> For the complete documentation index, see [llms.txt](https://docs.reconftw.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.reconftw.com/output/output.md).

# Output Interpretation

Understanding reconFTW's output structure and how to interpret results is crucial for effective reconnaissance.

***

## Output Directory Structure

When you run a scan against `example.com`, reconFTW creates:

```
Recon/
└── example.com/
    ├── subdomains/           # Subdomain enumeration results
    ├── webs/                 # Web probing and analysis
    ├── hosts/                # IP and port scanning
    ├── osint/                # OSINT findings
    ├── vulns/                # Vulnerability scan results
    ├── nuclei_output/        # Nuclei JSON results
    ├── fuzzing/              # Directory/file fuzzing
    ├── js/                   # JavaScript analysis
    ├── screenshots/          # Web screenshots
    ├── .tmp/                 # Temporary files
    ├── .log/                 # Execution logs
    ├── .called_fn/           # Checkpoint markers
    ├── assets.jsonl          # Automation-friendly asset list
    └── hotlist.txt           # Risk-scored findings
```

***

## Subdomain Files (`subdomains/`)

### subdomains.txt

**Content:** Final deduplicated list of discovered subdomains.

**Format:** One subdomain per line.

```
www.example.com
api.example.com
mail.example.com
dev.example.com
staging.example.com
```

**Use Cases:**

* Input for further enumeration
* Scope verification
* Asset inventory

***

### subdomains\_crt.txt

**Content:** Subdomains from Certificate Transparency logs.

**Source:** crt.sh queries

```
www.example.com
mail.example.com
*.dev.example.com
autodiscover.example.com
```

***

### subdomains\_dnsrecords.txt

**Content:** DNS records for resolved subdomains.

**Format:** Subdomain with record types.

```
www.example.com [A] 93.184.216.34
mail.example.com [CNAME] mail.example.com.mail.protection.outlook.com
api.example.com [A] 93.184.216.35
example.com [MX] 10 mail.example.com
example.com [TXT] "v=spf1 include:_spf.google.com ~all"
```

***

### subdomains\_noerror.txt

**Content:** Subdomains discovered via DNS NOERROR response.

**Technique:** DNS response code analysis.

***

### subdomains\_permut.txt

**Content:** Subdomains found via permutation techniques.

***

### subdomains\_recursive.txt

**Content:** Subdomains from recursive enumeration.

***

### subdomains\_scraping.txt

**Content:** Subdomains extracted from web scraping.

***

## Web Files (`webs/`)

### webs.txt

**Content:** Live web servers (HTTP 200/30x responses).

**Format:** Full URLs.

```
https://www.example.com
https://api.example.com
http://dev.example.com:8080
https://staging.example.com
```

**Use Cases:**

* Target list for vulnerability scanning
* Web application testing
* Screenshot generation

***

### webs\_all.txt

**Content:** All probed URLs with HTTP response data.

**Format:** URL with metadata.

```
https://www.example.com [200] [Example Site] [nginx]
https://api.example.com [200] [API v2] [Express]
http://dev.example.com:8080 [403] [Forbidden] [Apache]
```

***

### url\_extract.txt

**Content:** All discovered URLs from crawling and archives.

**Sources:** gau, waybackurls, katana, hakrawler

```
https://example.com/login
https://example.com/api/v1/users
https://example.com/admin/dashboard
https://example.com/uploads/document.pdf
https://example.com/search?q=test
```

***

### takeover.txt

**Content:** Potential subdomain takeover vulnerabilities.

**Format:** Subdomain with service info.

```
VULNERABLE: docs.example.com [GitHub Pages]
VULNERABLE: blog.example.com [Heroku]
EDGE CASE: old.example.com [S3 bucket]
```

**Action Required:** Verify and claim vulnerable subdomains.

***

### url\_gf/

**Content:** URLs categorized by vulnerability patterns.

**Files:**

* `xss.txt` - XSS candidates
* `sqli.txt` - SQL injection candidates
* `ssrf.txt` - SSRF candidates
* `lfi.txt` - LFI candidates
* `redirect.txt` - Open redirect candidates
* `rce.txt` - RCE candidates
* `idor.txt` - IDOR candidates

**Example (xss.txt):**

```
https://example.com/search?q=FUZZ
https://example.com/user?name=FUZZ
https://example.com/callback?url=FUZZ
```

***

### url\_extensions/

**Content:** URLs grouped by file extension.

**Files:**

* `url_pdf.txt`
* `url_doc.txt`
* `url_js.txt`
* `url_json.txt`
* `url_xml.txt`
* `url_config.txt`

***

## Host Files (`hosts/`)

### ips.txt

**Content:** All resolved IP addresses (non-CDN).

```
93.184.216.34
93.184.216.35
10.0.0.100
```

***

### cdn.txt

**Content:** IP addresses identified as CDN.

```
104.16.132.229 [cloudflare]
151.101.1.195 [fastly]
13.32.123.45 [cloudfront]
```

***

### portscan\_passive.txt

**Content:** Port scan results from Shodan.

```
93.184.216.34
  22/tcp    open  ssh        OpenSSH 8.2
  80/tcp    open  http       nginx 1.18
  443/tcp   open  https      nginx 1.18
  3306/tcp  open  mysql      MySQL 8.0
```

***

### portscan\_active.txt

**Content:** Active nmap scan results.

**Format:** Standard nmap output.

```
Nmap scan report for 93.184.216.34
PORT      STATE SERVICE    VERSION
22/tcp    open  ssh        OpenSSH 8.2p1 Ubuntu
| vulners: 
|   CVE-2020-15778  6.8
80/tcp    open  http       nginx 1.18.0
443/tcp   open  ssl/https  nginx 1.18.0
| ssl-cert: Subject: CN=example.com
```

***

### portscan\_active.xml

**Content:** Nmap results in XML format.

**Use Cases:**

* Import to vulnerability scanners
* Parse with scripts
* Import to Faraday

***

### portscan\_active.gnmap

**Content:** Nmap greppable format.

```
Host: 93.184.216.34 () Ports: 22/open/tcp//ssh//OpenSSH 8.2p1/, 80/open/tcp//http//nginx 1.18.0/, 443/open/tcp//https//
```

***

### waf.txt

**Content:** WAF detection results.

```
https://www.example.com
  WAF: Cloudflare
  Detected by: Response headers

https://api.example.com
  WAF: AWS WAF
  Detected by: Response behavior
```

***

### geo.txt

**Content:** IP geolocation data.

```
93.184.216.34
  Country: United States
  Region: California
  City: Los Angeles
  Org: Edgecast Inc.
  ASN: AS15133
```

***

## OSINT Files (`osint/`)

### dorks.txt

**Content:** Google dork results.

```
[site:example.com filetype:pdf]
https://example.com/documents/report.pdf
https://example.com/downloads/manual.pdf

[site:example.com inurl:admin]
https://example.com/admin/login
https://example.com/administrator/
```

***

### emails.txt

**Content:** Discovered email addresses.

```
admin@example.com
contact@example.com
john.doe@example.com
support@example.com
```

***

### passwords.txt

**Content:** Leaked credential data.

**Format:** Email:password pairs (from breach databases).

```
user@example.com:password123
admin@example.com:admin2020
```

**⚠️ IMPORTANT:** Handle with care, sensitive data.

***

### metadata\_results.txt

**Content:** Document metadata extraction.

```
File: report.pdf
  Author: John Doe
  Creator: Microsoft Word
  Creation Date: 2023-01-15
  Software: Adobe Acrobat
  
File: presentation.pptx
  Author: Jane Smith
  Company: Example Corp
  Last Modified: 2023-03-20
```

***

### github\_company\_secrets.json

**Content:** Secrets found in GitHub repositories.

**Format:** JSON with file locations and secret types.

```json
[
  {
    "file": "config.js",
    "repo": "example/webapp",
    "secret_type": "AWS_KEY",
    "match": "AKIA..."
  },
  {
    "file": ".env.example",
    "repo": "example/api",
    "secret_type": "API_KEY",
    "match": "sk_live_..."
  }
]
```

***

### apileaks.txt

**Content:** API endpoints from Postman/Swagger leaks.

```
[Postman Collection: example-api]
POST /api/v1/users
GET /api/v1/orders
DELETE /api/v1/sessions

[Swagger: api.example.com]
/api/auth/login
/api/users/{id}
/api/admin/settings
```

***

### domain\_info.txt

**Content:** WHOIS and domain intelligence.

```
Domain: example.com
Registrar: GoDaddy
Created: 1995-08-14
Expires: 2025-08-13
Registrant: Example Corporation
Email: domains@example.com

Nameservers:
  ns1.example.com
  ns2.example.com
```

***

### spf\_dmarc.txt

**Content:** Email security analysis.

```
Domain: example.com

SPF Record: v=spf1 include:_spf.google.com ~all
  Status: CONFIGURED
  Policy: Soft fail

DMARC Record: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
  Status: CONFIGURED
  Policy: Quarantine
  
Email Spoofing: PROTECTED (moderate)
```

***

## Vulnerability Files (`vulns/`)

### nuclei\_output/

**Content:** Nuclei scan results in JSON format.

**Files:**

* `nuclei_critical.json`
* `nuclei_high.json`
* `nuclei_medium.json`
* `nuclei_low.json`
* `nuclei_info.json`

**Sample JSON:**

```json
{
  "template-id": "cve-2021-44228-log4j-rce",
  "info": {
    "name": "Apache Log4j RCE",
    "severity": "critical",
    "tags": ["cve", "rce", "log4j"]
  },
  "matcher-name": "dns",
  "host": "https://api.example.com",
  "matched-at": "https://api.example.com/api/v1/log",
  "timestamp": "2023-06-15T10:30:45Z"
}
```

***

### xss.txt

**Content:** XSS vulnerability findings.

```
[VULNERABLE] https://example.com/search?q=<script>alert(1)</script>
  Payload: <script>alert(1)</script>
  Type: Reflected XSS
  
[VULNERABLE] https://example.com/user?name="><img src=x onerror=alert(1)>
  Payload: "><img src=x onerror=alert(1)>
  Type: Reflected XSS
```

***

### sqli.txt

**Content:** SQL injection findings.

```
[VULNERABLE] https://example.com/product?id=1
  Parameter: id
  Type: Boolean-based blind
  Payload: 1 AND 1=1
  DBMS: MySQL
  
[VULNERABLE] https://example.com/user?name=admin
  Parameter: name
  Type: Error-based
  Payload: admin'
  DBMS: PostgreSQL
```

***

### ssrf.txt

**Content:** SSRF vulnerability findings.

```
[VULNERABLE] https://example.com/fetch?url=http://169.254.169.254
  Parameter: url
  Type: Blind SSRF
  Evidence: Delayed response / OOB callback
```

***

### cors.txt

**Content:** CORS misconfiguration findings.

```
[MISCONFIGURED] https://api.example.com
  Issue: Arbitrary Origin Reflection
  ACAO: *
  ACAC: true
  Impact: Credential theft possible
```

***

### redirect.txt

**Content:** Open redirect findings.

```
[VULNERABLE] https://example.com/redirect?url=https://evil.com
  Parameter: url
  Redirects to: https://evil.com
```

***

### lfi.txt

**Content:** Local File Inclusion findings.

```
[VULNERABLE] https://example.com/view?file=../../../etc/passwd
  Parameter: file
  Payload: ../../../etc/passwd
  Evidence: root:x:0:0:root:/root:/bin/bash
```

***

### testssl.txt

**Content:** SSL/TLS analysis results.

```
Testing: https://example.com

Protocol Support:
  TLS 1.3: YES
  TLS 1.2: YES
  TLS 1.1: NO (good)
  TLS 1.0: NO (good)
  SSL 3.0: NO (good)

Vulnerabilities:
  Heartbleed: NOT vulnerable
  ROBOT: NOT vulnerable
  BEAST: NOT vulnerable
  
Certificate:
  Subject: CN=example.com
  Issuer: Let's Encrypt
  Valid Until: 2024-01-15
  Key Size: 2048 bits
```

***

## JavaScript Files (`js/`)

### js\_files.txt

**Content:** Discovered JavaScript file URLs.

```
https://example.com/static/app.js
https://example.com/assets/bundle.min.js
https://example.com/js/vendor.js
https://cdn.example.com/lib/jquery-3.6.0.min.js
```

***

### js\_secrets.txt

**Content:** Secrets found in JavaScript files.

```
[API_KEY] https://example.com/app.js
  Line 145: apiKey: "sk_live_abc123..."
  
[AWS_KEY] https://example.com/config.js
  Line 23: accessKeyId: "AKIA..."
  
[PRIVATE_KEY] https://example.com/auth.js
  Line 89: privateKey: "-----BEGIN RSA PRIVATE KEY-----"
```

***

### js\_endpoints.txt

**Content:** API endpoints extracted from JavaScript.

```
/api/v1/users
/api/v1/orders
/api/v2/products
/internal/admin/settings
/graphql
/api/auth/token
```

***

## Fuzzing Files (`fuzzing/`)

### fuzzing\_full.txt

**Content:** All fuzzing results combined.

```
[200] https://example.com/admin
[200] https://example.com/api
[301] https://example.com/docs → /documentation
[403] https://example.com/.git
[200] https://example.com/backup.zip
```

***

### fuzzing\_{subdomain}.txt

**Content:** Per-subdomain fuzzing results.

***

## Screenshots (`screenshots/`)

**Content:** Web page screenshots.

**Format:** PNG images named by URL hash.

**Files:**

* `https_www.example.com.png`
* `https_api.example.com.png`
* `http_dev.example.com_8080.png`

**Gallery View:** Use gowitness report for HTML gallery.

```bash
# Generate HTML report
gowitness report serve
```

***

## Log Files (`.log/`)

### reconftw\.log

**Content:** Main execution log.

```
[2023-06-15 10:00:00] Starting reconnaissance for example.com
[2023-06-15 10:00:01] Running sub_passive...
[2023-06-15 10:05:30] sub_passive completed: 150 subdomains
[2023-06-15 10:05:31] Running sub_crt...
```

***

### errors.log

**Content:** Error messages during execution.

```
[ERROR] subfinder: API rate limit exceeded for VirusTotal
[ERROR] httpx: Connection timeout for staging.example.com
[WARN] nuclei: Template cve-2021-1234 deprecated
```

***

## Checkpoint Files (`.called_fn/`)

**Content:** Function completion markers for checkpoint/resume.

**Files:**

```
.called_fn/
├── sub_passive
├── sub_crt
├── sub_brute
├── webprobe_simple
└── nuclei_check
```

**Purpose:** Resume interrupted scans from last checkpoint.

***

## Special Files

### assets.jsonl

**Content:** Automation-friendly asset list in JSON Lines format.

**Format:**

```json
{"subdomain":"www.example.com","ip":"93.184.216.34","url":"https://www.example.com","status":200,"title":"Example Site"}
{"subdomain":"api.example.com","ip":"93.184.216.35","url":"https://api.example.com","status":200,"title":"API v2"}
```

**Use Cases:**

* Pipeline integration
* Custom tooling
* Data analysis

***

### hotlist.txt

**Content:** Risk-scored priority targets.

**Format:** Assets with risk indicators.

```
[HIGH] https://admin.example.com - Admin panel exposed
[HIGH] https://api.example.com/graphql - GraphQL endpoint
[MEDIUM] https://staging.example.com - Staging environment
[MEDIUM] https://dev.example.com - Development server
```

***

## Interpreting Nuclei Results

### Severity Levels

| Severity     | Description                     | Action                 |
| ------------ | ------------------------------- | ---------------------- |
| **Critical** | Immediate exploitation possible | Report immediately     |
| **High**     | Significant security impact     | Prioritize remediation |
| **Medium**   | Moderate risk                   | Schedule fix           |
| **Low**      | Minor issues                    | Best practice          |
| **Info**     | Informational                   | Document               |

### Reading Nuclei JSON

```json
{
  "template-id": "cve-2021-44228-log4j-rce",
  "info": {
    "name": "Apache Log4j2 RCE (CVE-2021-44228)",
    "severity": "critical",
    "description": "Apache Log4j2 allows remote code execution...",
    "reference": ["https://nvd.nist.gov/vuln/detail/CVE-2021-44228"],
    "tags": ["cve", "cve2021", "rce", "log4j", "apache"]
  },
  "type": "http",
  "host": "https://api.example.com",
  "matched-at": "https://api.example.com/api/v1/log",
  "extracted-results": ["dns-callback-received"],
  "curl-command": "curl -X POST ...",
  "timestamp": "2023-06-15T10:30:45.123456789Z"
}
```

### Key Fields:

* `template-id`: Template identifier
* `severity`: Risk level
* `host`: Target URL
* `matched-at`: Exact vulnerable endpoint
* `extracted-results`: Evidence of vulnerability
* `curl-command`: Reproduction command

***

## Report Generation

### AI-Generated Reports

```bash
# Generate AI report
./reconftw.sh -d example.com -y

# Custom report type
./reconftw.sh -d example.com -y --report-type executive
```

**Report Types:**

* `detailed` - Technical deep-dive
* `executive` - High-level summary
* `compliance` - Compliance-focused

### Manual Report Creation

1. Collect key findings from:
   * `vulns/nuclei_output/`
   * `webs/takeover.txt`
   * `osint/github_company_secrets.json`
2. Prioritize by severity
3. Include reproduction steps from curl commands

***

## Data Export

### Export to CSV

```bash
# Convert JSON to CSV
cat nuclei_output/*.json | jq -r '[.host, .["template-id"], .info.severity] | @csv'
```

### Export to Faraday

Automatic when `FARADAY` is enabled. Results imported to workspace.

### Export to JSON

Most output files have JSON equivalents in `.tmp/` directory.

***

## Cleanup

### Temporary Files

```bash
# Clear temp files
rm -rf Recon/example.com/.tmp/*
```

### Reset Checkpoints

```bash
# Remove checkpoints to re-run functions
rm -rf Recon/example.com/.called_fn/*
```

### Full Clean

```bash
# Remove all data for target
rm -rf Recon/example.com/
```

***

## Next Steps

* [**Integrations**](/integrations/axiom.md) - Axiom and Faraday
* [**Advanced Usage**](/advanced/advanced.md) - Custom functions


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.reconftw.com/output/output.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.