Glossary

Technical terms and concepts used throughout the reconFTW documentation.

---

A

Active Scanning

Reconnaissance that directly interacts with the target, such as sending HTTP requests or DNS queries. Contrast with Passive Scanning.

API Key

Authentication credential for accessing third-party services like Shodan, VirusTotal, or GitHub.

ASN (Autonomous System Number)

A unique identifier for a network on the internet, useful for discovering related IP ranges.

Asset

Any discoverable resource belonging to a target: subdomains, IPs, URLs, etc.

Axiom

Infrastructure automation tool for distributing security tools across cloud instances. Commands use axiom-* naming (e.g., axiom-fleet, axiom-scan). See Axiom Integration.

---

B

Banner Grabbing

Technique to identify services by examining their response banners (e.g., SSH version, HTTP server).

Brute Force

Technique of systematically checking all possible values (e.g., subdomain wordlist enumeration).

Bug Bounty

Program where organizations pay security researchers for responsibly disclosed vulnerabilities.

---

C

CDN (Content Delivery Network)

Distributed network of servers that cache content closer to users. Examples: Cloudflare, Akamai, CloudFront.

Certificate Transparency (CT)

Public logs of SSL/TLS certificates, useful for discovering subdomains.

Checkpoint

Marker file indicating a function has completed, enabling scan resumption.

CIDR (Classless Inter-Domain Routing)

Notation for IP address ranges (e.g., 192.168.1.0/24).

CORS (Cross-Origin Resource Sharing)

Browser security mechanism that can be misconfigured, leading to data theft vulnerabilities.

Crawler

Tool that automatically follows links to discover URLs and content on websites.

CRLF Injection

Vulnerability where attacker injects carriage return and line feed characters to manipulate HTTP headers.

CRT.sh

Certificate Transparency log search engine operated by Sectigo.

CVE (Common Vulnerabilities and Exposures)

Standardized identifier for known security vulnerabilities (e.g., CVE-2021-44228).

---

D

Dalfox

Fast XSS (Cross-Site Scripting) vulnerability scanner.

DEEP Mode

reconFTW mode that runs additional intensive checks when target size is below threshold.

DNS (Domain Name System)

System that translates domain names to IP addresses.

DNS Bruteforce

Technique of testing wordlist entries as subdomains against DNS servers.

Dnsx

Fast DNS toolkit for resolution and record querying.

Dork

Search query using advanced operators to find specific information (e.g., Google dorks).

---

E

Endpoint

Specific URL path on a web server (e.g., /api/users).

Enumeration

Process of systematically discovering assets or information.

---

F

Faraday

Collaborative vulnerability management platform for organizing and reporting findings.

Favicon

Small icon associated with a website, can be used to discover real IPs behind CDNs.

ffuf

Fast web fuzzer for discovering directories, files, and parameters.

Fleet

Group of cloud instances managed by Axiom for distributed scanning. See Axiom Integration.

Fuzzing

Technique of sending random or semi-random data to find vulnerabilities or hidden content.

---

G

GAU (Get All URLs)

Tool that fetches known URLs from web archives and other sources.

gf (grep for pentesters)

Pattern-matching tool for extracting potentially vulnerable URLs.

GitBook

Documentation platform used to host docs.reconftw.com.

GitHub Dorking

Using GitHub search to find sensitive information in repositories.

Go/Golang

Programming language used by many security tools integrated with reconFTW.

Gowitness

Screenshot tool for capturing web page images.

---

H

httpx

Fast HTTP toolkit for probing web servers and extracting metadata.

Host

Individual server or IP address.

---

I

Incremental Scan

Scan mode that only processes new findings since the last scan.

In-Scope

Assets that are authorized for testing in an engagement.

Interactsh

Out-of-band interaction detection service for finding blind vulnerabilities.

---

J

JavaScript Analysis

Examining JavaScript files for endpoints, secrets, and vulnerabilities.

JSON (JavaScript Object Notation)

Data format used for structured output (e.g., Nuclei results).

JSONL (JSON Lines)

Format with one JSON object per line, useful for streaming data.

---

K

Katana

Modern web crawler for URL and endpoint discovery.

---

L

LFI (Local File Inclusion)

Vulnerability allowing attackers to read local files from the server.

Linkfinder

Tool for extracting endpoints from JavaScript files.

---

M

Massdns

High-performance DNS resolver for bulk subdomain resolution.

Metadata

Data about data; in documents, includes author, creation date, software used.

Module

Logical grouping of related functions in reconFTW (e.g., OSINT module, Subdomains module).

---

N

Nmap

Network scanner for port discovery and service detection.

NOERROR

DNS response code indicating the domain exists (used for subdomain discovery).

Notify

Tool for sending notifications to Slack, Discord, Telegram, etc.

Nuclei

Template-based vulnerability scanner by ProjectDiscovery.

Nuclei Templates

YAML files defining vulnerability checks for Nuclei.

---

O

OOB (Out-of-Band)

Testing technique where vulnerable application makes external callback to attacker's server.

Open Redirect

Vulnerability where application redirects users to arbitrary URLs.

OSINT (Open Source Intelligence)

Information gathered from publicly available sources.

Out-of-Scope

Assets explicitly excluded from testing authorization.

---

P

Parameter

Query string or form field name (e.g., ?id=1 where id is the parameter).

Passive Scanning

Reconnaissance using only publicly available data without direct target interaction.

Permutation

Variation of subdomain names (e.g., dev, dev1, development).

Port

Network endpoint for services (e.g., 80 for HTTP, 443 for HTTPS).

Port Scanning

Discovering open ports and services on hosts.

Prototype Pollution

JavaScript vulnerability where attacker modifies Object prototype.

Proxy

Intermediary server for routing traffic (e.g., Burp Suite).

Puredns

Fast DNS resolution tool with wildcard filtering.

---

R

Rate Limiting

Restricting request frequency to avoid overwhelming targets or being blocked.

Recon (Reconnaissance)

Information gathering phase of security testing.

Recursive Enumeration

Discovering subdomains of subdomains (e.g., finding x.dev.example.com).

Resolver

DNS server that translates domain names to IP addresses.

RFI (Remote File Inclusion)

Vulnerability allowing inclusion of remote files in server-side code.

---

S

Scope

Defined boundaries of what can be tested in an engagement.

Screenshot

Image capture of web page appearance.

Secrets

Sensitive data like API keys, passwords, or tokens.

Shodan

Search engine for internet-connected devices.

Smap

Shodan-based passive port scanner.

Spider

See Crawler.

SQL Injection (SQLi)

Vulnerability where attacker injects SQL commands into database queries.

SSRF (Server-Side Request Forgery)

Vulnerability where attacker makes server perform requests to internal resources.

SSTI (Server-Side Template Injection)

Vulnerability in template engines allowing code execution.

Subdomain

Prefix to a domain name (e.g., www in www.example.com).

Subdomain Takeover

Vulnerability where unclaimed subdomain can be claimed by attacker.

Subfinder

Fast passive subdomain enumeration tool.

---

T

Target

Domain, IP, or organization being assessed.

Template

Reusable definition file (e.g., Nuclei vulnerability templates).

Thread

Concurrent execution unit; more threads = faster but more resource-intensive.

TLS/SSL

Encryption protocols for secure communication.

Tlsx

TLS analysis tool for certificate inspection.

Trufflehog

Secret scanning tool for Git repositories.

---

U

URL (Uniform Resource Locator)

Web address (e.g., https://example.com/page).

User-Agent

HTTP header identifying the client software.

---

V

VPS (Virtual Private Server)

Cloud-hosted virtual machine for running tools.

Vulnerability

Security weakness that can be exploited.

---

W

WAF (Web Application Firewall)

Security system that filters malicious web traffic.

Wafw00f

WAF detection and fingerprinting tool.

Wayback Machine

Internet Archive's historical web page database.

Wildcard

DNS configuration returning response for any subdomain query.

Wordlist

File containing entries for brute-force testing.

---

X

XSS (Cross-Site Scripting)

Vulnerability allowing injection of malicious scripts into web pages.

XXE (XML External Entity)

Vulnerability in XML parsers allowing file disclosure or SSRF.

---

Z

Zen Mode

reconFTW mode with minimal terminal output.

Zone Transfer

DNS mechanism for replicating records, sometimes misconfigured to leak all subdomains.