Twitter - Telegram - thewhiteh4t's Blog
FinalRecon is an all in one automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. Instead of executing several tools one after another it can provide similar results keeping dependencies small and simple.
Available In
Featured On
Python For OSINT
- Hakin9 April 2020
- https://hakin9.org/product/python-for-osint-tooling/
NullByte
- https://null-byte.wonderhowto.com/how-to/conduct-recon-web-target-with-python-tools-0198114/
- https://www.youtube.com/watch?v=F9lwzMPGIgo
Hakin9
Features
FinalRecon provides detailed information such as :
- Header Information
- General vs Security header categorization
- Missing security headers flagged
- Cookie attribute breakdown (Secure, HttpOnly, SameSite)
- Whois
- Domain expiry countdown
- DNSSEC status
- SSL Certificate Information
- Crawler
- html
- CSS
- Javascripts
- Internal Links
- External Links
- Images
- robots
- sitemaps
- Links inside Javascripts
- Links from Wayback Machine from Last 1 Year
- html
- DNS Enumeration
- Over 40 types of Records queried and grouped by category
- Security records highlighted
- DMARC Records
- Subdomain Enumeration
- 15 reliable data sources
- Real-time error reporting per source
- Directory Enumeration
- Phantom URL probing to reduce false positives
- Smart real-time soft-404 filtering based on content length and redirect clustering
- Support for File Extensions
- Wayback Machine
- 50,000 URLs are fetched
- URLs are triaged into :
- JS files
- API endpoints
- juicy parameters
- sensitive extensions
- Port Scan
- Fast
- Top 1000 Ports
- Export
- Formats
- txt
- Formats
Configuration
API Keys
Some Modules Use API Keys to fetch data from different resources, these are optional, if you are not using an API key, they will be simply skipped.
Environment Variables
Keys are read from environment variables if they are set otherwise they are loaded from the config directory
FR_BEVIGIL_KEY, FR_HUNTER_KEY, FR_NETLAS_KEY,
FR_SHODAN_KEY, FR_VT_KEY, FR_ZOOMEYE_KEY,
FR_CHAOS_KEY, FR_GITHUB_KEY, FR_LEAKIX_KEY
# Example :
export FR_SHODAN_KEY="kl32lcdqwcdfv"
Saved Keys
You can use -k to add the keys which will be saved in config directory automatically
# Usage
python3 finalrecon.py -k '<API NAME>@<API KEY>'
Valid Keys : 'bevigil', 'chaos', 'github', 'hunter', 'leakix', 'netlas', 'shodan', 'virustotal', 'zoomeye'
# Example :
python3 finalrecon.py -k 'shodan@kl32lcdqwcdfv'
Path = $HOME/.config/finalrecon/keys.json
| Source | Module | Link |
|---|---|---|
| VirusTotal | Sub Domain Enum | https://www.virustotal.com/gui/my-apikey |
| Shodan | Sub Domain Enum | https://developer.shodan.io/api/requirements |
| BeVigil | Sub Domain Enum | https://bevigil.com/osint-api |
| Chaos | Sub Domain Enum | https://cloud.projectdiscovery.io |
| LeakIX | Sub Domain Enum | https://leakix.net |
| GitHub | Sub Domain Enum | https://github.com/settings/tokens |
| Netlas | Sub Domain Enum | https://docs.netlas.io/getting_started/ |
| ZoomEye | Sub Domain Enum | https://www.zoomeye.ai/ |
| Hunter | Sub Domain Enum | https://hunter.how/search-api |
JSON Config File
Default config file is available at ~/.config/finalrecon/config.json
{
"common": {
"timeout": 30,
"dns_servers": "8.8.8.8, 8.8.4.4, 1.1.1.1, 1.0.0.1"
},
"ssl_cert": {
"ssl_port": 443
},
"port_scan": {
"threads": 50
},
"dir_enum": {
"threads": 50,
"redirect": false,
"verify_ssl": false,
"extension": ""
},
"export": {
"format": "txt"
}
}
Tested on
- Kali Linux
- BlackArch Linux
FinalRecon is a tool for Pentesters and it's designed for Linux based Operating Systems, other platforms like Windows and Termux are NOT supported.
Installation
Kali Linux
sudo apt install finalrecon
BlackArch Linux
sudo pacman -S finalrecon
SecBSD
doas pkg_add finalrecon
Other Linux
git clone https://github.com/thewhiteh4t/FinalRecon.git
cd FinalRecon
pip3 install -r requirements.txt
Docker
docker pull thewhiteh4t/finalrecon
docker run -it --entrypoint /bin/sh thewhiteh4t/finalrecon
Also docker user can use this alias to run the finalrecon as the normal CLI user.
alias finalrecon="docker run -it --rm --name finalrecon --entrypoint 'python3' thewhiteh4t/finalrecon finalrecon.py"
And then use finalrecon to start your scan.
remark
If you have any api keys you can easily commit that image in your local machine.
This docker usage needs root to run docker command.
Usage
FinalRecon - All in One Web Recon | v1.1.6
options:
-h, --help show this help message and exit
--url URL Target URL
--headers Header Information
--sslinfo SSL Certificate Information
--whois Whois Lookup
--crawl Crawl Target
--dns DNS Enumeration
--sub Sub-Domain Enumeration
--dir Directory Search
--wayback Wayback URLs
--ps Fast Port Scan
--full Full Recon
Extra Options:
-nb Hide Banner
-dt DT Number of threads for directory enum [ Default : 30 ]
-pt PT Number of threads for port scan [ Default : 50 ]
-T T Request Timeout [ Default : 30.0 ]
-w W Path to Wordlist [ Default : wordlists/dirb_common.txt
]
-r Allow Redirect [ Default : False ]
-s Toggle SSL Verification [ Default : True ]
-sp SP Specify SSL Port [ Default : 443 ]
-d D Custom DNS Servers [ Default : 1.1.1.1 ]
-e E File Extensions [ Example : txt, xml, php ]
-o O Export Format [ Default : txt ]
-cd CD Change export directory [ Default :
~/.local/share/finalrecon ]
-k K Add API key [ Example : shodan@key ]
# Check headers
python3 finalrecon.py --headers --url https://example.com
# Check ssl Certificate
python3 finalrecon.py --sslinfo --url https://example.com
# Check whois Information
python3 finalrecon.py --whois --url https://example.com
# Crawl Target
python3 finalrecon.py --crawl --url https://example.com
# Directory Searching
python3 finalrecon.py --dir --url https://example.com -e txt,php -w /path/to/wordlist
# full scan
python3 finalrecon.py --full --url https://example.com
Demo
Created by Lohitya Pushkar (thewhiteh4t)