack surface
***
## Nmap Scan Customization
### Quick Discovery
```bash
PORTSCAN_ACTIVE_OPTIONS="--top-ports 100 -Pn -T4"
```
### Full Scan
```bash
PORTSCAN_ACTIVE_OPTIONS="-p- -sV -sC -Pn"
```
### Stealth Scan
```bash
PORTSCAN_ACTIVE_OPTIONS="-sS -T2 --top-ports 1000 -Pn"
```
### Service Focus
```bash
PORTSCAN_ACTIVE_OPTIONS="-p 21,22,23,25,80,443,3306,5432,6379,27017 -sV -Pn"
```
***
## Next Steps
* [**Tools Reference**](/tools-reference/tools) - All integrated tools
* [**Output Interpretation**](/output/output) - Understand results
# Integrated Tools
reconFTW integrates 80+ security tools. This reference documents each tool, its purpose, and how reconFTW uses it.
***
## Tool Categories
| Category | Tools | Purpose |
| ---------------------- | ----- | -------------------------- |
| Subdomain Enumeration | 15+ | Discover subdomains |
| DNS Analysis | 8+ | DNS resolution and records |
| Web Probing | 10+ | HTTP analysis |
| Content Discovery | 6+ | Directory/file fuzzing |
| Vulnerability Scanning | 20+ | Detect vulnerabilities |
| OSINT | 12+ | Intelligence gathering |
| Utilities | 10+ | Support functions |
***
## Installation Verification
```bash
# Check all tool installations
./reconftw.sh --check-tools
# System health check
./reconftw.sh --health-check
```
***
## Subdomain Enumeration Tools
### subfinder
**Purpose:** Passive subdomain enumeration using APIs and data sources.
**Data Sources:** VirusTotal, Shodan, Censys, SecurityTrails, and 40+ more.
**Usage in reconFTW:**
```bash
# Called in sub_passive()
subfinder -d example.com -all -o output.txt
```
**Configuration:**
```bash
# Control how long passive enumeration runs (minutes)
SUBFINDER_ENUM_TIMEOUT=180
# API keys in ~/.config/subfinder/provider-config.yaml
```
**Website:**
***
### amass
**Purpose:** Multi-source subdomain enumeration using multiple techniques.
**Techniques:** DNS brute-force, web scraping, APIs, certificate logs.
**Usage in reconFTW:**
```bash
# Passive mode
amass enum -passive -d example.com -o output.txt
```
**Configuration:**
```bash
# API keys in ~/.config/amass/config.ini
```
**Website:**
***
### assetfinder
**Purpose:** Fast passive subdomain enumeration.
**Usage in reconFTW:**
```bash
# Called for quick enumeration
echo example.com | assetfinder --subs-only
```
**Website:**
***
### findomain
**Purpose:** Fast subdomain enumeration using multiple APIs.
**Usage in reconFTW:**
```bash
findomain -t example.com -u output.txt
```
**Configuration:**
```bash
# API keys as environment variables
FINDOMAIN_FB_TOKEN=...
FINDOMAIN_VIRUSTOTAL_TOKEN=...
```
**Website:**
***
### github-subdomains
**Purpose:** Find subdomains mentioned in GitHub code.
**Usage in reconFTW:**
```bash
github-subdomains -d example.com -t $GITHUB_TOKEN
```
**Configuration:**
```bash
GITHUB_TOKEN="your_token" # In secrets.cfg
```
**Website:**
***
### crt.sh / ctfr
**Purpose:** Query Certificate Transparency logs.
**Usage in reconFTW:**
```bash
# Certificate transparency lookup
curl "https://crt.sh/?q=%25.example.com&output=json"
```
***
### dnsx
**Purpose:** Fast DNS resolution and record querying.
**Usage in reconFTW:**
```bash
# DNS resolution
cat subdomains.txt | dnsx -silent -a -resp
```
**Configuration:**
```bash
DNSX_THREADS=100
```
**Website:**
***
### puredns
**Purpose:** High-performance DNS brute-forcing with wildcard filtering.
**Usage in reconFTW:**
```bash
# DNS brute-force
puredns bruteforce wordlist.txt example.com -r resolvers.txt
```
**Configuration:**
```bash
PUREDNS_PUBLIC_LIMIT=10
```
**Website:**
***
### shuffledns
**Purpose:** Wrapper for massdns with wildcard handling.
**Usage in reconFTW:**
```bash
shuffledns -d example.com -w wordlist.txt -r resolvers.txt
```
**Website:**
***
### dnsgen
**Purpose:** Generate subdomain permutations.
**Usage in reconFTW:**
```bash
# Generate permutations
cat subdomains.txt | dnsgen - | puredns resolve
```
**Website:**
***
### alterx
**Purpose:** AI-powered subdomain permutation generation.
**Usage in reconFTW:**
```bash
# Called in sub_ia_permut()
echo example.com | alterx
```
**Website:**
***
### gotator
**Purpose:** Fast subdomain permutation generator.
**Usage in reconFTW:**
```bash
gotator -sub subdomains.txt -perm permutations.txt -depth 1
```
**Website:**
***
### regulator
**Purpose:** Generate subdomains based on regex patterns.
**Usage in reconFTW:**
```bash
# Called in sub_regex_permut()
regulator -d example.com
```
***
### analyticsrelationships
**Purpose:** Find related domains via Google Analytics IDs.
**Usage in reconFTW:**
```bash
# Find related domains
analyticsrelationships -ch $BUILTWITH_API_KEY
```
**Website:**
***
### tlsx
**Purpose:** TLS/SSL certificate analysis and subdomain discovery.
**Usage in reconFTW:**
```bash
# Extract subdomains from certificates
echo example.com | tlsx -san -cn -silent
```
**Website:**
***
## Web Probing Tools
### httpx
**Purpose:** Fast HTTP probing with metadata extraction.
**Features:** Status codes, titles, technologies, content length.
**Usage in reconFTW:**
```bash
# Probe for live hosts
cat subdomains.txt | httpx -ports 80,443,8080 -title -tech-detect
```
**Configuration:**
```bash
HTTPX_THREADS=50
HTTPX_RATELIMIT=150
HTTPX_TIMEOUT=10
```
**Website:**
***
### gowitness
**Purpose:** Web screenshot tool.
**Usage in reconFTW:**
```bash
# Screenshot web pages
gowitness file -f webs.txt --delay 2
```
**Configuration:**
```bash
GOWITNESS_THREADS=8
```
**Website:**
***
### webanalyze
**Purpose:** Technology detection (Wappalyzer-based).
**Usage in reconFTW:**
```bash
# Detect technologies
webanalyze -host https://example.com
```
**Website:**
***
### wafw00f
**Purpose:** Web Application Firewall detection.
**Usage in reconFTW:**
```bash
# Detect WAF
wafw00f https://example.com
```
**Website:**
***
## Content Discovery Tools
### ffuf
**Purpose:** Fast web fuzzer for directory/file discovery.
**Usage in reconFTW:**
```bash
# Directory fuzzing
ffuf -u https://example.com/FUZZ -w wordlist.txt -mc 200,301,302
```
**Configuration:**
```bash
FFUF_THREADS=40
FFUF_RATELIMIT=
```
**Website:**
***
### feroxbuster
**Purpose:** Recursive content discovery.
**Usage in reconFTW:**
```bash
# Recursive fuzzing
feroxbuster -u https://example.com -w wordlist.txt
```
**Website:**
***
### dirsearch
**Purpose:** Web path discovery.
**Usage in reconFTW:**
```bash
# Directory enumeration
dirsearch -u https://example.com -e php,html,js
```
**Website:**
***
### hakrawler
**Purpose:** Web crawler for URL discovery.
**Usage in reconFTW:**
```bash
# Crawl website
echo https://example.com | hakrawler -d 3
```
**Website:**
***
### katana
**Purpose:** Modern web crawler.
**Usage in reconFTW:**
```bash
# Crawl and extract URLs
katana -u https://example.com -d 3 -jc
```
**Website:**
***
### gospider
**Purpose:** Fast web spidering.
**Usage in reconFTW:**
```bash
# Spider website
gospider -s https://example.com -d 2
```
**Website:**
***
### gau
**Purpose:** Fetch known URLs from web archives.
**Sources:** Wayback Machine, Common Crawl, URLScan.
**Usage in reconFTW:**
```bash
# Get archived URLs
echo example.com | gau --threads 5
```
**Website:**
***
### waybackurls
**Purpose:** Fetch URLs from Wayback Machine.
**Usage in reconFTW:**
```bash
echo example.com | waybackurls
```
**Website:**
***
## Vulnerability Scanning Tools
### nuclei
**Purpose:** Template-based vulnerability scanner.
**Usage in reconFTW:**
```bash
# Scan with templates
nuclei -l urls.txt -t ~/nuclei-templates -severity critical,high
```
**Configuration:**
```bash
NUCLEI_RATELIMIT=150
NUCLEI_SEVERITY="critical,high,medium"
NUCLEI_TEMPLATES_PATH="$HOME/nuclei-templates"
NUCLEI_EXTRA_ARGS=""
```
**Website:**
***
### dalfox
**Purpose:** XSS vulnerability scanner.
**Usage in reconFTW:**
```bash
# Test for XSS
dalfox url https://example.com/search?q=test
```
**Configuration:**
```bash
DALFOX_THREADS=30
```
**Website:**
***
### sqlmap
**Purpose:** Automatic SQL injection detection.
**Usage in reconFTW:**
```bash
# Test for SQLi
sqlmap -u "https://example.com/page?id=1" --batch
```
**Configuration:**
```bash
SQLMAP_THREADS=5
```
**Website:**
***
### ghauri
**Purpose:** Advanced SQL injection scanner.
**Usage in reconFTW:**
```bash
# Alternative SQLi testing
ghauri -u "https://example.com/page?id=1"
```
**Website:**
***
### commix
**Purpose:** Command injection exploitation.
**Usage in reconFTW:**
```bash
# Test for command injection
commix -u "https://example.com/ping?host=test"
```
**Website:**
***
### crlfuzz
**Purpose:** CRLF injection scanner.
**Usage in reconFTW:**
```bash
# Test for CRLF
crlfuzz -l urls.txt
```
**Website:**
***
### interactsh-client
**Purpose:** Out-of-band interaction detection.
**Usage in reconFTW:**
```bash
# OOB testing server
interactsh-client
```
**Website:**
***
### ssrf-sheriff
**Purpose:** SSRF vulnerability detection.
**Usage in reconFTW:**
```bash
# Test for SSRF
ssrf-sheriff -u "https://example.com/fetch?url="
```
***
### tplmap
**Purpose:** Server-side template injection detection.
**Usage in reconFTW:**
```bash
# Test for SSTI
tplmap -u "https://example.com/page?name=test"
```
**Website:**
***
### ppfuzz
**Purpose:** Prototype pollution scanner.
**Usage in reconFTW:**
```bash
# Test for prototype pollution
ppfuzz -l urls.txt
```
***
### smuggler
**Purpose:** HTTP request smuggling detection.
**Usage in reconFTW:**
```bash
# Test for smuggling
python3 smuggler.py -u https://example.com
```
**Website:**
***
### Web-Cache-Vulnerability-Scanner
**Purpose:** Web cache poisoning detection.
**Usage in reconFTW:**
```bash
# Test for cache poisoning
wcvs -u https://example.com
```
***
### testssl.sh
**Purpose:** SSL/TLS vulnerability testing.
**Usage in reconFTW:**
```bash
# Test SSL configuration
testssl.sh https://example.com
```
**Website:**
***
### byp4xx
**Purpose:** 403/401 bypass techniques.
**Usage in reconFTW:**
```bash
# Bypass 4xx
byp4xx https://example.com/admin
```
**Website:**
***
### gf
**Purpose:** Pattern extraction from URLs.
**Patterns:** XSS, SQLi, SSRF, LFI, etc.
**Usage in reconFTW:**
```bash
# Extract SQLi candidates
cat urls.txt | gf sqli
```
**Website:**
***
### Gxss
**Purpose:** Check for reflected parameters.
**Usage in reconFTW:**
```bash
# Check reflection
cat urls.txt | Gxss
```
**Website:**
***
### kxss
**Purpose:** Find reflected XSS endpoints.
**Usage in reconFTW:**
```bash
# Find reflected params
cat urls.txt | kxss
```
**Website:**
***
## OSINT Tools
### theHarvester
**Purpose:** Email and subdomain harvesting.
**Usage in reconFTW:**
```bash
# Harvest emails
theHarvester -d example.com -b all
```
**Website:**
***
### emailfinder
**Purpose:** Find email addresses.
**Usage in reconFTW:**
```bash
# Find emails
emailfinder -d example.com
```
**Website:**
***
### pwndb
**Purpose:** Check for leaked credentials.
**Usage in reconFTW:**
```bash
# Check leaks
pwndb -t example.com
```
***
### gitdorker
**Purpose:** GitHub dorking for secrets.
**Usage in reconFTW:**
```bash
# Search GitHub
python3 GitDorker.py -tf GITHUB_TOKEN -q example.com
```
**Website:**
***
### trufflehog
**Purpose:** Secret scanning in repositories.
**Usage in reconFTW:**
```bash
# Scan for secrets
trufflehog github --org example
```
**Website:**
***
### gitrob
**Purpose:** GitHub organization reconnaissance.
**Usage in reconFTW:**
```bash
# Scan GitHub org
gitrob -o example-org
```
***
### cloud\_enum
**Purpose:** Cloud storage enumeration.
**Usage in reconFTW:**
```bash
# Enumerate cloud storage
python3 cloud_enum.py -k example
```
**Website:**
***
### dnsrecon
**Purpose:** DNS enumeration and zone transfer.
**Usage in reconFTW:**
```bash
# Zone transfer check
dnsrecon -d example.com -t axfr
```
**Website:**
***
### spoof.py
**Purpose:** Email spoofing check.
**Usage in reconFTW:**
```bash
# Check SPF/DMARC
spoofcheck.py example.com
```
***
### metagoofil
**Purpose:** Metadata extraction from documents.
**Usage in reconFTW:**
```bash
# Extract metadata
metagoofil -d example.com -t pdf,doc
```
**Website:**
***
## Port Scanning Tools
### nmap
**Purpose:** Network discovery and security auditing.
**Usage in reconFTW:**
```bash
# Port scan
nmap -sV -sC --top-ports 200 -Pn target.txt
```
**Configuration:**
```bash
PORTSCAN_ACTIVE_OPTIONS="--top-ports 200 -sV -n -Pn --open"
```
**Website:**
***
### smap
**Purpose:** Shodan-based passive port scanning.
**Usage in reconFTW:**
```bash
# Passive port scan
smap target.txt
```
**Website:**
***
### masscan
**Purpose:** Fast port scanning.
**Usage in reconFTW:**
```bash
# Quick port scan
masscan -p1-65535 target -rate=1000
```
**Website:**
***
## JavaScript Analysis Tools
### getJS
**Purpose:** Extract JavaScript files from pages.
**Usage in reconFTW:**
```bash
# Get JS files
getJS -url https://example.com
```
**Website:**
***
### subjs
**Purpose:** Find JavaScript files in pages.
**Usage in reconFTW:**
```bash
# Find JS
cat urls.txt | subjs
```
**Website:**
***
### linkfinder
**Purpose:** Find endpoints in JavaScript files.
**Usage in reconFTW:**
```bash
# Extract endpoints
python3 linkfinder.py -i https://example.com/app.js
```
**Website:**
***
### secretfinder
**Purpose:** Find secrets in JavaScript.
**Usage in reconFTW:**
```bash
# Find secrets in JS
python3 SecretFinder.py -i https://example.com/app.js
```
**Website:**
***
### mantra
**Purpose:** Hunt for API keys and secrets.
**Usage in reconFTW:**
```bash
# Find API keys
mantra -u https://example.com
```
***
### jsluice
**Purpose:** JavaScript analysis and URL extraction.
**Usage in reconFTW:**
```bash
# Analyze JS
cat app.js | jsluice urls
```
**Website:**
***
## Utility Tools
### anew
**Purpose:** Append lines to file if they don't exist.
**Usage in reconFTW:**
```bash
# Deduplicate append
cat new.txt | anew existing.txt
```
**Website:**
***
### qsreplace
**Purpose:** Replace query string parameters.
**Usage in reconFTW:**
```bash
# Replace params
cat urls.txt | qsreplace FUZZ
```
**Website:**
***
### unfurl
**Purpose:** Parse and extract URL components.
**Usage in reconFTW:**
```bash
# Extract domains
cat urls.txt | unfurl domains
```
**Website:**
***
### urldedupe
**Purpose:** Remove duplicate URLs.
**Usage in reconFTW:**
```bash
# Deduplicate URLs
cat urls.txt | urldedupe
```
**Website:**
***
### inscope
**Purpose:** Filter URLs by scope.
**Usage in reconFTW:**
```bash
# Filter in-scope
cat urls.txt | inscope
```
**Website:**
***
### interlace
**Purpose:** Run commands across multiple targets.
**Usage in reconFTW:**
```bash
# Parallel execution
interlace -tL targets.txt -threads 10 -c "cmd _target_"
```
**Website:**
***
### notify
**Purpose:** Send notifications (Slack, Discord, etc.).
**Usage in reconFTW:**
```bash
# Send notification
echo "message" | notify
```
**Configuration:**
```bash
NOTIFICATION=true
```
**Website:**
***
### cdncheck
**Purpose:** Identify CDN providers.
**Usage in reconFTW:**
```bash
# Check for CDN
cat ips.txt | cdncheck
```
**Website:**
***
### mapcidr
**Purpose:** CIDR manipulation and expansion.
**Usage in reconFTW:**
```bash
# Expand CIDR
echo "192.168.1.0/24" | mapcidr
```
**Website:**
***
### dnsvalidator
**Purpose:** Validate DNS resolvers.
**Usage in reconFTW:**
```bash
# Validate resolvers
dnsvalidator -tL resolvers.txt -threads 100
```
**Website:**
***
## API-Dependent Tools
These tools require API keys configured in `secrets.cfg`:
| Tool | API Required |
| ----------------- | ------------------------------------ |
| subfinder | Multiple (optional) |
| shodan | SHODAN\_API\_KEY |
| censys | CENSYS\_API\_ID, CENSYS\_API\_SECRET |
| github-subdomains | GITHUB\_TOKEN |
| gitdorker | GITHUB\_TOKEN |
| whoisxml | WHOISXML\_API |
| securitytrails | SECURITYTRAILS\_KEY |
| intelx | INTELX\_KEY |
| hunter | HUNTER\_API\_KEY |
***
## Tool Update Commands
```bash
# Update reconFTW and reinstall all tools
cd reconftw
git pull
./install.sh
# Update specific tool
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
# Update nuclei templates
nuclei -update-templates
```
***
## Tool Troubleshooting
### Common Issues
1. **Tool not found:** Ensure `~/go/bin` is in PATH
2. **Permission denied:** Check executable permissions
3. **API errors:** Verify API keys in secrets.cfg
4. **Rate limiting:** Reduce thread counts
### Verification
```bash
# Check tool path
which httpx
# Check version
httpx -version
# Test functionality
echo example.com | httpx -silent
```
***
## Adding Custom Tools
To integrate a new tool:
1. Install the tool
2. Create wrapper function in custom module
3. Add configuration options to reconftw\.cfg
4. Test integration
***
## Next Steps
* [**Output Interpretation**](/output/output) - Understanding results
* [**Configuration**](/configuration/configuration) - Tool settings
# Output Interpretation
Understanding reconFTW's output structure and how to interpret results is crucial for effective reconnaissance.
***
## Output Directory Structure
When you run a scan against `example.com`, reconFTW creates:
```
Recon/
└── example.com/
├── subdomains/ # Subdomain enumeration results
├── webs/ # Web probing and analysis
├── hosts/ # IP and port scanning
├── osint/ # OSINT findings
├── vulns/ # Vulnerability scan results
├── nuclei_output/ # Nuclei JSON results
├── fuzzing/ # Directory/file fuzzing
├── js/ # JavaScript analysis
├── screenshots/ # Web screenshots
├── .tmp/ # Temporary files
├── .log/ # Execution logs
├── .called_fn/ # Checkpoint markers
├── assets.jsonl # Automation-friendly asset list
└── hotlist.txt # Risk-scored findings
```
***
## Subdomain Files (`subdomains/`)
### subdomains.txt
**Content:** Final deduplicated list of discovered subdomains.
**Format:** One subdomain per line.
```
www.example.com
api.example.com
mail.example.com
dev.example.com
staging.example.com
```
**Use Cases:**
* Input for further enumeration
* Scope verification
* Asset inventory
***
### subdomains\_crt.txt
**Content:** Subdomains from Certificate Transparency logs.
**Source:** crt.sh queries
```
www.example.com
mail.example.com
*.dev.example.com
autodiscover.example.com
```
***
### subdomains\_dnsrecords.txt
**Content:** DNS records for resolved subdomains.
**Format:** Subdomain with record types.
```
www.example.com [A] 93.184.216.34
mail.example.com [CNAME] mail.example.com.mail.protection.outlook.com
api.example.com [A] 93.184.216.35
example.com [MX] 10 mail.example.com
example.com [TXT] "v=spf1 include:_spf.google.com ~all"
```
***
### subdomains\_noerror.txt
**Content:** Subdomains discovered via DNS NOERROR response.
**Technique:** DNS response code analysis.
***
### subdomains\_permut.txt
**Content:** Subdomains found via permutation techniques.
***
### subdomains\_recursive.txt
**Content:** Subdomains from recursive enumeration.
***
### subdomains\_scraping.txt
**Content:** Subdomains extracted from web scraping.
***
## Web Files (`webs/`)
### webs.txt
**Content:** Live web servers (HTTP 200/30x responses).
**Format:** Full URLs.
```
https://www.example.com
https://api.example.com
http://dev.example.com:8080
https://staging.example.com
```
**Use Cases:**
* Target list for vulnerability scanning
* Web application testing
* Screenshot generation
***
### webs\_all.txt
**Content:** All probed URLs with HTTP response data.
**Format:** URL with metadata.
```
https://www.example.com [200] [Example Site] [nginx]
https://api.example.com [200] [API v2] [Express]
http://dev.example.com:8080 [403] [Forbidden] [Apache]
```
***
### url\_extract.txt
**Content:** All discovered URLs from crawling and archives.
**Sources:** gau, waybackurls, katana, hakrawler
```
https://example.com/login
https://example.com/api/v1/users
https://example.com/admin/dashboard
https://example.com/uploads/document.pdf
https://example.com/search?q=test
```
***
### takeover.txt
**Content:** Potential subdomain takeover vulnerabilities.
**Format:** Subdomain with service info.
```
VULNERABLE: docs.example.com [GitHub Pages]
VULNERABLE: blog.example.com [Heroku]
EDGE CASE: old.example.com [S3 bucket]
```
**Action Required:** Verify and claim vulnerable subdomains.
***
### url\_gf/
**Content:** URLs categorized by vulnerability patterns.
**Files:**
* `xss.txt` - XSS candidates
* `sqli.txt` - SQL injection candidates
* `ssrf.txt` - SSRF candidates
* `lfi.txt` - LFI candidates
* `redirect.txt` - Open redirect candidates
* `rce.txt` - RCE candidates
* `idor.txt` - IDOR candidates
**Example (xss.txt):**
```
https://example.com/search?q=FUZZ
https://example.com/user?name=FUZZ
https://example.com/callback?url=FUZZ
```
***
### url\_extensions/
**Content:** URLs grouped by file extension.
**Files:**
* `url_pdf.txt`
* `url_doc.txt`
* `url_js.txt`
* `url_json.txt`
* `url_xml.txt`
* `url_config.txt`
***
## Host Files (`hosts/`)
### ips.txt
**Content:** All resolved IP addresses (non-CDN).
```
93.184.216.34
93.184.216.35
10.0.0.100
```
***
### cdn.txt
**Content:** IP addresses identified as CDN.
```
104.16.132.229 [cloudflare]
151.101.1.195 [fastly]
13.32.123.45 [cloudfront]
```
***
### portscan\_passive.txt
**Content:** Port scan results from Shodan.
```
93.184.216.34
22/tcp open ssh OpenSSH 8.2
80/tcp open http nginx 1.18
443/tcp open https nginx 1.18
3306/tcp open mysql MySQL 8.0
```
***
### portscan\_active.txt
**Content:** Active nmap scan results.
**Format:** Standard nmap output.
```
Nmap scan report for 93.184.216.34
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1 Ubuntu
| vulners:
| CVE-2020-15778 6.8
80/tcp open http nginx 1.18.0
443/tcp open ssl/https nginx 1.18.0
| ssl-cert: Subject: CN=example.com
```
***
### portscan\_active.xml
**Content:** Nmap results in XML format.
**Use Cases:**
* Import to vulnerability scanners
* Parse with scripts
* Import to Faraday
***
### portscan\_active.gnmap
**Content:** Nmap greppable format.
```
Host: 93.184.216.34 () Ports: 22/open/tcp//ssh//OpenSSH 8.2p1/, 80/open/tcp//http//nginx 1.18.0/, 443/open/tcp//https//
```
***
### waf.txt
**Content:** WAF detection results.
```
https://www.example.com
WAF: Cloudflare
Detected by: Response headers
https://api.example.com
WAF: AWS WAF
Detected by: Response behavior
```
***
### geo.txt
**Content:** IP geolocation data.
```
93.184.216.34
Country: United States
Region: California
City: Los Angeles
Org: Edgecast Inc.
ASN: AS15133
```
***
## OSINT Files (`osint/`)
### dorks.txt
**Content:** Google dork results.
```
[site:example.com filetype:pdf]
https://example.com/documents/report.pdf
https://example.com/downloads/manual.pdf
[site:example.com inurl:admin]
https://example.com/admin/login
https://example.com/administrator/
```
***
### emails.txt
**Content:** Discovered email addresses.
```
admin@example.com
contact@example.com
john.doe@example.com
support@example.com
```
***
### passwords.txt
**Content:** Leaked credential data.
**Format:** Email:password pairs (from breach databases).
```
user@example.com:password123
admin@example.com:admin2020
```
**⚠️ IMPORTANT:** Handle with care, sensitive data.
***
### metadata\_results.txt
**Content:** Document metadata extraction.
```
File: report.pdf
Author: John Doe
Creator: Microsoft Word
Creation Date: 2023-01-15
Software: Adobe Acrobat
File: presentation.pptx
Author: Jane Smith
Company: Example Corp
Last Modified: 2023-03-20
```
***
### github\_company\_secrets.json
**Content:** Secrets found in GitHub repositories.
**Format:** JSON with file locations and secret types.
```json
[
{
"file": "config.js",
"repo": "example/webapp",
"secret_type": "AWS_KEY",
"match": "AKIA..."
},
{
"file": ".env.example",
"repo": "example/api",
"secret_type": "API_KEY",
"match": "sk_live_..."
}
]
```
***
### apileaks.txt
**Content:** API endpoints from Postman/Swagger leaks.
```
[Postman Collection: example-api]
POST /api/v1/users
GET /api/v1/orders
DELETE /api/v1/sessions
[Swagger: api.example.com]
/api/auth/login
/api/users/{id}
/api/admin/settings
```
***
### domain\_info.txt
**Content:** WHOIS and domain intelligence.
```
Domain: example.com
Registrar: GoDaddy
Created: 1995-08-14
Expires: 2025-08-13
Registrant: Example Corporation
Email: domains@example.com
Nameservers:
ns1.example.com
ns2.example.com
```
***
### spf\_dmarc.txt
**Content:** Email security analysis.
```
Domain: example.com
SPF Record: v=spf1 include:_spf.google.com ~all
Status: CONFIGURED
Policy: Soft fail
DMARC Record: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
Status: CONFIGURED
Policy: Quarantine
Email Spoofing: PROTECTED (moderate)
```
***
## Vulnerability Files (`vulns/`)
### nuclei\_output/
**Content:** Nuclei scan results in JSON format.
**Files:**
* `nuclei_critical.json`
* `nuclei_high.json`
* `nuclei_medium.json`
* `nuclei_low.json`
* `nuclei_info.json`
**Sample JSON:**
```json
{
"template-id": "cve-2021-44228-log4j-rce",
"info": {
"name": "Apache Log4j RCE",
"severity": "critical",
"tags": ["cve", "rce", "log4j"]
},
"matcher-name": "dns",
"host": "https://api.example.com",
"matched-at": "https://api.example.com/api/v1/log",
"timestamp": "2023-06-15T10:30:45Z"
}
```
***
### xss.txt
**Content:** XSS vulnerability findings.
```
[VULNERABLE] https://example.com/search?q=
Payload:
Type: Reflected XSS
[VULNERABLE] https://example.com/user?name=">
Payload: ">
Type: Reflected XSS
```
***
### sqli.txt
**Content:** SQL injection findings.
```
[VULNERABLE] https://example.com/product?id=1
Parameter: id
Type: Boolean-based blind
Payload: 1 AND 1=1
DBMS: MySQL
[VULNERABLE] https://example.com/user?name=admin
Parameter: name
Type: Error-based
Payload: admin'
DBMS: PostgreSQL
```
***
### ssrf.txt
**Content:** SSRF vulnerability findings.
```
[VULNERABLE] https://example.com/fetch?url=http://169.254.169.254
Parameter: url
Type: Blind SSRF
Evidence: Delayed response / OOB callback
```
***
### cors.txt
**Content:** CORS misconfiguration findings.
```
[MISCONFIGURED] https://api.example.com
Issue: Arbitrary Origin Reflection
ACAO: *
ACAC: true
Impact: Credential theft possible
```
***
### redirect.txt
**Content:** Open redirect findings.
```
[VULNERABLE] https://example.com/redirect?url=https://evil.com
Parameter: url
Redirects to: https://evil.com
```
***
### lfi.txt
**Content:** Local File Inclusion findings.
```
[VULNERABLE] https://example.com/view?file=../../../etc/passwd
Parameter: file
Payload: ../../../etc/passwd
Evidence: root:x:0:0:root:/root:/bin/bash
```
***
### testssl.txt
**Content:** SSL/TLS analysis results.
```
Testing: https://example.com
Protocol Support:
TLS 1.3: YES
TLS 1.2: YES
TLS 1.1: NO (good)
TLS 1.0: NO (good)
SSL 3.0: NO (good)
Vulnerabilities:
Heartbleed: NOT vulnerable
ROBOT: NOT vulnerable
BEAST: NOT vulnerable
Certificate:
Subject: CN=example.com
Issuer: Let's Encrypt
Valid Until: 2024-01-15
Key Size: 2048 bits
```
***
## JavaScript Files (`js/`)
### js\_files.txt
**Content:** Discovered JavaScript file URLs.
```
https://example.com/static/app.js
https://example.com/assets/bundle.min.js
https://example.com/js/vendor.js
https://cdn.example.com/lib/jquery-3.6.0.min.js
```
***
### js\_secrets.txt
**Content:** Secrets found in JavaScript files.
```
[API_KEY] https://example.com/app.js
Line 145: apiKey: "sk_live_abc123..."
[AWS_KEY] https://example.com/config.js
Line 23: accessKeyId: "AKIA..."
[PRIVATE_KEY] https://example.com/auth.js
Line 89: privateKey: "-----BEGIN RSA PRIVATE KEY-----"
```
***
### js\_endpoints.txt
**Content:** API endpoints extracted from JavaScript.
```
/api/v1/users
/api/v1/orders
/api/v2/products
/internal/admin/settings
/graphql
/api/auth/token
```
***
## Fuzzing Files (`fuzzing/`)
### fuzzing\_full.txt
**Content:** All fuzzing results combined.
```
[200] https://example.com/admin
[200] https://example.com/api
[301] https://example.com/docs → /documentation
[403] https://example.com/.git
[200] https://example.com/backup.zip
```
***
### fuzzing\_{subdomain}.txt
**Content:** Per-subdomain fuzzing results.
***
## Screenshots (`screenshots/`)
**Content:** Web page screenshots.
**Format:** PNG images named by URL hash.
**Files:**
* `https_www.example.com.png`
* `https_api.example.com.png`
* `http_dev.example.com_8080.png`
**Gallery View:** Use gowitness report for HTML gallery.
```bash
# Generate HTML report
gowitness report serve
```
***
## Log Files (`.log/`)
### reconftw\.log
**Content:** Main execution log.
```
[2023-06-15 10:00:00] Starting reconnaissance for example.com
[2023-06-15 10:00:01] Running sub_passive...
[2023-06-15 10:05:30] sub_passive completed: 150 subdomains
[2023-06-15 10:05:31] Running sub_crt...
```
***
### errors.log
**Content:** Error messages during execution.
```
[ERROR] subfinder: API rate limit exceeded for VirusTotal
[ERROR] httpx: Connection timeout for staging.example.com
[WARN] nuclei: Template cve-2021-1234 deprecated
```
***
## Checkpoint Files (`.called_fn/`)
**Content:** Function completion markers for checkpoint/resume.
**Files:**
```
.called_fn/
├── sub_passive
├── sub_crt
├── sub_brute
├── webprobe_simple
└── nuclei_check
```
**Purpose:** Resume interrupted scans from last checkpoint.
***
## Special Files
### assets.jsonl
**Content:** Automation-friendly asset list in JSON Lines format.
**Format:**
```json
{"subdomain":"www.example.com","ip":"93.184.216.34","url":"https://www.example.com","status":200,"title":"Example Site"}
{"subdomain":"api.example.com","ip":"93.184.216.35","url":"https://api.example.com","status":200,"title":"API v2"}
```
**Use Cases:**
* Pipeline integration
* Custom tooling
* Data analysis
***
### hotlist.txt
**Content:** Risk-scored priority targets.
**Format:** Assets with risk indicators.
```
[HIGH] https://admin.example.com - Admin panel exposed
[HIGH] https://api.example.com/graphql - GraphQL endpoint
[MEDIUM] https://staging.example.com - Staging environment
[MEDIUM] https://dev.example.com - Development server
```
***
## Interpreting Nuclei Results
### Severity Levels
| Severity | Description | Action |
| ------------ | ------------------------------- | ---------------------- |
| **Critical** | Immediate exploitation possible | Report immediately |
| **High** | Significant security impact | Prioritize remediation |
| **Medium** | Moderate risk | Schedule fix |
| **Low** | Minor issues | Best practice |
| **Info** | Informational | Document |
### Reading Nuclei JSON
```json
{
"template-id": "cve-2021-44228-log4j-rce",
"info": {
"name": "Apache Log4j2 RCE (CVE-2021-44228)",
"severity": "critical",
"description": "Apache Log4j2 allows remote code execution...",
"reference": ["https://nvd.nist.gov/vuln/detail/CVE-2021-44228"],
"tags": ["cve", "cve2021", "rce", "log4j", "apache"]
},
"type": "http",
"host": "https://api.example.com",
"matched-at": "https://api.example.com/api/v1/log",
"extracted-results": ["dns-callback-received"],
"curl-command": "curl -X POST ...",
"timestamp": "2023-06-15T10:30:45.123456789Z"
}
```
### Key Fields:
* `template-id`: Template identifier
* `severity`: Risk level
* `host`: Target URL
* `matched-at`: Exact vulnerable endpoint
* `extracted-results`: Evidence of vulnerability
* `curl-command`: Reproduction command
***
## Report Generation
### AI-Generated Reports
```bash
# Generate AI report
./reconftw.sh -d example.com -y
# Custom report type
./reconftw.sh -d example.com -y --report-type executive
```
**Report Types:**
* `detailed` - Technical deep-dive
* `executive` - High-level summary
* `compliance` - Compliance-focused
### Manual Report Creation
1. Collect key findings from:
* `vulns/nuclei_output/`
* `webs/takeover.txt`
* `osint/github_company_secrets.json`
2. Prioritize by severity
3. Include reproduction steps from curl commands
***
## Data Export
### Export to CSV
```bash
# Convert JSON to CSV
cat nuclei_output/*.json | jq -r '[.host, .["template-id"], .info.severity] | @csv'
```
### Export to Faraday
Automatic when `FARADAY` is enabled. Results imported to workspace.
### Export to JSON
Most output files have JSON equivalents in `.tmp/` directory.
***
## Cleanup
### Temporary Files
```bash
# Clear temp files
rm -rf Recon/example.com/.tmp/*
```
### Reset Checkpoints
```bash
# Remove checkpoints to re-run functions
rm -rf Recon/example.com/.called_fn/*
```
### Full Clean
```bash
# Remove all data for target
rm -rf Recon/example.com/
```
***
## Next Steps
* [**Integrations**](/integrations/axiom) - Axiom and Faraday
* [**Advanced Usage**](/advanced/advanced) - Custom functions
# Axiom Integration
> **Note**: Axiom was rebranded to "Ax Framework" but the tool and commands still use `axiom-*` naming. This documentation uses "Axiom" for consistency with the actual commands.
Axiom enables distributed scanning across cloud infrastructure, speeding up reconnaissance by parallelizing workloads across multiple instances.
***
## What is Axiom?
Axiom is an infrastructure automation framework that allows you to:
* **Spin up cloud instances on-demand** across multiple providers
* **Distribute scanning tasks** across a fleet of machines
* **Scale horizontally** for large-scale reconnaissance
* **Reduce scan time** from hours to minutes
***
## Prerequisites
### 1. Axiom Installation
```bash
# Install axiom
bash <(curl -s https://raw.githubusercontent.com/pry0cc/axiom/master/interact/axiom-configure)
# Or clone and install
git clone https://github.com/pry0cc/axiom ~/.axiom
cd ~/.axiom && ./interact/axiom-configure
```
### 2. Cloud Provider Setup
Supported providers:
* DigitalOcean (recommended)
* AWS
* Azure
* Linode
* Google Cloud
* Hetzner
* IBM Cloud
### 3. API Keys
Configure cloud provider credentials:
```bash
# Run axiom configuration
axiom-configure
```
***
## Configuration in reconFTW
### Enable Axiom Mode
```bash
# In reconftw.cfg
# Enable Axiom/VPS mode
AXIOM=true
# Fleet configuration
AXIOM_FLEET_NAME="reconftw" # Fleet identifier
AXIOM_FLEET_COUNT=10 # Number of instances
AXIOM_FLEET_LAUNCH=true # Auto-launch fleet
AXIOM_FLEET_SHUTDOWN=true # Auto-shutdown after scan
# Distributed tool settings
AXIOM_THREADS=20 # Threads per instance
```
### Instance Configuration
```bash
# Fleet instance settings
AXIOM_INSTANCE_TYPE="s-1vcpu-1gb" # DigitalOcean size
AXIOM_REGION="nyc1" # Deployment region
AXIOM_IMAGE="axiom-default" # Base image name
```
### Resolver Configuration
```bash
# Resolvers for distributed scanning
AXIOM_RESOLVERS_PATH="/home/op/lists/resolvers.txt"
```
***
## Running with Axiom
### Basic Usage
```bash
# Run with Axiom flag
./reconftw.sh -d example.com -a --vps
# Or use -v shorthand
./reconftw.sh -d example.com -a -v
```
### What Happens
1. **Fleet Launch:** Axiom spins up configured number of instances
2. **Tool Distribution:** Tools run across fleet in parallel
3. **Result Collection:** Results merged from all instances
4. **Fleet Shutdown:** Instances terminated (if configured)
***
## Distributed Scanning Flow
```
┌─────────────────────────────────────────────────────────────────────┐
│ Axiom Distributed Scanning │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────┐ │
│ │ Local Machine│ │
│ │ (reconFTW) │ │
│ └──────┬───────┘ │
│ │ │
│ │ axiom-fleet launch │
│ ▼ │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ Axiom Fleet (10 instances) │ │
│ ├──────────────────────────────────────────────────────┤ │
│ │ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ │ │
│ │ │ 01 │ │ 02 │ │ 03 │ │ 04 │ │ 05 │ │ │
│ │ └────┘ └────┘ └────┘ └────┘ └────┘ │ │
│ │ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ │ │
│ │ │ 06 │ │ 07 │ │ 08 │ │ 09 │ │ 10 │ │ │
│ │ └────┘ └────┘ └────┘ └────┘ └────┘ │ │
│ └──────────────────────────────────────────────────────┘ │
│ │ │
│ │ axiom-scan (distribute tasks) │
│ ▼ │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ Each instance processes portion of targets: │ │
│ │ - Instance 01: subdomains 1-1000 │ │
│ │ - Instance 02: subdomains 1001-2000 │ │
│ │ - ... │ │
│ └──────────────────────────────────────────────────────┘ │
│ │ │
│ │ Results merged │
│ ▼ │
│ ┌──────────────┐ │
│ │ Local Machine│ │
│ │ (combined │ │
│ │ results) │ │
│ └──────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘
```
***
## Tools with Axiom Support
reconFTW distributes these tools across the fleet:
| Tool | Distribution Type | Notes |
| --------- | ----------------- | ---------------------------- |
| subfinder | Target split | Each instance handles subset |
| httpx | Target split | URL probing distributed |
| nuclei | Target split | Vulnerability scanning |
| ffuf | Target split | Directory fuzzing |
| dnsx | Target split | DNS resolution |
| nmap | Target split | Port scanning |
| katana | Target split | Web crawling |
| dalfox | Target split | XSS testing |
***
## Fleet Management
### Manual Fleet Control
```bash
# Launch fleet
axiom-fleet reconftw -i 10
# Check fleet status
axiom-ls
# SSH to specific instance
axiom-ssh reconftw01
# Execute command on all instances
axiom-exec "nuclei -update-templates"
# Shutdown fleet
axiom-rm "reconftw*" -f
```
### Fleet Lifecycle
```bash
# In reconftw.cfg
# Auto-launch fleet if not running
AXIOM_FLEET_LAUNCH=true
# Shutdown after scan completion
AXIOM_FLEET_SHUTDOWN=true
# Keep fleet running for subsequent scans
AXIOM_FLEET_SHUTDOWN=false
```
***
## Cost Optimization
### Instance Sizing
| Provider | Instance | vCPU | RAM | Cost/hr |
| ------------ | ----------- | ---- | --- | ------- |
| DigitalOcean | s-1vcpu-1gb | 1 | 1GB | $0.007 |
| DigitalOcean | s-2vcpu-2gb | 2 | 2GB | $0.018 |
| AWS | t3.micro | 2 | 1GB | $0.012 |
| Linode | g6-nanode-1 | 1 | 1GB | $0.0075 |
### Cost Estimation
```
Fleet: 10 instances × $0.007/hr = $0.07/hr
Scan duration: 2 hours
Total cost: ~$0.14 per scan
```
### Best Practices
1. **Use smallest viable instance:** 1GB RAM sufficient for most tools
2. **Auto-shutdown:** Enable `AXIOM_FLEET_SHUTDOWN=true`
3. **Spot instances:** Use when available for 60-90% savings
4. **Regional pricing:** Some regions cheaper than others
***
## Resolver Management
### Upload Custom Resolvers
```bash
# Upload resolvers to fleet
axiom-scp resolvers.txt "reconftw*":/home/op/lists/
# Or use built-in resolver update
axiom-exec "dnsvalidator -tL public-resolvers.txt -threads 100 -o resolvers.txt"
```
### Configuration
```bash
# In reconftw.cfg
RESOLVERS_TRUSTED="/home/op/lists/resolvers_trusted.txt"
RESOLVERS="/home/op/lists/resolvers.txt"
# On fleet
AXIOM_RESOLVERS_PATH="/home/op/lists/resolvers.txt"
```
***
## Troubleshooting
### Fleet Won't Start
```bash
# Check cloud provider credentials
axiom-configure
# Verify API key
doctl auth init # DigitalOcean
aws configure # AWS
# Check available images
axiom-images ls
```
### SSH Connection Issues
```bash
# Regenerate SSH keys
axiom-init --regenerate
# Manual SSH test
ssh -i ~/.axiom/.sshkey root@
```
### Tools Not Running
```bash
# Update tools on fleet
axiom-exec "axiom-build tools"
# Verify tool installation
axiom-exec "which nuclei"
```
### Result Merge Failures
```bash
# Check disk space
axiom-exec "df -h"
# Manual result collection
axiom-scp "reconftw*":/home/op/recon/results.txt ./results/
```
***
## Advanced Configuration
### Custom Axiom Image
```bash
# Build custom image with all tools
axiom-build reconftw --install-tools
# Use custom image
AXIOM_IMAGE="reconftw-image"
```
### Per-Tool Distribution
```bash
# Override distribution for specific tools
AXIOM_SUBFINDER_DISTRIBUTE=true
AXIOM_NUCLEI_DISTRIBUTE=true
AXIOM_HTTPX_DISTRIBUTE=true
```
### Scan Modules
```bash
# reconFTW Axiom modules in modules/axiom.sh
# Functions prefixed with axiom_*
axiom_launch # Launch fleet
axiom_shutdown # Terminate fleet
axiom_selected # Run tool on fleet
axiom_exec # Execute command
```
***
## Example Workflows
### Large Target List
```bash
# Scan 10,000 subdomains with 20-instance fleet
AXIOM_FLEET_COUNT=20
./reconftw.sh -l targets_10k.txt -a -v
```
### Bug Bounty Program
```bash
# Weekly automated scan
./reconftw.sh -d target.com -a -v --incremental
```
### Red Team Assessment
```bash
# Quick initial recon
AXIOM_FLEET_COUNT=5
./reconftw.sh -d target.com -r -v
```
***
## Security Considerations
1. **Instance isolation:** Each scan uses fresh instances
2. **Credential management:** Cloud keys never touch targets
3. **Data cleanup:** Results removed from instances
4. **Network isolation:** Use private networking when possible
5. **Audit logging:** Enable cloud provider audit logs
***
## Next Steps
* [**Faraday Integration**](/integrations/faraday) - Vulnerability management
* [**Deployment Guide**](/deployment/deployment) - VPS setup
# Faraday Integration
Faraday is a collaborative vulnerability management platform. reconFTW integrates with Faraday to automatically import scan results.
***
## What is Faraday?
Faraday provides:
* **Centralized vulnerability database**
* **Team collaboration features**
* **Report generation**
* **Integration with 80+ security tools**
* **Workspace management**
***
## Prerequisites
### Faraday Installation
```bash
# Docker installation (recommended)
docker pull faradaysec/faraday:latest
docker run -d --name faraday -p 5985:5985 faradaysec/faraday
# Or native installation
pip install faradaysec
```
### Faraday Setup
1. Access Faraday web interface: `http://localhost:5985`
2. Create admin account
3. Create workspace for your project
4. Generate API token
***
## Configuration in reconFTW
### Enable Faraday Integration
```bash
# In reconftw.cfg
# Enable Faraday
FARADAY=true
# Faraday server URL
FARADAY_URL="http://localhost:5985"
# Workspace name
FARADAY_WORKSPACE="reconftw"
# API credentials (in secrets.cfg)
# FARADAY_API_TOKEN="your_token"
```
### secrets.cfg Setup
```bash
# In secrets.cfg
FARADAY_API_TOKEN="your_api_token_here"
```
***
## Data Imported to Faraday
reconFTW automatically sends:
| Data Type | Source | Faraday Entity |
| --------------- | -------------------- | -------------- |
| Hosts | Subdomain resolution | Host |
| Services | Port scan (nmap) | Service |
| Vulnerabilities | Nuclei results | Vulnerability |
| CVEs | Nmap vulners script | Vulnerability |
***
## Integration Flow
```
┌─────────────────────────────────────────────────────────────────────┐
│ Faraday Integration Flow │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────┐ │
│ │ reconFTW │ │
│ │ Scan │ │
│ └──────┬───────┘ │
│ │ │
│ ┌────┴────┬────────────┬─────────────┐ │
│ ▼ ▼ ▼ ▼ │
│ ┌──────┐ ┌───────┐ ┌──────────┐ ┌──────────┐ │
│ │Nuclei│ │ Nmap │ │ Hosts │ │ Services │ │
│ │ JSON │ │ XML │ │ IPs │ │ Ports │ │
│ └──┬───┘ └───┬───┘ └────┬─────┘ └────┬─────┘ │
│ │ │ │ │ │
│ └────┬────┴───────────┴─────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ │
│ │ faraday-cli │ (or API calls) │
│ └──────┬───────┘ │
│ │ │
│ │ POST /api/v3/ws/{workspace}/... │
│ ▼ │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ Faraday Server │ │
│ ├──────────────────────────────────────────────────────┤ │
│ │ ┌─────────┐ ┌─────────────┐ ┌────────────────┐ │ │
│ │ │ Hosts │ │ Services │ │ Vulnerabilities│ │ │
│ │ │ Table │ │ Table │ │ Table │ │ │
│ │ └─────────┘ └─────────────┘ └────────────────┘ │ │
│ └──────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘
```
***
## Workspace Management
### Create Workspace
```bash
# Via Faraday CLI
faraday-cli create_ws reconftw
# Via API
curl -X POST "http://localhost:5985/api/v3/ws" \
-H "Authorization: Token $FARADAY_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "reconftw"}'
```
### Workspace Strategy
| Strategy | Description | Use Case |
| ----------- | ---------------------------- | ----------------------- |
| Per-target | One workspace per domain | Isolated scans |
| Per-program | One workspace per bug bounty | Program tracking |
| Unified | Single workspace | Overview of all targets |
***
## Viewing Results
### Faraday Web Interface
1. Open `http://localhost:5985`
2. Select workspace (`reconftw`)
3. Navigate to:
* **Hosts:** All discovered hosts with IPs
* **Services:** Ports and services per host
* **Vulns:** All vulnerabilities by severity
### Faraday CLI
```bash
# List hosts
faraday-cli host -w reconftw
# List vulnerabilities
faraday-cli vuln -w reconftw
# Export report
faraday-cli report -w reconftw -o report.pdf
```
***
## Report Generation
### Built-in Reports
Faraday generates reports in multiple formats:
* PDF
* HTML
* Markdown
* CSV
### Custom Templates
```bash
# Create custom report template
faraday-cli report -w reconftw --template custom.html
```
***
## Advanced Configuration
### Severity Mapping
reconFTW maps nuclei severities to Faraday:
| Nuclei Severity | Faraday Severity |
| --------------- | ---------------- |
| critical | Critical |
| high | High |
| medium | Medium |
| low | Low |
| info | Informational |
### Custom Fields
```bash
# Add custom data to vulnerabilities
# In reconftw.cfg
FARADAY_CUSTOM_FIELDS=true
```
### Bulk Import
For large scans, results are batched:
```bash
# Batch size configuration
FARADAY_BATCH_SIZE=100
```
***
## Troubleshooting
### Connection Issues
```bash
# Test Faraday connectivity
curl -X GET "http://localhost:5985/api/v3/info" \
-H "Authorization: Token $FARADAY_API_TOKEN"
```
### Authentication Errors
```bash
# Verify token
# Check secrets.cfg has correct token
# Regenerate token in Faraday web UI if needed
```
### Missing Data
1. Check workspace exists
2. Verify scan completed successfully
3. Review Faraday logs: `docker logs faraday`
### Duplicate Entries
Faraday deduplicates by:
* Host: IP address
* Service: IP + port + protocol
* Vulnerability: Name + host + service
***
## Best Practices
1. **Workspace naming:** Use consistent naming convention
2. **Token security:** Keep API token in secrets.cfg
3. **Regular cleanup:** Archive old workspaces
4. **Backup:** Export workspaces regularly
5. **Access control:** Use Faraday roles for team access
***
## Alternative: Manual Import
If automatic integration fails, import manually:
```bash
# Import nmap results
faraday-cli tool nmap -w reconftw hosts/portscan_active.xml
# Import nuclei results
faraday-cli tool nuclei -w reconftw vulns/nuclei_output/*.json
```
***
## Next Steps
* [**Deployment Guide**](/deployment/deployment) - Full setup
* [**Output Interpretation**](/output/output) - Understanding results
# Deployment Guide
This guide covers all deployment options for reconFTW: local installation, Docker, cloud platforms, and infrastructure as code.
***
## Deployment Options Overview
| Method | Best For | Complexity |
| ----------------- | ---------------------------- | ---------- |
| Local Install | Development, single machine | Low |
| Docker | Portability, isolation | Low |
| VPS | Long-running scans | Medium |
| Terraform/Ansible | Reproducible infrastructure | High |
| Proxmox | Home lab, dedicated hardware | Medium |
***
## Local Installation
### System Requirements
| Resource | Minimum | Recommended |
| -------- | ------------- | ------------ |
| CPU | 2 cores | 4+ cores |
| RAM | 4 GB | 8+ GB |
| Disk | 20 GB | 50+ GB |
| OS | Ubuntu 20.04+ | Ubuntu 22.04 |
### Quick Install
```bash
# Clone repository
git clone https://github.com/six2dez/reconftw.git
cd reconftw
# Run installer
./install.sh
# Verify installation
./reconftw.sh --check-tools
```
### Manual Installation
```bash
# Install system dependencies
sudo apt update
sudo apt install -y git curl wget python3 python3-pip ruby golang jq
# Set up Go environment
export GOPATH=$HOME/go
export PATH=$PATH:$GOPATH/bin
echo 'export GOPATH=$HOME/go' >> ~/.bashrc
echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bashrc
# Clone and install
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh
```
### macOS Installation
```bash
# Install Homebrew dependencies
brew install git curl wget python3 go ruby jq coreutils gnu-sed
# Use GNU versions
export PATH="/opt/homebrew/opt/coreutils/libexec/gnubin:$PATH"
export PATH="/opt/homebrew/opt/gnu-sed/libexec/gnubin:$PATH"
# Clone and install
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh
```
***
## Docker Deployment
### Using Official Image
```bash
# Pull latest image
docker pull six2dez/reconftw:latest
# Run scan
docker run -it --rm \
-v $(pwd)/Recon:/reconftw/Recon \
-v $(pwd)/reconftw.cfg:/reconftw/reconftw.cfg \
-v $(pwd)/secrets.cfg:/reconftw/secrets.cfg \
six2dez/reconftw:latest \
-d example.com -r
```
### Docker Compose
Create `docker-compose.yml`:
```yaml
version: '3.8'
services:
reconftw:
image: six2dez/reconftw:latest
container_name: reconftw
volumes:
- ./Recon:/reconftw/Recon
- ./reconftw.cfg:/reconftw/reconftw.cfg
- ./secrets.cfg:/reconftw/secrets.cfg
- ./wordlists:/reconftw/wordlists
environment:
- TERM=xterm-256color
stdin_open: true
tty: true
command: ["-d", "example.com", "-r"]
```
Run with:
```bash
docker-compose up
```
### Building Custom Image
```dockerfile
# Dockerfile.custom
FROM six2dez/reconftw:latest
# Add custom tools
RUN go install -v github.com/custom/tool@latest
# Add custom wordlists
COPY ./wordlists /reconftw/wordlists
# Add custom config
COPY ./reconftw.cfg /reconftw/reconftw.cfg
```
Build and run:
```bash
docker build -t reconftw-custom -f Dockerfile.custom .
docker run -it --rm -v $(pwd)/Recon:/reconftw/Recon reconftw-custom -d example.com -r
```
### Volume Mounts
| Mount | Purpose |
| ------------------------ | ---------------- |
| `/reconftw/Recon` | Output directory |
| `/reconftw/reconftw.cfg` | Configuration |
| `/reconftw/secrets.cfg` | API keys |
| `/reconftw/wordlists` | Custom wordlists |
### Resource Limits
```yaml
# docker-compose.yml with limits
services:
reconftw:
image: six2dez/reconftw:latest
deploy:
resources:
limits:
cpus: '4'
memory: 8G
reservations:
cpus: '2'
memory: 4G
```
***
## VPS Deployment
### Recommended Providers
| Provider | Instance | Specs | Cost/mo |
| ------------ | ------------- | --------- | ------- |
| DigitalOcean | Basic Droplet | 2vCPU/4GB | $24 |
| Linode | Linode 4GB | 2vCPU/4GB | $24 |
| Vultr | Cloud Compute | 2vCPU/4GB | $24 |
| Hetzner | CX21 | 2vCPU/4GB | €5.83 |
| AWS | t3.medium | 2vCPU/4GB | \~$30 |
### Initial VPS Setup
```bash
# Connect to VPS
ssh root@your-vps-ip
# Update system
apt update && apt upgrade -y
# Create non-root user
adduser recon
usermod -aG sudo recon
# Switch to user
su - recon
# Install reconFTW
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh
```
### Security Hardening
```bash
# Disable root login
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
# Setup firewall
sudo ufw allow ssh
sudo ufw enable
# Install fail2ban
sudo apt install fail2ban
sudo systemctl enable fail2ban
```
### Running Long Scans
```bash
# Use tmux for persistent sessions
sudo apt install tmux
tmux new -s recon
# Start scan inside tmux
./reconftw.sh -d example.com -a
# Detach: Ctrl+B, then D
# Reattach: tmux attach -t recon
```
### Screen Alternative
```bash
# Use screen
screen -S recon
./reconftw.sh -d example.com -a
# Detach: Ctrl+A, then D
# Reattach: screen -r recon
```
***
## Terraform Deployment
### AWS Terraform
```hcl
# main.tf
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "~> 4.0"
}
}
}
provider "aws" {
region = "us-east-1"
}
resource "aws_instance" "reconftw" {
ami = "ami-0c55b159cbfafe1f0" # Ubuntu 22.04
instance_type = "t3.medium"
key_name = "your-key-pair"
vpc_security_group_ids = [aws_security_group.reconftw.id]
user_data = <<-EOF
#!/bin/bash
apt update
apt install -y git
git clone https://github.com/six2dez/reconftw.git /opt/reconftw
cd /opt/reconftw && ./install.sh
EOF
tags = {
Name = "reconftw"
}
root_block_device {
volume_size = 50
}
}
resource "aws_security_group" "reconftw" {
name = "reconftw-sg"
description = "Security group for reconFTW"
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["YOUR_IP/32"] # Restrict to your IP
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
output "instance_ip" {
value = aws_instance.reconftw.public_ip
}
```
Deploy:
```bash
terraform init
terraform plan
terraform apply
```
### DigitalOcean Terraform
```hcl
# main.tf
terraform {
required_providers {
digitalocean = {
source = "digitalocean/digitalocean"
version = "~> 2.0"
}
}
}
variable "do_token" {}
provider "digitalocean" {
token = var.do_token
}
resource "digitalocean_droplet" "reconftw" {
image = "ubuntu-22-04-x64"
name = "reconftw"
region = "nyc1"
size = "s-2vcpu-4gb"
ssh_keys = [digitalocean_ssh_key.default.fingerprint]
user_data = <<-EOF
#!/bin/bash
apt update
apt install -y git
git clone https://github.com/six2dez/reconftw.git /opt/reconftw
cd /opt/reconftw && ./install.sh
EOF
}
resource "digitalocean_ssh_key" "default" {
name = "reconftw-key"
public_key = file("~/.ssh/id_rsa.pub")
}
output "ip_address" {
value = digitalocean_droplet.reconftw.ipv4_address
}
```
***
## Ansible Deployment
### Playbook
```yaml
# reconftw-playbook.yml
---
- name: Deploy reconFTW
hosts: reconftw_servers
become: yes
vars:
reconftw_user: recon
reconftw_path: /opt/reconftw
tasks:
- name: Update apt cache
apt:
update_cache: yes
- name: Install dependencies
apt:
name:
- git
- curl
- wget
- python3
- python3-pip
- golang
- ruby
- jq
state: present
- name: Create reconftw user
user:
name: "{{ reconftw_user }}"
shell: /bin/bash
groups: sudo
append: yes
- name: Clone reconFTW
git:
repo: https://github.com/six2dez/reconftw.git
dest: "{{ reconftw_path }}"
version: main
become_user: "{{ reconftw_user }}"
- name: Run installer
shell: ./install.sh
args:
chdir: "{{ reconftw_path }}"
become_user: "{{ reconftw_user }}"
- name: Copy configuration
copy:
src: ./reconftw.cfg
dest: "{{ reconftw_path }}/reconftw.cfg"
owner: "{{ reconftw_user }}"
mode: '0644'
- name: Copy secrets
copy:
src: ./secrets.cfg
dest: "{{ reconftw_path }}/secrets.cfg"
owner: "{{ reconftw_user }}"
mode: '0600'
```
### Inventory
```ini
# inventory.ini
[reconftw_servers]
reconftw-1 ansible_host=192.168.1.100 ansible_user=root
reconftw-2 ansible_host=192.168.1.101 ansible_user=root
```
Run:
```bash
ansible-playbook -i inventory.ini reconftw-playbook.yml
```
***
## Proxmox Deployment
### Create VM
1. Upload Ubuntu ISO to Proxmox
2. Create VM:
* CPU: 2+ cores
* RAM: 4+ GB
* Disk: 50+ GB
3. Install Ubuntu
4. Install reconFTW
### LXC Container
```bash
# Create container
pct create 100 local:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst \
--hostname reconftw \
--memory 4096 \
--cores 2 \
--rootfs local-lvm:50 \
--net0 name=eth0,bridge=vmbr0,ip=dhcp
# Start container
pct start 100
# Enter container
pct enter 100
# Install reconFTW
apt update && apt install -y git
git clone https://github.com/six2dez/reconftw.git
cd reconftw && ./install.sh
```
***
## CI/CD Integration
### GitHub Actions
#### Basic Weekly Scan
```yaml
# .github/workflows/reconftw.yml
name: reconFTW Scan
on:
schedule:
- cron: '0 0 * * 0' # Weekly on Sunday
workflow_dispatch:
inputs:
target:
description: 'Target domain'
required: true
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup reconFTW
run: |
git clone https://github.com/six2dez/reconftw.git
cd reconftw && ./install.sh
- name: Configure secrets
run: |
echo "SHODAN_API_KEY=${{ secrets.SHODAN_API_KEY }}" >> reconftw/secrets.cfg
- name: Run scan
run: |
cd reconftw
./reconftw.sh -d ${{ github.event.inputs.target }} -r
- name: Upload results
uses: actions/upload-artifact@v3
with:
name: reconftw-results
path: reconftw/Recon/
```
#### Advanced: Multi-Target with Diff and Notifications
```yaml
# .github/workflows/reconftw-advanced.yml
name: reconFTW Multi-Target Scan
on:
schedule:
- cron: '0 2 * * 0' # Weekly Sunday 2AM
workflow_dispatch:
env:
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
jobs:
scan:
runs-on: ubuntu-latest
strategy:
matrix:
target: [target1.com, target2.com, target3.com]
max-parallel: 1 # Sequential to avoid rate limits
steps:
- name: Setup reconFTW
run: |
git clone https://github.com/six2dez/reconftw.git
cd reconftw && ./install.sh
- name: Configure
run: |
cd reconftw
cat << 'EOF' > secrets.cfg
SHODAN_API_KEY="${{ secrets.SHODAN_API_KEY }}"
GITHUB_TOKEN="${{ secrets.GH_TOKEN }}"
EOF
- name: Restore previous results
uses: actions/cache@v3
with:
path: reconftw/Recon/${{ matrix.target }}
key: reconftw-${{ matrix.target }}-${{ github.run_number }}
restore-keys: reconftw-${{ matrix.target }}-
- name: Run scan
run: |
cd reconftw
./reconftw.sh -d ${{ matrix.target }} -r --incremental
- name: Generate diff
id: diff
run: |
cd reconftw/Recon/${{ matrix.target }}
# Count new findings
NEW_SUBS=$(wc -l < subdomains/subdomains.txt 2>/dev/null || echo 0)
VULNS=$(cat vulns/nuclei_output.json 2>/dev/null | jq -s 'length' || echo 0)
echo "new_subs=$NEW_SUBS" >> $GITHUB_OUTPUT
echo "vulns=$VULNS" >> $GITHUB_OUTPUT
- name: Notify Slack
if: steps.diff.outputs.vulns > 0
run: |
curl -X POST -H 'Content-type: application/json' \
--data '{"text":"🔔 reconFTW: ${{ matrix.target }} - ${{ steps.diff.outputs.new_subs }} subs, ${{ steps.diff.outputs.vulns }} vulns"}' \
$SLACK_WEBHOOK
- name: Upload results
uses: actions/upload-artifact@v3
with:
name: results-${{ matrix.target }}
path: reconftw/Recon/${{ matrix.target }}
retention-days: 30
```
#### Scheduled with Faraday Integration
```yaml
# .github/workflows/reconftw-faraday.yml
name: reconFTW to Faraday
on:
schedule:
- cron: '0 3 * * 1' # Weekly Monday 3AM
jobs:
scan:
runs-on: ubuntu-latest
steps:
- name: Setup
run: |
git clone https://github.com/six2dez/reconftw.git
cd reconftw && ./install.sh
- name: Configure Faraday
run: |
cd reconftw
cat << EOF >> reconftw.cfg
FARADAY=true
FARADAY_URL="${{ secrets.FARADAY_URL }}"
FARADAY_USER="${{ secrets.FARADAY_USER }}"
FARADAY_PASSWORD="${{ secrets.FARADAY_PASSWORD }}"
FARADAY_WORKSPACE="${{ github.event.inputs.workspace || 'default' }}"
EOF
- name: Run scan
run: |
cd reconftw
./reconftw.sh -l targets.txt -r
```
### GitLab CI
#### Basic Pipeline
```yaml
# .gitlab-ci.yml
stages:
- scan
reconftw_scan:
stage: scan
image: six2dez/reconftw:latest
script:
- ./reconftw.sh -d $TARGET_DOMAIN -r
artifacts:
paths:
- Recon/
expire_in: 1 week
only:
- schedules
```
#### Advanced: Parallel Targets with Reports
```yaml
# .gitlab-ci.yml
stages:
- scan
- report
variables:
TARGETS: "target1.com target2.com target3.com"
.scan_template: &scan_template
image: six2dez/reconftw:latest
before_script:
- echo "$SECRETS_CFG" > secrets.cfg
artifacts:
paths:
- Recon/
expire_in: 2 weeks
scan_target1:
<<: *scan_template
stage: scan
script:
- ./reconftw.sh -d target1.com -r
only:
- schedules
scan_target2:
<<: *scan_template
stage: scan
script:
- ./reconftw.sh -d target2.com -r
only:
- schedules
generate_report:
stage: report
image: python:3.9
dependencies:
- scan_target1
- scan_target2
script:
- pip install jinja2
- python scripts/generate_report.py
artifacts:
paths:
- report.html
expire_in: 4 weeks
```
### Jenkins Pipeline
```groovy
// Jenkinsfile
pipeline {
agent any
parameters {
string(name: 'TARGET', defaultValue: 'example.com', description: 'Target domain')
choice(name: 'MODE', choices: ['passive', 'recon', 'all'], description: 'Scan mode')
}
environment {
SHODAN_API_KEY = credentials('shodan-api-key')
GITHUB_TOKEN = credentials('github-token')
}
stages {
stage('Setup') {
steps {
sh '''
git clone https://github.com/six2dez/reconftw.git || true
cd reconftw && git pull && ./install.sh
'''
}
}
stage('Configure') {
steps {
sh '''
cd reconftw
echo "SHODAN_API_KEY=${SHODAN_API_KEY}" > secrets.cfg
echo "GITHUB_TOKEN=${GITHUB_TOKEN}" >> secrets.cfg
'''
}
}
stage('Scan') {
steps {
sh '''
cd reconftw
MODE_FLAG=""
case "${MODE}" in
passive) MODE_FLAG="-p" ;;
recon) MODE_FLAG="-r" ;;
all) MODE_FLAG="-a" ;;
esac
./reconftw.sh -d ${TARGET} ${MODE_FLAG}
'''
}
}
stage('Archive') {
steps {
archiveArtifacts artifacts: 'reconftw/Recon/**/*', fingerprint: true
}
}
stage('Notify') {
when {
expression {
return fileExists('reconftw/Recon/${TARGET}/vulns/nuclei_output.json')
}
}
steps {
script {
def vulnCount = sh(
script: 'cat reconftw/Recon/${TARGET}/vulns/nuclei_output.json | jq -s length',
returnStdout: true
).trim()
if (vulnCount.toInteger() > 0) {
slackSend(
color: 'danger',
message: "reconFTW found ${vulnCount} vulnerabilities on ${TARGET}"
)
}
}
}
}
}
post {
always {
cleanWs()
}
}
}
```
### Cron-based (Linux Server)
```bash
#!/bin/bash
# /opt/reconftw/scripts/weekly_scan.sh
RECONFTW_PATH="/opt/reconftw"
TARGETS_FILE="/opt/reconftw/targets.txt"
RESULTS_PATH="/var/reconftw-results"
DATE=$(date +%Y-%m-%d)
# Ensure directories exist
mkdir -p "$RESULTS_PATH/$DATE"
# Run scans
while IFS= read -r target; do
echo "[$(date)] Starting scan for $target"
cd "$RECONFTW_PATH"
./reconftw.sh -d "$target" -r -o "$RESULTS_PATH/$DATE/$target"
# Generate diff if previous results exist
PREV=$(ls -1 "$RESULTS_PATH" | grep -v "$DATE" | sort -r | head -1)
if [[ -n "$PREV" && -d "$RESULTS_PATH/$PREV/$target" ]]; then
echo "[$(date)] Generating diff against $PREV"
diff -rq "$RESULTS_PATH/$PREV/$target/subdomains" \
"$RESULTS_PATH/$DATE/$target/subdomains" \
> "$RESULTS_PATH/$DATE/$target/diff_subs.txt" 2>/dev/null
fi
echo "[$(date)] Completed scan for $target"
done < "$TARGETS_FILE"
# Cleanup old results (keep 4 weeks)
find "$RESULTS_PATH" -maxdepth 1 -type d -mtime +28 -exec rm -rf {} \;
# Send summary
TOTAL_VULNS=$(cat "$RESULTS_PATH/$DATE"/*/vulns/nuclei_output.json 2>/dev/null | jq -s 'length')
echo "Weekly scan complete. Total vulnerabilities: $TOTAL_VULNS" | \
mail -s "reconFTW Weekly Report" security@company.com
```
**Cron entry:**
```bash
# /etc/cron.d/reconftw
0 2 * * 0 root /opt/reconftw/scripts/weekly_scan.sh >> /var/log/reconftw.log 2>&1
```
***
## Post-Deployment
### Verify Installation
```bash
# Check tools
./reconftw.sh --check-tools
# System health
./reconftw.sh --health-check
# Test scan
./reconftw.sh -d example.com -p
```
### Configure API Keys
```bash
# Edit secrets.cfg
nano secrets.cfg
# Add keys
SHODAN_API_KEY="your_key"
GITHUB_TOKEN="your_token"
# ... more keys
```
### Update Tools
```bash
# Update reconFTW and reinstall tools
git pull
./install.sh
```
***
## Resource Management
### Monitor Usage
```bash
# CPU and memory
htop
# Disk usage
df -h
# Network
iftop
```
### Cleanup
```bash
# Clear old results
rm -rf Recon/old-target/
# Clear temp files
rm -rf Recon/*/tmp/*
# Docker cleanup
docker system prune -a
```
***
## Next Steps
* [**Configuration**](/configuration/configuration) - Customize settings
* [**Usage Guide**](/usage/usage) - Run scans
* [**Axiom Integration**](/integrations/axiom) - Distributed scanning
# Advanced Usage
This guide covers advanced features, customization, and optimization techniques for power users.
***
## Custom Function Execution
### Running Specific Functions
Use the `-c` flag to run specific functions:
```bash
# Run single function
./reconftw.sh -d example.com -c nuclei_check
# Run multiple functions
./reconftw.sh -d example.com -c sub_passive
./reconftw.sh -d example.com -c webprobe_simple
./reconftw.sh -d example.com -c nuclei_check
```
### Available Functions
| Module | Functions |
| ---------- | ------------------------------------------------------------------- |
| OSINT | `google_dorks`, `github_dorks`, `metadata`, `emails`, `domain_info` |
| Subdomains | `sub_passive`, `sub_crt`, `sub_brute`, `sub_permut`, `sub_dns` |
| Web | `webprobe_simple`, `screenshot`, `fuzz`, `urlchecks`, `jschecks` |
| Vulns | `nuclei_check`, `xss`, `sqli`, `ssrf_checks`, `cors` |
| Hosts | `portscan`, `cdnprovider`, `waf_checks`, `geo_info` |
### Function Dependencies
Some functions depend on others:
```
webprobe_simple → screenshot → urlchecks → jschecks
sub_passive → sub_dns → webprobe_simple
```
***
## Creating Custom Modules
### Module Structure
```bash
# Create custom module: modules/custom.sh
#!/bin/bash
custom_function() {
start_func "${FUNCNAME[0]}" "Running custom check"
# Your code here
echo "Custom scan for $domain"
# Use existing outputs
if [[ -f "$dir/webs/webs.txt" ]]; then
cat "$dir/webs/webs.txt" | custom-tool > "$dir/custom/results.txt"
fi
end_func "Results: $dir/custom/results.txt"
}
```
### Loading Custom Modules
Add to reconftw\.sh:
```bash
# Load custom module
source "$SCRIPTPATH/modules/custom.sh"
```
### Function Templates
```bash
# Template with all features
my_function() {
# Function lifecycle
start_func "${FUNCNAME[0]}" "Description"
# Check if should run in DEEP mode
if should_run_deep "$input_file" "$DEEP_LIMIT"; then
# DEEP mode behavior
fi
# Use axiom if enabled
if [[ "$AXIOM" == true ]]; then
axiom_scan "$input_file" "my-tool" "$output_file"
else
my-tool < "$input_file" > "$output_file"
fi
# Notifications
notification "Found $(wc -l < $output_file) results"
# End function
end_func "Completed: $(wc -l < $output_file) results"
}
```
***
## Plugin System
### Plugin Architecture
reconFTW supports plugins via hooks:
```bash
# In reconftw.cfg
PLUGINS=true
PLUGINS_PATH="$SCRIPTPATH/plugins"
```
### Creating Plugins
```bash
# plugins/my-plugin.sh
#!/bin/bash
# Hook: after_subdomains
plugin_after_subdomains() {
echo "[PLUGIN] Processing subdomains..."
# Custom post-processing
}
# Hook: after_scan
plugin_after_scan() {
echo "[PLUGIN] Scan completed, generating custom report..."
# Custom reporting
}
# Register plugin
plugins_register "my-plugin" "after_subdomains,after_scan"
```
### Available Hooks
| Hook | Timing |
| ------------------ | ---------------------------- |
| `before_scan` | Before scan starts |
| `after_subdomains` | After subdomain enumeration |
| `after_webprobe` | After web probing |
| `after_vulns` | After vulnerability scanning |
| `after_scan` | After scan completes |
***
## Wordlist Customization
### Custom Wordlist Configuration
```bash
# In reconftw.cfg
# Custom subdomain wordlists
subs_wordlist="$SCRIPTPATH/wordlists/custom_subdomains.txt"
subs_wordlist_big="$SCRIPTPATH/wordlists/custom_subdomains_big.txt"
# Custom directory wordlists
fuzz_wordlist="$SCRIPTPATH/wordlists/custom_dirs.txt"
# Optional vuln-specific wordlists
lfi_wordlist="$SCRIPTPATH/wordlists/custom_lfi.txt"
ssti_wordlist="$SCRIPTPATH/wordlists/custom_ssti.txt"
```
### Generating Custom Wordlists
```bash
# Generate target-specific wordlist
./reconftw.sh -d example.com -c wordlist_gen
# Merge wordlists
cat wordlist1.txt wordlist2.txt | sort -u > merged.txt
# Filter by length
awk 'length($0) >= 3 && length($0) <= 20' wordlist.txt > filtered.txt
```
### Per-Target Wordlists
```bash
# Create target-specific wordlist directory
mkdir -p wordlists/example.com/
# Place custom wordlists
cp custom_subs.txt wordlists/example.com/subdomains.txt
cp custom_dirs.txt wordlists/example.com/fuzzing.txt
# reconFTW will use if present
```
***
## Resolver Optimization
### Resolver Setup
```bash
# Validate resolvers
dnsvalidator -tL public_resolvers.txt -threads 100 -o resolvers.txt
# Use validated resolvers
RESOLVERS="$SCRIPTPATH/resolvers.txt"
```
### Trusted Resolvers
```bash
# Trusted resolvers (for sensitive queries)
RESOLVERS_TRUSTED="$SCRIPTPATH/resolvers_trusted.txt"
# Contents: reliable, trusted DNS servers
8.8.8.8
8.8.4.4
1.1.1.1
9.9.9.9
```
### Resolver Rotation
```bash
# Enable resolver rotation
RESOLVER_ROTATE=true
RESOLVER_ROTATE_INTERVAL=100 # Rotate every 100 queries
```
***
## Incremental Mode Deep Dive
### How Incremental Works
1. First scan: Full enumeration, results saved
2. Subsequent scans: Compare new vs existing
3. Process only NEW findings
4. Merge results
```bash
# Enable incremental
./reconftw.sh -d example.com -r --incremental
```
### Incremental Data Flow
```
┌─────────────────────────────────────────────────────────────────────┐
│ Incremental Scan Flow │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────┐ ┌──────────────┐ │
│ │ New Scan │ │ Previous │ │
│ │ Results │ │ Results │ │
│ └──────┬───────┘ └──────┬───────┘ │
│ │ │ │
│ └────────┬───────────┘ │
│ │ │
│ ▼ │
│ ┌───────────────┐ │
│ │ Compare │ │
│ │ (comm/diff) │ │
│ └───────┬───────┘ │
│ │ │
│ ┌───────────┼───────────┐ │
│ ▼ ▼ ▼ │
│ ┌───────┐ ┌────────┐ ┌────────┐ │
│ │ New │ │ Common │ │Removed │ │
│ │ Items │ │ Items │ │ Items │ │
│ └───┬───┘ └────────┘ └────────┘ │
│ │ │
│ ▼ │
│ ┌─────────────────┐ │
│ │ Process ONLY │ │
│ │ New Items │ │
│ └─────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘
```
### Incremental Configuration
```bash
# In reconftw.cfg
INCREMENTAL=true
DIFF_ONLY=true # Process only differences
DIFF_NOTIFY=true # Notify on new findings
```
***
## Checkpoint/Recovery System
### How Checkpoints Work
```bash
# Checkpoint directory
Recon/example.com/.called_fn/
# Each completed function creates a marker
.called_fn/
├── sub_passive
├── sub_crt
├── webprobe_simple
└── nuclei_check
```
### Resuming Interrupted Scans
```bash
# Scan interrupted at nuclei_check
./reconftw.sh -d example.com -a
# Resume - skips completed functions
./reconftw.sh -d example.com -a
# Output: [sub_passive] Already run, skipping...
```
### Reset Checkpoints
```bash
# Reset all checkpoints (full rescan)
rm -rf Recon/example.com/.called_fn/
# Reset specific function
rm Recon/example.com/.called_fn/nuclei_check
```
### Checkpoint Configuration
```bash
# In reconftw.cfg
USE_CHECKPOINT=true # Enable checkpoint system
CHECKPOINT_DIR=".called_fn"
```
***
## Rate Limiting Strategies
### Per-Tool Rate Limits
```bash
# In reconftw.cfg
# httpx rate limit (requests per second)
HTTPX_RATELIMIT=150
# Nuclei rate limit
NUCLEI_RATELIMIT=150
# FFUF rate limit
FFUF_RATELIMIT=0 # 0 = no limit
```
### Adaptive Rate Limiting
```bash
# Enable adaptive rate limiting
./reconftw.sh -d example.com -a --adaptive-rate
# Automatically adjusts based on:
# - Response times
# - Error rates
# - 429 responses
```
### Global Rate Limit
```bash
# Limit all requests
./reconftw.sh -d example.com -r -q 100 # 100 req/sec global
```
### Target-Specific Limits
```bash
# Create scope file with rate limits
echo "example.com:50" > scope.txt # 50 req/sec for this target
./reconftw.sh -d example.com -r -i scope.txt
```
***
## Multi-Target Scanning
### Target List
```bash
# targets.txt
example.com
test.com
target.org
```
```bash
# Scan multiple targets
./reconftw.sh -l targets.txt -r
```
### Parallel Execution
```bash
# Run multiple scans in parallel
cat targets.txt | parallel -j 3 "./reconftw.sh -d {} -r"
```
### Multi-Target with Different Configs
```bash
# Create per-target configs
cp reconftw.cfg configs/example.com.cfg
cp reconftw.cfg configs/target.org.cfg
# Run with specific config
./reconftw.sh -d example.com -r -f configs/example.com.cfg
```
***
## Scope File Management
### Scope File Format
```bash
# inscope.txt - domains to include
example.com
*.example.com
api.example.org
# outofscope.txt - domains to exclude
blog.example.com
legacy.example.com
```
### Using Scope Files
```bash
# Include scope
./reconftw.sh -d example.com -r -i inscope.txt
# Exclude scope
./reconftw.sh -d example.com -r -x outofscope.txt
# Both
./reconftw.sh -d example.com -r -i inscope.txt -x outofscope.txt
```
### Wildcard Scopes
```bash
# inscope.txt with wildcards
*.example.com # All subdomains
*.*.example.com # Second-level subdomains
api.*.example.com # api.X.example.com pattern
```
***
## Notification Customization
### Notification Providers
```bash
# In reconftw.cfg
NOTIFICATION=true
# Configure in ~/.config/notify/provider-config.yaml
```
### Provider Configuration
```yaml
# ~/.config/notify/provider-config.yaml
slack:
- id: "slack-webhook"
slack_webhook_url: "https://hooks.slack.com/services/XXX"
discord:
- id: "discord-webhook"
discord_webhook_url: "https://discord.com/api/webhooks/XXX"
telegram:
- id: "telegram"
telegram_api_key: "XXX"
telegram_chat_id: "XXX"
```
### Custom Notification Templates
```bash
# Custom notification format
notification() {
local message="$1"
echo "[$(date)] $domain: $message" | notify -silent
}
```
***
## AI Report Customization
### AI Configuration
```bash
# In reconftw.cfg
AI_REPORT=true
AI_MODEL="gpt-4"
AI_REPORT_TYPE="detailed" # detailed, executive, compliance
```
### Custom Report Prompts
```bash
# Custom system prompt
AI_SYSTEM_PROMPT="You are a senior penetration tester..."
# Custom report sections
AI_REPORT_SECTIONS="executive_summary,findings,recommendations,methodology"
```
### Report Types
| Type | Focus | Audience |
| ------------ | ------------------- | ------------- |
| `detailed` | Technical deep-dive | Security team |
| `executive` | High-level summary | Management |
| `compliance` | Compliance mapping | Auditors |
***
## Performance Tuning
### Thread Optimization
```bash
# In reconftw.cfg
# Based on CPU cores (nproc)
THREADS=$(($(nproc) * 2))
# Per-tool threads
HTTPX_THREADS=50
FFUF_THREADS=40
KATANA_THREADS=20
DALFOX_THREADS=200
RESOLVE_DOMAINS_THREADS=150
TLSX_THREADS=1000
```
### Memory Management
```bash
# Limit memory-intensive tools
FFUF_THREADS=20 # Reduce if OOM
HTTPX_THREADS=20
KATANA_THREADS=10
# Use streaming where possible
# Avoid loading large files into memory
```
### Disk I/O Optimization
```bash
# Use SSD for output directory
OUTPUT="/mnt/ssd/Recon"
# Compress old results
tar -czf old_results.tar.gz Recon/old_target/
```
### Network Optimization
```bash
# Reduce HTTP timeouts
HTTPX_TIMEOUT=5
HTTPX_UNCOMMONPORTS_TIMEOUT=5
# Reduce passive enum time window
SUBFINDER_ENUM_TIMEOUT=120
```
***
## Circuit Breaker Pattern
### Configuration
```bash
# In reconftw.cfg
CIRCUIT_BREAKER=true
CIRCUIT_BREAKER_THRESHOLD=50 # Error threshold
CIRCUIT_BREAKER_TIMEOUT=300 # Cooldown in seconds
```
### Behavior
1. **Closed:** Normal operation
2. **Open:** Too many errors, stop requests
3. **Half-Open:** Test with few requests
4. **Recovery:** Resume normal operation
***
## Environment Variables
### Override Configuration
```bash
# Set via environment
export RECONFTW_THREADS=100
export RECONFTW_OUTPUT="/custom/output"
./reconftw.sh -d example.com -r
```
### Precedence
1. Command-line flags (highest)
2. Environment variables
3. Custom config file (-f)
4. Default reconftw\.cfg (lowest)
***
## Debugging
### Dry Run Mode
```bash
# Preview commands without executing
./reconftw.sh -d example.com -r --dry-run
```
### Verbose Output
```bash
# Enable debug logging
DEBUG=true ./reconftw.sh -d example.com -r
# Or in config
DEBUG=true
```
### Log Analysis
```bash
# Check execution log
tail -f Recon/example.com/.log/reconftw.log
# Check errors
grep -i error Recon/example.com/.log/*.log
```
***
## Next Steps
* [**Troubleshooting**](/help/troubleshooting) - Common issues
* [**Configuration**](/configuration/configuration) - All options
# Performance Tuning
Optimize reconFTW for your target size, hardware, and time constraints.
***
## Quick Tuning Profiles
Copy-paste these configurations based on your scenario:
### Small Target (< 100 subdomains)
```bash
# In reconftw.cfg - Small target, thorough scan
# Enable DEEP mode (more thorough)
DEEP=true
DEEP_LIMIT=500
DEEP_LIMIT2=2000
# Moderate threads (don't overwhelm small infra)
HTTPX_THREADS=50
FFUF_THREADS=40
NUCLEI_RATELIMIT=100
# Enable all checks
NUCLEICHECK=true
FUZZ=true
CORS=true
XSS=true
SQLI=true
# Time estimate: 1-2 hours
```
### Medium Target (100-1,000 subdomains)
```bash
# In reconftw.cfg - Medium target, balanced
# Standard DEEP limits
DEEP_LIMIT=500
DEEP_LIMIT2=1500
# Higher threads
HTTPX_THREADS=100
FFUF_THREADS=60
NUCLEI_RATELIMIT=150
# Core checks enabled
NUCLEICHECK=true
FUZZ=true
XSS=true
SQLI=true
# Skip some heavy checks
SMUGGLING=false
WEBCACHE=false
PROTOTYPE_POLLUTION=false
# Time estimate: 2-4 hours
```
### Large Target (1,000-10,000 subdomains)
```bash
# In reconftw.cfg - Large target, efficient
# Lower DEEP limits (skip intensive checks for large lists)
DEEP_LIMIT=200
DEEP_LIMIT2=500
# High threads
HTTPX_THREADS=150
FFUF_THREADS=80
NUCLEI_RATELIMIT=200
# Essential checks only
NUCLEICHECK=true
FUZZ=false # Too slow for large targets
XSS=true
SQLI=false # Use nuclei SQLi templates instead
# Skip slow modules
SMUGGLING=false
WEBCACHE=false
PROTOTYPE_POLLUTION=false
GRAPHQL_SCAN=false
WEBSOCKET_CHECKS=false
# Time estimate: 4-8 hours
```
### Massive Target (10,000+ subdomains)
```bash
# In reconftw.cfg - Massive target, speed priority
# Minimal DEEP mode
DEEP_LIMIT=100
DEEP_LIMIT2=200
# Maximum threads
HTTPX_THREADS=200
FFUF_THREADS=100
NUCLEI_RATELIMIT=300
# Only nuclei scanning
NUCLEICHECK=true
FUZZ=false
XSS=false
SQLI=false
SSRF_CHECKS=false
CORS=false
# Use Axiom for distribution
AXIOM=true
AXIOM_FLEET_COUNT=20
# Time estimate: 8-24 hours (or 2-4 with Axiom)
```
***
## Understanding DEEP Mode
DEEP mode runs additional checks when target size is below threshold.
### How It Works
```
Target subdomains count:
├── Below DEEP_LIMIT (500) → Run intensive checks (DEEP mode)
├── Below DEEP_LIMIT2 (1500) → Run moderate checks
└── Above DEEP_LIMIT2 → Skip intensive checks
```
### What DEEP Mode Enables
| Check | Without DEEP | With DEEP |
| ------------------- | ------------------ | ----------------------- |
| Permutations | Basic | AI + Regex permutations |
| Fuzzing | Top dirs only | Full wordlist |
| JS Analysis | Extract endpoints | Full secret scanning |
| Nuclei | Critical/High only | All severities |
| Parameter discovery | Skip | Full discovery |
### Configuring DEEP Limits
```bash
# For thorough scanning (small targets)
DEEP_LIMIT=1000
DEEP_LIMIT2=3000
# For fast scanning (large targets)
DEEP_LIMIT=100
DEEP_LIMIT2=300
# Disable DEEP mode entirely
DEEP=false
```
***
## Thread Optimization
### By Tool
| Tool | Default | Min (Stealth) | Max (Speed) | Notes |
| ------------------------- | ------- | ------------- | ----------- | ----------------------- |
| `HTTPX_THREADS` | 50 | 10 | 200 | HTTP probing |
| `FFUF_THREADS` | 40 | 10 | 100 | Directory fuzzing |
| `NUCLEI_RATELIMIT` | 150 | 30 | 500 | Vuln scanning (req/sec) |
| `DALFOX_THREADS` | 200 | 50 | 500 | XSS testing |
| `TLSX_THREADS` | 1000 | 200 | 2000 | TLS analysis |
| `RESOLVE_DOMAINS_THREADS` | 150 | 50 | 300 | DNS resolution |
### By Hardware
| System | Threads Multiplier | Example |
| ------------------ | ------------------ | ------------------ |
| 1 CPU / 1GB RAM | 0.5x | HTTPX\_THREADS=25 |
| 2 CPU / 4GB RAM | 1x (default) | HTTPX\_THREADS=50 |
| 4 CPU / 8GB RAM | 2x | HTTPX\_THREADS=100 |
| 8+ CPU / 16GB+ RAM | 3-4x | HTTPX\_THREADS=200 |
### Memory Considerations
High-memory tools:
* `nuclei` - Keep under 200 ratelimit on low-memory systems
* `ffuf` - Reduce threads on large wordlists
* `katana` - Can be memory-intensive on large sites
```bash
# Low memory system (2GB)
HTTPX_THREADS=30
FFUF_THREADS=20
NUCLEI_RATELIMIT=50
# High memory system (16GB+)
HTTPX_THREADS=150
FFUF_THREADS=80
NUCLEI_RATELIMIT=300
```
***
## Rate Limiting Strategies
### Adaptive Rate Limiting
```bash
# Enable automatic adjustment
./reconftw.sh -d target.com -r --adaptive-rate
# Or in config
ADAPTIVE_RATE_LIMIT=true
MIN_RATE_LIMIT=10 # Never go below this
MAX_RATE_LIMIT=500 # Never exceed this
RATE_LIMIT_BACKOFF_FACTOR=0.5 # Reduce by 50% on errors
RATE_LIMIT_INCREASE_FACTOR=1.2 # Increase by 20% on success
```
### Manual Rate Limiting
```bash
# Global rate limit
./reconftw.sh -d target.com -r -q 50 # 50 req/sec
# Per-tool limits in config
HTTPX_RATELIMIT=50
NUCLEI_RATELIMIT=50
FFUF_RATELIMIT=50
```
### When to Reduce Rates
| Symptom | Action |
| ------------------- | ------------------------------------------- |
| 429 errors | Reduce ratelimit by 50% |
| Connection timeouts | Reduce threads |
| WAF blocks | Use `--adaptive-rate`, reduce to 30 req/sec |
| Server errors (5xx) | Reduce threads AND ratelimit |
***
## Timeout Configuration
```bash
# In reconftw.cfg
# HTTP timeouts
HTTPX_TIMEOUT=10 # Seconds per request
FFUF_TIMEOUT=10
NUCLEI_TIMEOUT=15
# DNS timeouts
DNS_TIMEOUT=5
# For slow targets
HTTPX_TIMEOUT=30
NUCLEI_TIMEOUT=30
```
***
## Wordlist Optimization
### Subdomain Wordlists
| Wordlist | Size | Use When |
| --------------------------- | ------ | -------------------- |
| `subdomains.txt` (default) | \~100K | Standard scans |
| `subdomains_n0kovo_big.txt` | \~1M | DEEP mode / thorough |
| Custom small list | \~10K | Fast scans / CI/CD |
```bash
# Fast scan - small wordlist
subs_wordlist="${tools}/subdomains_small.txt"
# Thorough scan - large wordlist
subs_wordlist="${tools}/subdomains_n0kovo_big.txt"
```
### Fuzzing Wordlists
| Wordlist | Size | Time Impact |
| --------------- | -------- | ---------------- |
| Small (\~5K) | Fast | 5-10 min/target |
| Medium (\~20K) | Moderate | 20-40 min/target |
| Large (\~100K+) | Slow | 1-2 hours/target |
```bash
# Fast fuzzing
fuzz_wordlist="${tools}/fuzz_small.txt"
# Thorough fuzzing
fuzz_wordlist="${tools}/fuzz_wordlist.txt"
```
### Recommended Wordlists
```bash
# Download optimized wordlists
# SecLists
git clone https://github.com/danielmiessler/SecLists.git ~/wordlists
# Assetnote
wget https://wordlists-cdn.assetnote.io/data/manual/best-dns-wordlist.txt
```
***
## Module-Specific Tuning
### Nuclei Optimization
```bash
# Severity filtering (faster)
NUCLEI_SEVERITY="critical,high" # Skip medium/low/info
# Template exclusion
NUCLEI_EXTRA_ARGS="-etags dos,fuzz" # Skip DoS and heavy fuzz templates
# Timeout
NUCLEI_TIMEOUT=10
# For large scans
NUCLEI_RATELIMIT=200
NUCLEI_FLAGS="-silent -retries 1" # Reduce retries
```
### Subdomain Enumeration
```bash
# Fast passive only
SUBBRUTE=false # Skip brute-force
SUBPERMUTE=false # Skip permutations
SUBIAPERMUTE=false # Skip AI permutations
# Thorough
SUBBRUTE=true
SUBPERMUTE=true
SUBIAPERMUTE=true
SUBREGEXPERMUTE=true
SUB_RECURSIVE_PASSIVE=true
```
### Fuzzing
```bash
# Fast
FUZZ=false # Skip entirely, rely on nuclei
# Or minimal fuzzing
FFUF_THREADS=20
fuzz_wordlist="${tools}/fuzz_small.txt"
# Thorough
FUZZ=true
FFUF_THREADS=80
fuzz_wordlist="${tools}/fuzz_wordlist.txt"
```
***
## Axiom Scaling
### Fleet Sizing
| Target Size | Fleet Size | Est. Time |
| ----------- | ---------- | --------- |
| < 100 subs | 3-5 | 30 min |
| 100-1000 | 5-10 | 1-2 hours |
| 1000-10000 | 10-20 | 2-4 hours |
| 10000+ | 20-50 | 4-8 hours |
### Cost Optimization
```bash
# Cheapest instances
AXIOM_INSTANCE_TYPE="s-1vcpu-1gb" # $0.007/hr on DO
# Cost example:
# 10 instances × 2 hours × $0.007 = $0.14 per scan
```
### Fleet Configuration
```bash
# In reconftw.cfg
AXIOM=true
AXIOM_FLEET_NAME="reconftw"
AXIOM_FLEET_COUNT=10
AXIOM_FLEET_LAUNCH=true
AXIOM_FLEET_SHUTDOWN=true # Destroy after scan
```
***
## Time Estimates
### By Mode
| Mode | Small (<100) | Medium (100-1K) | Large (1K-10K) |
| -------------- | ------------ | --------------- | -------------- |
| `-p` (passive) | 5-10 min | 10-20 min | 20-40 min |
| `-s` (subs) | 15-30 min | 30-60 min | 1-2 hours |
| `-r` (recon) | 30-60 min | 1-3 hours | 3-6 hours |
| `-a` (all) | 1-2 hours | 2-5 hours | 5-12 hours |
### Speed vs Thoroughness
```
Fast ←————————————————————————→ Thorough
-p -s -r -a
Passive Subs only Full recon All + vulns
~15 min ~30 min ~2 hours ~4 hours
```
***
## Parallelization
reconFTW includes built-in parallelization to speed up reconnaissance by running independent operations concurrently.
### Enabling Parallelization
```bash
# Run subdomains with parallelization
./reconftw.sh -d target.com -s --parallel
# Or use the parallel functions directly
parallel_subdomains_full
```
### Parallelization Phases
Subdomain enumeration is organized into phases with dependencies:
```
Phase 1: Passive (parallel)
├── sub_passive
└── sub_crt
Phase 2: Active DNS (parallel)
├── sub_active
├── sub_noerror
└── sub_dns
Phase 3: Post-Active (parallel) - requires resolved subs from Phase 2
├── sub_tls
└── sub_analytics
Phase 4: Brute Force (limited parallel) - resource intensive
├── sub_brute
├── sub_permut
├── sub_regex_permut
└── sub_ia_permut
Phase 5: Recursive (sequential) - depends on all previous
├── sub_recursive_passive
├── sub_recursive_brute
└── sub_scraping
```
### Configuration Variables
```bash
# Maximum parallel jobs (default: 4)
PARALLEL_MAX_JOBS=4
# Parallel batch size for large operations
PARALLEL_BATCH_SIZE=10
# Enable/disable parallelization globally
PARALLEL_ENABLED=true
```
### Performance Impact
| Target Size | Without Parallel | With Parallel | Speedup |
| --------------- | ---------------- | ------------- | ------- |
| Small (<100) | 15 min | 8 min | \~2x |
| Medium (100-1K) | 45 min | 20 min | \~2.2x |
| Large (1K-10K) | 3 hours | 1.5 hours | \~2x |
### Parallel Functions Reference
| Function | Purpose | Max Jobs |
| ---------------------------- | ---------------------------------- | -------- |
| `parallel_passive_enum()` | Run passive sources in parallel | 4 |
| `parallel_active_enum()` | Run active DNS checks in parallel | 3 |
| `parallel_postactive_enum()` | TLS and analytics after resolution | 2 |
| `parallel_brute_enum()` | Brute force (resource limited) | 2 |
| `parallel_web_vulns()` | Web vulnerability checks | 4 |
| `parallel_injection_vulns()` | Injection testing | 4 |
| `parallel_osint()` | OSINT gathering | 4 |
### When NOT to Use Parallelization
* **Low-memory systems** (< 4GB RAM): Use sequential mode
* **Rate-limited targets**: Parallel can trigger blocks faster
* **Axiom mode**: Already distributed, parallelization adds complexity
* **Debugging**: Sequential is easier to troubleshoot
***
## Common Tuning Scenarios
### "I need results in 30 minutes"
```bash
# Passive only
./reconftw.sh -d target.com -p
```
### "Overnight scan, make it thorough"
```bash
# Config: Enable everything, DEEP mode
DEEP=true
DEEP_LIMIT=2000
./reconftw.sh -d target.com -a
```
### "Bug bounty, new program rush"
```bash
# Fast but complete
DEEP_LIMIT=300
FUZZ=false
./reconftw.sh -d target.com -r --adaptive-rate
```
### "Red team, need to stay quiet"
```bash
# Low and slow
HTTPX_RATELIMIT=10
NUCLEI_RATELIMIT=10
HTTPX_THREADS=10
./reconftw.sh -d target.com -p # Start passive
```
***
## Monitoring Performance
### Check Progress
```bash
# Watch log
tail -f Recon/target.com/.log/reconftw.log
# Check completed functions
ls Recon/target.com/.called_fn/
# Count results
wc -l Recon/target.com/subdomains/subdomains.txt
```
### Resource Monitoring
```bash
# CPU/Memory
htop
# Disk
df -h
# Network
iftop # or nload
```
***
## TL;DR Quick Config
```bash
# SMALL target - be thorough
DEEP=true && HTTPX_THREADS=50 && NUCLEI_RATELIMIT=100
# LARGE target - be efficient
DEEP_LIMIT=200 && HTTPX_THREADS=150 && FUZZ=false
# QUIET scan - low profile
HTTPX_RATELIMIT=10 && NUCLEI_RATELIMIT=10
# FAST scan - speed priority
./reconftw.sh -d target.com -p # Just passive
```
***
> **Documentation Info**\
> Branch: `dev` | Version: `v3.0.0+` | Last updated: February 2026
# Data Model & I/O
Complete reference for reconFTW's input formats and output structure.
***
## Input Formats
### Single Domain (-d)
```bash
# Standard domain
./reconftw.sh -d example.com -r
# Subdomain (scans parent automatically)
./reconftw.sh -d api.example.com -r
# With protocol (protocol is stripped)
./reconftw.sh -d https://example.com -r
```
### Domain List (-l)
```bash
./reconftw.sh -l targets.txt -r
```
**targets.txt format:**
```
example.com
target.org
subdomain.another.com
```
* One domain per line
* No protocols, paths, or ports
* Blank lines ignored
* Comments NOT supported
### CIDR/IP Range (-m)
```bash
./reconftw.sh -m 192.168.1.0/24 -r
```
Supported formats:
* CIDR: `192.168.1.0/24`
* Range: `192.168.1.1-255`
* Single IP: `192.168.1.1`
### Scope Files
**In-scope (-i):**
```
*.example.com
api.example.com
192.168.1.0/24
```
**Out-of-scope (-x):**
```
admin.example.com
*.internal.example.com
10.0.0.0/8
```
Wildcards supported: `*.example.com` matches `anything.example.com`
***
## Output Directory Structure
All results stored in `Recon//`:
```
Recon/example.com/
├── .called_fn/ # Checkpoint markers (hidden)
├── .log/ # Execution logs (hidden)
│ └── reconftw.log
├── .tmp/ # Temporary files (hidden)
│
├── subdomains/ # Subdomain enumeration results
│ ├── subdomains.txt # [KEY] Final merged subdomains
│ ├── subdomains_crt.txt # CT log subdomains
│ ├── subdomains_passive.txt
│ ├── subdomains_brute.txt
│ ├── subdomains_permut.txt
│ ├── subdomains_dnsrecords.txt # DNS record details
│ └── takeover.txt # Subdomain takeover findings
│
├── webs/ # Web probing results
│ ├── webs.txt # [KEY] Live HTTP/HTTPS servers
│ ├── webs_all.txt # All probed URLs with metadata
│ ├── webs_info.txt # Detailed web info (title, status, tech)
│ └── url_extract.txt # Extracted URLs from crawling
│
├── hosts/ # Host/IP information
│ ├── ips.txt # [KEY] Resolved IP addresses
│ ├── cdn.txt # CDN IPs (filtered)
│ ├── portscan_active.txt # Open ports
│ └── portscan_active.xml # Nmap XML output
│
├── osint/ # OSINT results
│ ├── dorks.txt # Google dork results
│ ├── github_company_secrets.json # GitHub leaks
│ ├── github_dorks.txt
│ ├── emails.txt # [KEY] Discovered emails
│ ├── passwords.txt # Leaked credentials
│ └── metadata_results.txt # Document metadata
│
├── vulns/ # Vulnerability findings
│ ├── nuclei_output.txt # Nuclei text output
│ ├── nuclei_output.json # [KEY] Nuclei JSON (parseable)
│ ├── xss.txt # XSS vulnerabilities
│ ├── sqli.txt # SQL injection
│ ├── cors.txt # CORS misconfigs
│ ├── ssrf.txt # SSRF findings
│ └── ... # Other vuln types
│
├── js/ # JavaScript analysis
│ ├── js_livelinks.txt # Found JS files
│ ├── js_secrets.txt # [KEY] Secrets in JS
│ └── js_endpoints.txt # API endpoints
│
├── screenshots/ # Web screenshots
│ └── *.png
│
├── fuzzing/ # Directory fuzzing
│ └── fuzzing_full.txt # Discovered paths
│
└── hotlist.txt # [KEY] Priority findings (risk-scored)
```
***
## Key Output Files
### subdomains/subdomains.txt
The master list of all discovered subdomains.
```
api.example.com
www.example.com
staging.example.com
dev.example.com
```
**How it's built:**
1. Passive sources (subfinder, APIs)
2. Certificate transparency (crt.sh)
3. Brute-force (if enabled)
4. Permutations (if enabled)
5. All sources merged and deduplicated
### webs/webs.txt
Live web servers (responding HTTP/HTTPS).
```
https://www.example.com
https://api.example.com
http://staging.example.com:8080
```
**Filtering applied:**
* DNS resolves ✓
* TCP connection succeeds ✓
* HTTP response received ✓
### webs/webs\_all.txt
Detailed web server information.
```
https://www.example.com [200] [Example Corp] [nginx/1.18] [text/html]
https://api.example.com [401] [API Gateway] [kong/2.5] [application/json]
```
Format: `URL [status] [title] [server] [content-type]`
### hosts/ips.txt
All resolved IP addresses (CDN filtered).
```
93.184.216.34
93.184.216.35
```
### vulns/nuclei\_output.json
Machine-readable vulnerability data.
```json
{
"template-id": "cve-2021-44228",
"name": "Log4j RCE",
"severity": "critical",
"host": "https://api.example.com",
"matched-at": "https://api.example.com/search",
"extracted-results": ["${jndi:ldap://...}"],
"timestamp": "2024-01-15T10:30:00Z"
}
```
**Useful jq queries:**
```bash
# Get critical vulns
cat nuclei_output.json | jq -r 'select(.severity=="critical")'
# List unique templates triggered
cat nuclei_output.json | jq -r '."template-id"' | sort -u
# Count by severity
cat nuclei_output.json | jq -r '.severity' | sort | uniq -c
```
### hotlist.txt
Risk-scored priority findings.
```
[CRITICAL] https://api.example.com/admin - nuclei:cve-2021-44228
[HIGH] staging.example.com - subdomain takeover
[MEDIUM] https://www.example.com - cors misconfiguration
```
***
## Module Input/Output Matrix
| Module | Primary Input | Key Outputs |
| ------------------ | ------------- | ------------------------------------------------------------ |
| **OSINT** | Domain | `osint/emails.txt`, `osint/github_*.json`, `osint/dorks.txt` |
| **Subdomains** | Domain | `subdomains/subdomains.txt`, `subdomains/takeover.txt` |
| **Web Probing** | Subdomains | `webs/webs.txt`, `webs/webs_all.txt` |
| **URL Collection** | Live webs | `webs/url_extract.txt`, `js/js_endpoints.txt` |
| **Fuzzing** | Live webs | `fuzzing/fuzzing_full.txt` |
| **Ports** | IPs | `hosts/portscan_active.txt`, `hosts/portscan_active.xml` |
| **Vulns** | URLs | `vulns/nuclei_output.json`, `vulns/*.txt` |
***
## Data Flow
```
┌─────────────┐
│ INPUT │
│ -d / -l │
└──────┬──────┘
│
▼
┌─────────────────────────────────────────────────┐
│ OSINT MODULE │
│ Domain → emails, dorks, GitHub leaks │
└──────┬──────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────┐
│ SUBDOMAIN MODULE │
│ Domain → subdomains.txt (merged, deduped) │
└──────┬──────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────┐
│ WEB MODULE │
│ Subdomains → webs.txt (live servers) │
│ Live webs → URLs, JS files, screenshots │
└──────┬──────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────┐
│ HOST MODULE │
│ IPs → port scans, CDN detection │
└──────┬──────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────┐
│ VULN MODULE │
│ URLs → nuclei, XSS, SQLi, etc. │
└──────┬──────────────────────────────────────────┘
│
▼
┌─────────────┐
│ OUTPUT │
│ Recon/domain│
└─────────────┘
```
***
## File Formats
### Text Lists (.txt)
One item per line, no headers:
```
item1
item2
item3
```
### JSON Output (.json)
NDJSON format (one JSON object per line):
```json
{"host":"example.com","finding":"vuln1"}
{"host":"example.org","finding":"vuln2"}
```
### XML Output (.xml)
Standard Nmap XML for port scans:
```xml
```
### CSV Output
Some tools output CSV (httpx with custom flags):
```csv
url,status_code,title,tech
https://example.com,200,Example,nginx
```
***
## Checkpoint System
The `.called_fn/` directory tracks completed functions.
### How It Works
```bash
# After sub_passive() completes:
ls Recon/example.com/.called_fn/
# sub_passive
# After more functions:
# sub_passive sub_brute webprobe_simple
```
### Resuming Scans
If interrupted, reconFTW skips completed functions:
```bash
# Scan interrupted at 50%
./reconftw.sh -d example.com -r
# Resumes from where it stopped
```
### Force Re-run
```bash
# Delete specific checkpoint
rm Recon/example.com/.called_fn/nuclei_check
# Delete all checkpoints (full re-scan)
rm -rf Recon/example.com/.called_fn/
```
***
## Log Files
### Main Log
`Recon//.log/reconftw.log`
```
[2024-01-15 10:30:00] [INFO] Starting reconnaissance for example.com
[2024-01-15 10:30:05] [INFO] Running sub_passive
[2024-01-15 10:35:00] [INFO] sub_passive found 150 subdomains
[2024-01-15 10:35:01] [INFO] Running sub_brute
[2024-01-15 10:45:00] [ERROR] nuclei timeout on https://slow.example.com
```
### Debug Mode
```bash
DEBUG=true ./reconftw.sh -d example.com -r
```
Outputs verbose tool commands and intermediate results.
***
## Aggregated Outputs
### assets.jsonl
Machine-readable asset inventory:
```json
{"type":"subdomain","value":"api.example.com","source":"subfinder"}
{"type":"url","value":"https://api.example.com/v1","source":"katana"}
{"type":"vulnerability","value":"cve-2021-44228","host":"api.example.com"}
```
### HTML Report (with AI)
When using `-y/--ai`:
```
Recon/example.com/
└── report.html # AI-generated summary report
```
***
## Integration Exports
### Faraday
Automatic import when configured:
* Nuclei JSON → Faraday vulnerabilities
* Host info → Faraday hosts
* Services → Faraday services
### Custom Export
```bash
# Export to CSV
cat vulns/nuclei_output.json | jq -r '[.host, .severity, ."template-id"] | @csv'
# Export subdomains for other tools
cat subdomains/subdomains.txt | httpx -silent > live.txt
```
***
## Common Data Operations
### Find All Critical Vulns
```bash
cat Recon/*/vulns/nuclei_output.json | jq -r 'select(.severity=="critical")'
```
### Merge Results from Multiple Scans
```bash
# Merge subdomains
cat Recon/*/subdomains/subdomains.txt | sort -u > all_subs.txt
# Merge vulnerabilities
cat Recon/*/vulns/nuclei_output.json > all_vulns.json
```
### Generate Statistics
```bash
# Count subdomains per domain
for d in Recon/*/; do
echo "$(basename $d): $(wc -l < $d/subdomains/subdomains.txt)"
done
# Vulnerability summary
cat Recon/*/vulns/nuclei_output.json | jq -r '.severity' | sort | uniq -c
```
***
## Storage Requirements
Approximate disk usage per scan:
| Target Size | Storage |
| -------------------- | ------------- |
| Small (<100 subs) | 50-200 MB |
| Medium (100-1K subs) | 200-500 MB |
| Large (1K-10K subs) | 500 MB - 2 GB |
| Massive (10K+ subs) | 2-10 GB |
**Space-heavy components:**
* Screenshots (\~500KB each)
* Fuzzing results (large wordlists)
* Full port scan XML
**Cleanup command:**
```bash
# Remove temporary files
rm -rf Recon/example.com/.tmp/
```
***
> **Documentation Info**\
> Branch: `dev` | Version: `v3.0.0+` | Last updated: February 2026
# OPSEC & Legal
Operational security and legal considerations for using reconFTW responsibly.
***
## ⚠️ The Golden Rule
> **NEVER scan a target without explicit written authorization.**
This isn't just advice—it's the law in most jurisdictions. Unauthorized scanning can result in:
* Criminal charges
* Civil lawsuits
* Career damage
* Account bans from bug bounty platforms
***
## Authorization Checklist
Before ANY scan, verify you have:
```markdown
## Pre-Scan Authorization Checklist
### Legal Authorization
- [ ] Written permission from asset owner (email, contract, or bug bounty policy)
- [ ] Scope document clearly defines in-scope assets
- [ ] Out-of-scope assets are documented and excluded
- [ ] Testing window defined (if applicable)
- [ ] Rate limits agreed upon (if any)
### Technical Preparation
- [ ] Scope file created (`-i inscope.txt`)
- [ ] Exclusions configured (`-x outofscope.txt`)
- [ ] Rate limits set appropriately
- [ ] VPS/cloud instance ready (recommended)
### Communication
- [ ] Emergency contact identified
- [ ] Reporting channel established
- [ ] NDA signed (if required)
```
***
## Scan Intrusiveness Matrix
Understanding how "noisy" each mode is:
### By Mode
| Mode | Intrusiveness | Detection Risk | Direct Contact |
| ----------------- | ------------- | -------------- | ---------------- |
| `-p` (passive) | 🟢 None | None | No |
| `-n` (OSINT) | 🟢 Minimal | Very Low | Minimal |
| `-s` (subdomains) | 🟡 Low | Low | DNS only |
| `-r` (recon) | 🟡 Medium | Medium | Yes |
| `-a` (all) | 🔴 High | High | Yes + Vuln tests |
### By Function
| Function | Intrusiveness | Notes |
| ----------------- | ------------- | ---------------------------- |
| `sub_passive` | 🟢 None | Third-party APIs only |
| `sub_crt` | 🟢 None | Certificate Transparency |
| `sub_brute` | 🟡 Low | DNS queries |
| `webprobe_simple` | 🟡 Medium | HTTP requests |
| `screenshot` | 🟡 Medium | HTTP requests |
| `fuzz` | 🟠 High | Many HTTP requests |
| `nuclei_check` | 🔴 Very High | Active vulnerability testing |
| `sqli` | 🔴 Very High | SQL injection attempts |
| `xss` | 🔴 Very High | XSS payload injection |
### Noise Levels Explained
* 🟢 **None/Minimal**: No direct target contact, uses public data
* 🟡 **Low/Medium**: Standard HTTP/DNS traffic, looks like normal browsing
* 🟠 **High**: Elevated traffic, may trigger WAF/IDS alerts
* 🔴 **Very High**: Attack-like traffic, will likely trigger security alerts
***
## Reducing Detection Risk
### Start Passive
```bash
# Always start with passive reconnaissance
./reconftw.sh -d target.com -p
# Review results before going active
cat Recon/target.com/subdomains/subdomains.txt
```
### Use Rate Limiting
```bash
# In reconftw.cfg
HTTPX_RATELIMIT=50 # Requests per second
NUCLEI_RATELIMIT=50
FFUF_RATELIMIT=50
# Or use adaptive rate limiting
./reconftw.sh -d target.com -r --adaptive-rate
```
### Use Scope Files
```bash
# inscope.txt - Only scan these
*.example.com
api.example.org
# outofscope.txt - Never scan these
admin.example.com
legacy.example.com
*.internal.example.com
```
```bash
./reconftw.sh -d example.com -r -i inscope.txt -x outofscope.txt
```
### Use a VPS
Scanning from your personal IP:
* Links activity directly to you
* May get your home IP blocked
* Exposes your location
Instead:
```bash
# Use a cloud VPS (DigitalOcean, Linode, etc.)
# Or use Axiom for distributed scanning
./reconftw.sh -d target.com -r -v
```
***
## Legal Framework by Region
### United States
| Law | What It Covers |
| --------------------------------------- | --------------------------------------- |
| **CFAA** (Computer Fraud and Abuse Act) | Unauthorized access to computer systems |
| **ECPA** | Wiretapping and electronic surveillance |
| State laws | Vary by state |
**Key Points:**
* "Exceeding authorized access" is a federal crime
* Bug bounty policies = authorization
* Always document permission
### European Union
| Framework | What It Covers |
| ----------------- | ---------------------- |
| **GDPR** | Personal data handling |
| **NIS Directive** | Network security |
| National laws | Vary by country |
**Key Points:**
* Stricter consent requirements
* Data handling must comply with GDPR
* Some countries require explicit contracts
### United Kingdom
| Law | What It Covers |
| ---------------------------- | ------------------- |
| **Computer Misuse Act 1990** | Unauthorized access |
| **GDPR UK** | Data protection |
**Key Points:**
* Even attempting unauthorized access is illegal
* "With intent to commit further offences" increases penalties
### General International
* Always research local laws before testing
* Consider both your location AND target's location
* When in doubt, get explicit written permission
***
## Bug Bounty Specific Guidelines
### Before Testing
1. **Read the policy completely**
* Safe harbor language
* Scope (domains, IPs, applications)
* Out-of-scope items
* Prohibited actions
2. **Note exclusions** (common ones):
* DoS/DDoS testing
* Social engineering
* Physical attacks
* Third-party services
* Rate limit abuse
3. **Check asset types**:
* Some exclude certain subdomains
* API vs web app rules may differ
* Mobile apps often have different rules
### During Testing
```bash
# Respect rate limits
./reconftw.sh -d target.com -r -q 30 # 30 req/sec max
# Stay in scope
./reconftw.sh -d target.com -r -x outofscope.txt
# Use passive first
./reconftw.sh -d target.com -p # Then review before -r
```
### What NOT to Do
| ❌ Don't | Why |
| --------------------------------- | ----------------------------------- |
| Test without reading policy | Different programs, different rules |
| Ignore scope | Instant ban risk |
| Chain to access other data | May cross legal lines |
| Store sensitive data | GDPR/privacy issues |
| Share findings publicly | Violates responsible disclosure |
| Test production during peak hours | May cause outages |
***
## Data Handling
### What reconFTW Collects
| Data Type | Location | Sensitivity |
| ---------------- | --------------------- | ----------- |
| Subdomains | `subdomains/` | Low |
| URLs | `webs/` | Low-Medium |
| Emails | `osint/emails.txt` | Medium |
| Leaked passwords | `osint/passwords.txt` | **High** |
| Vulnerabilities | `vulns/` | **High** |
| Screenshots | `screenshots/` | Medium |
### Security Practices
```bash
# 1. Protect secrets.cfg
chmod 600 secrets.cfg
# 2. Don't commit sensitive files
# .gitignore already includes:
# - secrets.cfg
# - Recon/
# 3. Encrypt sensitive results
tar czf results.tar.gz Recon/target.com/
gpg -c results.tar.gz
# 4. Secure deletion when done
srm -r Recon/target.com/ # Or use shred
```
### Reporting Guidelines
When you find vulnerabilities:
1. **Don't access more than necessary** to prove the bug
2. **Don't exfiltrate data** beyond proof
3. **Document everything** (timestamps, commands, evidence)
4. **Report promptly** through official channels
5. **Wait for authorization** before public disclosure
***
## Incident Response
### If You Find Critical Data
```
1. STOP further testing immediately
2. Document what you accessed (screenshot, timestamp)
3. Report through fastest channel available
4. Do NOT share with anyone else
5. Securely delete any copies
```
### If Something Breaks
```
1. STOP scanning immediately
2. Document what happened (command run, time, error)
3. Contact emergency point immediately
4. Preserve evidence of authorization
5. Do NOT try to "fix" anything on target
```
### If You Receive a Cease & Desist
```
1. STOP all testing immediately
2. Preserve all documentation of authorization
3. Do NOT delete anything
4. Contact legal counsel
5. Respond professionally
```
***
## VPS and Infrastructure OPSEC
### Recommended Setup
```bash
# Use cloud VPS, not home IP
# Provider: DigitalOcean, Linode, Vultr, Hetzner
# Change hostname to something neutral
hostnamectl set-hostname scanner-01
# Use separate VPS per engagement (if possible)
```
### What NOT to Do
| ❌ Don't | ✅ Do Instead |
| ------------------------------ | ----------------------------------- |
| Scan from home IP | Use cloud VPS |
| Reuse VPS across clients | Fresh instance per engagement |
| Store results on VPS long-term | Download and destroy |
| Use personal accounts | Create engagement-specific accounts |
***
## Quick Reference: Safe Scanning Checklist
```markdown
## Before Scan
- [ ] Authorization documented
- [ ] Scope file ready
- [ ] VPS configured
- [ ] Rate limits set
- [ ] Start with passive mode
## During Scan
- [ ] Monitor for errors
- [ ] Stay in scope
- [ ] Respect rate limits
- [ ] Watch for critical findings
## After Scan
- [ ] Review all findings
- [ ] Report vulnerabilities
- [ ] Secure/delete sensitive data
- [ ] Document for records
```
***
## Additional Resources
* [**EFF Know Your Rights**](https://www.eff.org/issues/cfaa) - CFAA information
* [**HackerOne Policy Guidelines**](https://www.hackerone.com/disclosure-guidelines) - Disclosure best practices
* [**Bugcrowd VRT**](https://bugcrowd.com/vulnerability-rating-taxonomy) - Vulnerability classification
* [**OWASP Testing Guide**](https://owasp.org/www-project-web-security-testing-guide/) - Ethical testing methodology
***
## TL;DR
1. **Get written permission** before any scan
2. **Start passive** (`-p`), then go active
3. **Use rate limiting** and scope files
4. **Scan from VPS**, not personal IP
5. **Report responsibly**, don't overstep
6. **When in doubt, ask** - it's better to ask than apologize
***
> **Documentation Info**\
> Branch: `dev` | Version: `v3.0.0+` | Last updated: February 2026
# Case Studies
Real-world examples of reconFTW in action.
***
## Case Study 1: Bug Bounty - New Program Launch
**Scenario:** A new bug bounty program launched with `*.target.com` in scope. Goal is to find vulnerabilities quickly before other hunters.
### Target Profile
* **Scope:** `*.target.com` (wildcard)
* **Size:** Unknown (new program)
* **Time:** 4 hours before others catch up
* **Goal:** Quick wins - subdomain takeovers, exposed panels, known CVEs
### Configuration
```bash
# Custom config: bounty-rush.cfg
# Fast subdomain enumeration
SUBBRUTE=false # Skip brute-force (time-consuming)
SUBPERMUTE=false # Skip permutations
SUBIAPERMUTE=false
# Essential web checks only
WEBPROBESIMPLE=true
WEBPROBEFULL=false # Skip detailed probing
# Priority vulnerability checks
NUCLEICHECK=true
NUCLEI_SEVERITY="critical,high" # Only high-impact
SUBTAKEOVER=true # Quick wins
# Skip slow modules
FUZZ=false
XSS=false
SQLI=false
SSRF_CHECKS=false
```
### Execution
```bash
# Phase 1: Quick passive recon (15 minutes)
./reconftw.sh -d target.com -p
# Review subdomains found
wc -l Recon/target.com/subdomains/subdomains.txt
# 847 subdomains
# Phase 2: Fast vulnerability scan (2 hours)
./reconftw.sh -d target.com -r -f bounty-rush.cfg --adaptive-rate
# Phase 3: Check results immediately
cat Recon/target.com/subdomains/takeover.txt
cat Recon/target.com/vulns/nuclei_output.json | jq -r 'select(.severity=="critical")'
```
### Results
| Finding | Severity | File Location |
| -------------------------------------- | -------- | -------------------------- |
| Subdomain takeover on `old.target.com` | High | `subdomains/takeover.txt` |
| Exposed Jenkins on `ci.target.com` | Critical | `vulns/nuclei_output.json` |
| S3 bucket listing | Medium | `osint/cloud_enum.txt` |
| 3 exposed admin panels | High | `vulns/nuclei_output.json` |
**Time to first finding:** 23 minutes (subdomain takeover)
### Key Takeaways
1. **Passive first** - Always run `-p` before full recon
2. **Skip slow modules** - Brute-force can wait
3. **Focus on quick wins** - Takeovers, panels, known CVEs
4. **Review as you go** - Don't wait for full scan to complete
***
## Case Study 2: Security Assessment - Enterprise Client
**Scenario:** Contracted for a security assessment of a Fortune 500 company. Need full coverage with minimal disruption.
### Target Profile
* **Scope:** `corp.example.com` + IP range `10.0.0.0/8` (internal)
* **Size:** Large enterprise (\~5,000 subdomains expected)
* **Time:** 1 week engagement
* **Goal:** Complete asset inventory, all vulnerabilities documented
### Pre-Engagement Setup
```bash
# Create scope files
echo "*.corp.example.com" > scope-in.txt
echo "*.internal.example.com" >> scope-in.txt
echo "vpn.corp.example.com" > scope-out.txt
echo "mail.corp.example.com" >> scope-out.txt
```
### Configuration
```bash
# Custom config: enterprise-assessment.cfg
# Thorough enumeration
SUBBRUTE=true
subs_wordlist="${tools}/subdomains_n0kovo_big.txt"
SUBPERMUTE=true
SUBIAPERMUTE=true
# All web checks
WEBPROBESIMPLE=true
WEBPROBEFULL=true
SCREENSHOT=true
# Full vulnerability assessment
NUCLEICHECK=true
NUCLEI_SEVERITY="critical,high,medium"
FUZZ=true
XSS=true
SQLI=true
SSRF_CHECKS=true
CORS=true
# Rate limiting (be respectful)
HTTPX_RATELIMIT=50
NUCLEI_RATELIMIT=100
ADAPTIVE_RATE_LIMIT=true
# Save everything
PORTSCANNER=true
PORTSCAN_ACTIVE=true
```
### Execution Plan
**Day 1-2: Reconnaissance**
```bash
# External reconnaissance
./reconftw.sh -d corp.example.com -r \
-i scope-in.txt -x scope-out.txt \
-f enterprise-assessment.cfg
# OSINT deep dive
./reconftw.sh -d corp.example.com -n # OSINT only
```
**Day 3-4: Vulnerability Assessment**
```bash
# Full vulnerability scan
./reconftw.sh -d corp.example.com -a \
-i scope-in.txt -x scope-out.txt \
-f enterprise-assessment.cfg
# Review and prioritize
cat Recon/corp.example.com/vulns/nuclei_output.json | \
jq -r 'select(.severity=="critical")' > critical_findings.json
```
**Day 5: Deep Dive on Findings**
```bash
# Re-scan specific high-value targets
./reconftw.sh -d api.corp.example.com -a --deep
# Manual verification of critical findings
```
### Results Summary
| Category | Count | Files |
| ---------------- | ----- | ----------------------------------- |
| Subdomains | 4,892 | `subdomains/subdomains.txt` |
| Live web servers | 1,247 | `webs/webs.txt` |
| Open ports | 8,432 | `hosts/portscan_active.txt` |
| Critical vulns | 12 | `vulns/nuclei_output.json` |
| High vulns | 47 | `vulns/nuclei_output.json` |
| Medium vulns | 183 | `vulns/nuclei_output.json` |
| Email addresses | 234 | `osint/emails.txt` |
| GitHub secrets | 8 | `osint/github_company_secrets.json` |
**Notable Findings:**
* Exposed Kubernetes dashboard (critical)
* Default credentials on 3 admin panels
* SQL injection in legacy application
* 2 subdomain takeover possibilities
* 8 hardcoded API keys in public GitHub repos
### Deliverable Generation
```bash
# Export all critical/high findings
cat Recon/corp.example.com/vulns/nuclei_output.json | \
jq -r 'select(.severity=="critical" or .severity=="high") |
[.host, .severity, ."template-id", .name] | @csv' > findings.csv
# Generate AI report
./reconftw.sh -d corp.example.com -y --ai-report full
```
### Key Takeaways
1. **Scope files are essential** - Prevent accidental out-of-scope testing
2. **Rate limiting** - Enterprise WAFs will block aggressive scans
3. **OSINT is gold** - GitHub secrets often provide initial access vectors
4. **Document everything** - Use `--deep` on interesting assets
***
## Case Study 3: Red Team - Distributed Scanning with Axiom
**Scenario:** Red team engagement against a large organization. Need to enumerate quickly across multiple regions without attribution.
### Target Profile
* **Scope:** `bigcorp.com` and all subsidiaries
* **Size:** Very large (10,000+ subdomains estimated)
* **Time:** 48 hours for initial recon
* **Goal:** Complete external footprint, identify entry points
### Infrastructure Setup
```bash
# Launch Axiom fleet (20 instances across regions)
axiom-fleet reconftw -i 20 --regions nyc1,lon1,sgp1,ams3
# Verify fleet
axiom-ls
```
### Configuration
```bash
# Custom config: redteam-distributed.cfg
# Aggressive enumeration (fleet handles load)
SUBBRUTE=true
SUBPERMUTE=true
SUBRECURSIVE=true
SUB_RECURSIVE_BRUTE=true
# Full web checks
WEBPROBESIMPLE=true
WEBPROBEFULL=true
# All vulnerability checks
NUCLEICHECK=true
NUCLEI_SEVERITY="critical,high,medium,low"
FUZZ=true
XSS=true
SQLI=true
# Axiom configuration
AXIOM=true
AXIOM_FLEET_NAME="reconftw"
AXIOM_FLEET_COUNT=20
AXIOM_FLEET_SHUTDOWN=false # Keep for multiple scans
```
### Execution
```bash
# Create target list
cat << EOF > targets.txt
bigcorp.com
subsidiary1.com
subsidiary2.com
acquired-company.com
EOF
# Launch distributed scan
./reconftw.sh -l targets.txt -a -v -f redteam-distributed.cfg
```
### Monitoring Progress
```bash
# Watch fleet activity
axiom-exec 'ps aux | grep -E "(nuclei|httpx|subfinder)"' -f reconftw
# Check intermediate results
axiom-exec 'wc -l /tmp/subdomains.txt' -f reconftw
# Pull partial results
axiom-scp 'reconftw*:/home/op/Recon' ./partial_results/ -f reconftw
```
### Results
**Scan completed in:** 14 hours (vs estimated 72 hours single-machine)
| Target | Subdomains | Web Servers | Critical | High |
| -------------------- | ---------- | ----------- | -------- | ------ |
| bigcorp.com | 8,234 | 2,847 | 8 | 34 |
| subsidiary1.com | 1,892 | 623 | 3 | 12 |
| subsidiary2.com | 945 | 312 | 1 | 8 |
| acquired-company.com | 2,134 | 892 | 6 | 23 |
| **Total** | **13,205** | **4,674** | **18** | **77** |
**Entry Points Identified:**
1. Exposed Citrix gateway (CVE-2023-XXXX)
2. Password spraying vector (O365 enumeration)
3. VPN with default credentials
4. Subdomain takeover → potential phishing vector
5. API key leaked in JS files → internal API access
### Cost Analysis
```
Fleet: 20 × $0.03/hr × 14 hours = $8.40
Total scan cost: Under $10 for massive reconnaissance
```
### Post-Scan Cleanup
```bash
# Merge all results
axiom-scp 'reconftw*:/home/op/Recon' ./final_results/ -f reconftw
# Shutdown fleet
axiom-rm 'reconftw*' -f
```
### Key Takeaways
1. **Axiom is cost-effective** - Massive scans for dollars, not hours
2. **Regional distribution** - Avoids geo-blocking
3. **Keep fleet alive** - Reuse for multiple targets
4. **Merge results carefully** - Use provided merge scripts
***
## Case Study 4: Continuous Monitoring - CI/CD Integration
**Scenario:** Security team wants automated weekly scans of all company assets with alerts for new findings.
### Setup
**Weekly cron job:**
```bash
# /etc/cron.d/reconftw-weekly
0 2 * * 0 /opt/reconftw/scripts/weekly_scan.sh
```
**Scan script:**
```bash
#!/bin/bash
# weekly_scan.sh
TARGETS="/opt/targets/company_domains.txt"
CONFIG="/opt/reconftw/configs/weekly.cfg"
OUTPUT="/opt/recon_results/$(date +%Y-%m-%d)"
# Run scan
cd /opt/reconftw
./reconftw.sh -l "$TARGETS" -r -f "$CONFIG" -o "$OUTPUT"
# Generate diff from last week
./scripts/diff_results.sh "$OUTPUT" "$LAST_WEEK"
# Send notification
./scripts/notify.sh "$OUTPUT/diff_report.txt"
```
### Configuration
```bash
# weekly.cfg - Balanced for regular monitoring
# Standard enumeration
SUBBRUTE=false # Passive only for regular scans
SUBPERMUTE=false
# Web checks
WEBPROBESIMPLE=true
SCREENSHOT=true
# Vulnerability focus
NUCLEICHECK=true
NUCLEI_SEVERITY="critical,high"
SUBTAKEOVER=true
# Notifications
SLACK_WEBHOOK="https://hooks.slack.com/services/XXX"
NOTIFY=true
NOTIFY_CONFIG="${tools}/notify-config.yaml"
```
### Diff Script
```bash
#!/bin/bash
# diff_results.sh
NEW=$1
OLD=$2
echo "=== New Subdomains ===" > "$NEW/diff_report.txt"
comm -23 <(sort "$NEW/subdomains/subdomains.txt") \
<(sort "$OLD/subdomains/subdomains.txt") >> "$NEW/diff_report.txt"
echo -e "\n=== New Vulnerabilities ===" >> "$NEW/diff_report.txt"
diff "$OLD/vulns/nuclei_output.json" "$NEW/vulns/nuclei_output.json" \
| grep "^>" >> "$NEW/diff_report.txt"
```
### Alert Output
```
🔔 Weekly Recon Report - 2024-01-15
=== New Subdomains (12) ===
new-api.company.com
staging2.company.com
...
=== New Vulnerabilities (3) ===
[CRITICAL] api.company.com - CVE-2024-XXXX
[HIGH] staging.company.com - exposed-admin
[HIGH] new-api.company.com - default-credentials
Full report: /opt/recon_results/2024-01-15/
```
### Key Takeaways
1. **Passive for monitoring** - Brute-force only for initial scans
2. **Diff is everything** - Focus on changes, not full results
3. **Alert on severity** - Critical/High only for notifications
4. **Archive results** - Keep history for trend analysis
***
## Quick Reference: Scenario → Configuration
| Scenario | Mode | Key Flags | Config Changes |
| ------------------------- | -------------- | ----------------- | --------------------------- |
| Bug bounty rush | `-p` then `-r` | `--adaptive-rate` | Disable slow modules |
| Enterprise assessment | `-a` | `-i`, `-x`, `-f` | Rate limiting, thorough |
| Red team (distributed) | `-a -v` | `--vps` | Axiom fleet config |
| CI/CD monitoring | `-r` | `-o`, `-f` | Passive only, notifications |
| Quick triage | `-p` | None | Default passive |
| Deep dive (single target) | `-a --deep` | None | Enable everything |
***
> **Documentation Info**\
> Branch: `dev` | Version: `v3.0.0+` | Last updated: February 2026
# Troubleshooting
This guide covers common issues, their causes, and solutions when running reconFTW.
***
## Installation Issues
### Go Not Found
**Symptom:**
```
go: command not found
```
**Solution:**
```bash
# Install Go
wget https://go.dev/dl/go1.21.0.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.21.0.linux-amd64.tar.gz
# Add to PATH
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc
# Verify
go version
```
***
### Permission Denied
**Symptom:**
```
bash: ./reconftw.sh: Permission denied
```
**Solution:**
```bash
chmod +x reconftw.sh
chmod +x install.sh
```
***
### macOS Homebrew Issues
**Symptom:**
```
sed: illegal option -- r
```
**Cause:** macOS uses BSD sed, not GNU sed.
**Solution:**
```bash
# Install GNU tools
brew install coreutils gnu-sed findutils grep
# Add to PATH (add to ~/.zshrc or ~/.bashrc)
export PATH="/opt/homebrew/opt/coreutils/libexec/gnubin:$PATH"
export PATH="/opt/homebrew/opt/gnu-sed/libexec/gnubin:$PATH"
export PATH="/opt/homebrew/opt/findutils/libexec/gnubin:$PATH"
export PATH="/opt/homebrew/opt/grep/libexec/gnubin:$PATH"
```
***
### Python Dependency Conflicts
**Symptom:**
```
ERROR: pip's dependency resolver does not support...
```
**Solution:**
```bash
# Create virtual environment
python3 -m venv ~/reconftw-venv
source ~/reconftw-venv/bin/activate
# Install dependencies
pip install -r requirements.txt
```
***
### Tool Installation Failures
**Symptom:**
```
go install: module not found
```
**Solution:**
```bash
# Check Go proxy settings
go env GOPROXY
# Reset to default
go env -w GOPROXY=https://proxy.golang.org,direct
# Retry installation
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
```
***
## Runtime Errors
### No Domain Provided
**Symptom:**
```
Error: No domain provided
```
**Solution:**
```bash
# Provide domain with -d flag
./reconftw.sh -d example.com -r
# Or use target list with -l flag
./reconftw.sh -l targets.txt -r
```
***
### Tool Not Found
**Symptom:**
```
subfinder: command not found
```
**Solution:**
```bash
# Check if tool exists
which subfinder
# If missing, install manually
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
# Verify Go bin in PATH
echo $PATH | grep -q "$HOME/go/bin" || export PATH=$PATH:$HOME/go/bin
# Run tool check
./reconftw.sh --check-tools
```
***
### Memory Issues (OOM)
**Symptom:**
```
Killed
```
or
```
Out of memory
```
**Solution:**
```bash
# Reduce thread counts in reconftw.cfg
HTTPX_THREADS=20
KATANA_THREADS=10
FFUF_THREADS=10
DALFOX_THREADS=50
# Add swap space
sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
```
***
### Disk Space Issues
**Symptom:**
```
No space left on device
```
**Solution:**
```bash
# Check disk usage
df -h
# Find large files
du -sh Recon/*
# Clean old scans
rm -rf Recon/old-target/
# Clean temp files
rm -rf Recon/*/.tmp/*
```
***
### Config File Not Found
**Symptom:**
```
Config file not found
```
**Solution:**
```bash
# Check config exists
ls -la reconftw.cfg
# Create from example
cp reconftw.cfg.example reconftw.cfg
# Or specify path
./reconftw.sh -d example.com -r -f /path/to/reconftw.cfg
```
***
## Performance Issues
### Slow Scans
**Causes and Solutions:**
1. **Too many subdomains:**
```bash
# Use DEEP mode limits
DEEP_LIMIT=500
DEEP_LIMIT2=1500
```
2. **DNS resolution slow:**
```bash
# Use validated resolvers
dnsvalidator -tL resolvers.txt -threads 100 -o valid_resolvers.txt
```
3. **Rate limiting by target:**
```bash
# Reduce rate limits
HTTPX_RATELIMIT=50
NUCLEI_RATELIMIT=50
```
4. **Network latency:**
```bash
# Use VPS closer to target
# Enable connection reuse
```
***
### High CPU Usage
**Solution:**
```bash
# Reduce parallel threads
HTTPX_THREADS=20
KATANA_THREADS=10
RESOLVE_DOMAINS_THREADS=80
# Use nice to lower priority
nice -n 10 ./reconftw.sh -d example.com -r
```
***
### Rate Limiting (429 Errors)
**Symptom:**
```
Too Many Requests
429
```
**Solution:**
```bash
# Reduce rate limits
HTTPX_RATELIMIT=50
NUCLEI_RATELIMIT=50
# Enable adaptive rate limiting
./reconftw.sh -d example.com -r --adaptive-rate
# Use global rate limit
./reconftw.sh -d example.com -r -q 50
```
***
## Axiom Issues
### Fleet Won't Start
**Symptom:**
```
Error: Failed to launch fleet
```
**Solutions:**
1. **Check cloud credentials:**
```bash
axiom-configure
```
2. **Check API limits:**
```bash
# DigitalOcean
doctl account get
# Check droplet limits
doctl account ratelimit
```
3. **Check available images:**
```bash
axiom-images ls
```
4. **Rebuild image:**
```bash
axiom-build default
```
***
### SSH Connection Issues
**Symptom:**
```
ssh: connect to host ... port 22: Connection refused
```
**Solutions:**
1. **Regenerate SSH keys:**
```bash
axiom-init --regenerate
```
2. **Check security groups:**
```bash
# Ensure port 22 is open
# Check cloud provider firewall
```
3. **Wait for instance:**
```bash
# Instances may take 1-2 minutes to be ready
sleep 120
axiom-ls
```
***
### Resolver Problems on Fleet
**Symptom:**
```
DNS resolution failing on fleet
```
**Solution:**
```bash
# Upload resolvers to fleet
axiom-scp resolvers.txt "reconftw*":/home/op/lists/
# Update resolver config
axiom-exec "cat /home/op/lists/resolvers.txt | head -5"
```
***
## Output Issues
### Empty Results
**Possible Causes:**
1. **Scope too restrictive:**
```bash
# Check scope files
cat inscope.txt
cat outofscope.txt
```
2. **Target doesn't exist:**
```bash
# Verify domain
dig example.com
```
3. **All tools failed:**
```bash
# Check logs
cat Recon/example.com/.log/*.log | grep -i error
```
4. **API keys missing:**
```bash
# Verify secrets.cfg
cat secrets.cfg
```
***
### Missing Files
**Symptom:** Files expected but not present in output.
**Solutions:**
1. **Check if function ran:**
```bash
ls Recon/example.com/.called_fn/
```
2. **Check logs for errors:**
```bash
grep -i "error\|fail" Recon/example.com/.log/*.log
```
3. **Rerun specific function:**
```bash
rm Recon/example.com/.called_fn/nuclei_check
./reconftw.sh -d example.com -c nuclei_check
```
***
### Corrupted Output
**Symptom:**
```
unexpected EOF
parse error
```
**Solution:**
```bash
# Clear temp files
rm -rf Recon/example.com/.tmp/*
# Clear checkpoints
rm -rf Recon/example.com/.called_fn/*
# Rescan
./reconftw.sh -d example.com -r
```
***
## API Key Issues
### Invalid API Key
**Symptom:**
```
401 Unauthorized
API key invalid
```
**Solution:**
```bash
# Verify key in secrets.cfg
grep SHODAN secrets.cfg
# Test key directly
curl "https://api.shodan.io/api-info?key=YOUR_KEY"
```
***
### Rate Limited by API
**Symptom:**
```
Rate limit exceeded
Too many requests
```
**Solution:**
```bash
# Wait and retry
sleep 3600 # Wait 1 hour
# Use multiple API keys (if allowed)
# Reduce parallel requests
```
***
### Missing API Keys
**Symptom:**
```
Warning: SHODAN_API_KEY not set
```
**Solution:**
```bash
# Edit secrets.cfg
nano secrets.cfg
# Add keys
SHODAN_API_KEY="your_key_here"
GITHUB_TOKEN="your_token_here"
```
***
## Common Fixes
### Clear Cache
```bash
# Clear all cache
rm -rf Recon/example.com/.tmp/*
rm -rf Recon/example.com/.cache/*
```
### Update Resolvers
```bash
# Download fresh resolvers
wget https://raw.githubusercontent.com/trickest/resolvers/main/resolvers.txt
# Validate
dnsvalidator -tL resolvers.txt -threads 100 -o valid_resolvers.txt
# Update config
cp valid_resolvers.txt ~/.config/reconftw/resolvers.txt
```
### Reinstall Tools
```bash
# Reinstall all tools
./install.sh
# Or update specific tool
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
```
### Reset Checkpoints
```bash
# Reset all (full rescan)
rm -rf Recon/example.com/.called_fn/
# Reset specific function
rm Recon/example.com/.called_fn/function_name
```
### Check Logs
```bash
# Main log
cat Recon/example.com/.log/reconftw.log
# Error log
cat Recon/example.com/.log/errors.log
# Live monitoring
tail -f Recon/example.com/.log/reconftw.log
```
***
## Diagnostic Commands
### System Check
```bash
# Check all tools
./reconftw.sh --check-tools
# System health
./reconftw.sh --health-check
# Show version
git rev-parse --abbrev-ref HEAD
git describe --tags 2>/dev/null || git rev-parse --short HEAD
```
### Resource Check
```bash
# Memory
free -h
# Disk
df -h
# CPU
nproc
cat /proc/cpuinfo | grep "model name" | head -1
```
### Network Check
```bash
# DNS resolution
dig example.com
# HTTP connectivity
curl -I https://example.com
# Check resolvers
cat resolvers.txt | head -5 | xargs -I {} dig @{} example.com
```
***
## Getting Help
### Community Resources
* **GitHub Issues:**
* **Discord:** \[Link to Discord]
* **Twitter:** @six2dez
### Reporting Bugs
Include:
1. reconFTW version: `git rev-parse --abbrev-ref HEAD` and `git describe --tags 2>/dev/null || git rev-parse --short HEAD`
2. OS version: `cat /etc/os-release`
3. Error message (full)
4. Steps to reproduce
5. Relevant log sections
### Feature Requests
Use GitHub Issues with `[FEATURE]` prefix.
***
## Error Code Reference
| Code | Meaning |
| ---- | ------------------- |
| 0 | Success |
| 1 | General error |
| 2 | Invalid argument |
| 3 | Tool not found |
| 4 | Configuration error |
| 5 | Network error |
| 6 | Permission denied |
| 7 | Disk full |
| 8 | Memory exhausted |
***
## Quick Reference
| Issue | Quick Fix |
| -------------- | ------------------------------ |
| Tool not found | `./install.sh` |
| Empty results | Check API keys in secrets.cfg |
| Slow scan | Reduce THREADS in config |
| 429 errors | Reduce RATELIMIT values |
| OOM | Add swap, reduce threads |
| Resume scan | Just run same command again |
| Full rescan | Delete `.called_fn/` directory |
***
## Next Steps
* [**Getting Started**](/getting-started/getting-started) - Fresh installation
* [**Configuration**](/configuration/configuration) - Optimize settings
* [**Advanced Usage**](/advanced/advanced) - Power user features