reconFTW

reconFTW is a powerful automated reconnaissance tool designed for security researchers and penetration testers. It streamlines the process of gathering intelligence on a target by performing subdomain enumeration, vulnerability scanning, OSINT and more. With a modular design, extensive configuration options, and support for distributed scanning via AX Framework, reconFTW is built to deliver comprehensive results efficiently.

reconFTW leverages a wide range of techniques, including passive and active subdomain discovery, web vulnerability checks (e.g., XSS, SSRF, SQLi), OSINT, directory fuzzing, port scanning and screenshotting. It integrates with cutting-edge tools and APIs to maximize coverage and accuracy, ensuring you stay ahead in your reconnaissance efforts.

Key Features:

• Comprehensive subdomain enumeration (passive, bruteforce, permutations, certificate transparency, etc.)
• Vulnerability scanning for XSS, SSRF, SQLi, LFI, SSTI, and more
• OSINT for emails, metadata, API leaks, and third-party misconfigurations
• Distributed scanning with AX Framework for faster execution
• Customizable workflows with a detailed configuration file
• Integration with Faraday for reporting and visualization
• Support for Docker, Terraform and Ansible deployments

Disclaimer: Usage of reconFTW for attacking targets without prior consent is illegal. It is the user's responsibility to obey all applicable laws. The developers assume no liability for misuse or damage caused by this tool. Use responsibly.

📔 Table of Contents

• 📔 Table of Contents
• ✨ Features
  • OSINT
  • Subdomains
  • Hosts
  • Web Analysis
  • Vulnerability Checks
  • Extras
• 🏗️ Architecture
• 💿 Installation
  • Local Installation (PC/VPS/VM)
  • Docker
  • Terraform + Ansible
• Trying the v2 beta (Go rewrite)
• ⚙️ Configuration
• 🚀 Usage
  • Target Options
  • Mode Options
  • General Options
  • Example Usage
• ☁️ Ax Framework Support (previously Axiom)
• 💻 Faraday Support
• 🧠 AI Integration
• 🗂️ Data Management
  • Makefile
  • Manual
• 🧪 Testing
• Mindmap/Workflow
• Sample video
• 🤝 How to Contribute
• 🔒 Security
• ❓ Need Help?
• 💖 Support This Project
• 🙏 Thanks
• 📝 Changelog
• 🛠️ Development
• 📜 License
• ⭐ Star History

✨ Features

reconFTW is packed with features to make reconnaissance thorough and efficient. Below is a detailed breakdown of its capabilities, updated to reflect the latest functionality in the script and configuration.

OSINT

• Domain Information: WHOIS lookup for domain registration details (whois).
• Email and Password Leaks: Searches for leaked emails and credentials (emailfinder and LeakSearch).
• Microsoft 365/Azure Mapping: Identifies Microsoft 365 and Azure tenants (msftrecon).
• Metadata Extraction: Extracts metadata from indexed office documents (metagoofil).
• API Leaks: Detects exposed APIs in public sources (porch-pirate, SwaggerSpy and postleaksNg).
• Google Dorking: Automated Google dork queries for sensitive information (dorks_hunter and xnldorker).
• GitHub Analysis: Scans GitHub organizations for repositories and secrets with selectable engines (enumerepo, trufflehog, gitleaks, titus, noseyparker).
• GitHub Actions Audit (Optional): Audits workflow artifacts and CI/CD exposure with gato.
• Third-Party Misconfigurations: Identifies misconfigured third-party services (misconfig-mapper).
• Mail Hygiene: Reviews SPF/DMARC configuration to flag spoofing or deliverability issues.
• Cloud Storage Enumeration: Surveys buckets across major providers for exposure (cloud_enum).
• Spoofable Domains: Checks for domains vulnerable to spoofing (spoofcheck).

Subdomains

• Passive Enumeration: Uses APIs and public sources for subdomain discovery (subfinder and github-subdomains).
• Certificate Transparency: Queries certificate transparency logs (crt).
• NOERROR Discovery: Identifies subdomains with DNS NOERROR responses (dnsx, more info here).
• Bruteforce: Performs DNS bruteforcing with customizable wordlists (puredns and custom wordlists).
• Permutations: Generates subdomain permutations using AI, regex and tools (Gotator as the single permutation engine, plus regulator and subwiz).
• Web Scraping: Extracts subdomains from passive URL sources and live web metadata (urlfinder, waymore, httpx, csprecon).
• DNS Records: Resolves DNS records for subdomains (dnsx).
• Google Analytics: Identifies subdomains via Analytics IDs (AnalyticsRelationships).
• TLS Handshake: Discovers subdomains via TLS ports (tlsx).
• Recursive Search: Performs recursive passive or bruteforce enumeration combined (dsieve).
• Subdomain Takeover: Detects vulnerable subdomains (nuclei and dnstake).
• DNS Zone Transfer: Checks for misconfigured DNS zone transfers (dig).
• Cloud Buckets: Identifies misconfigured cloud buckets and exposed storage assets (S3Scanner and cloud_enum).
• Cloud Coverage Note: Cloud bucket checks no longer include Alibaba OSS coverage after replacing CloudHunter with cloud_enum.
• Cloud Output Migration: Legacy cloudhunter_* bucket artifacts were removed; use subdomains/cloud_enum_buckets_trufflehog.txt instead.
• Reverse IP Lookup: Discovers subdomains via IP ranges (hakip2host).

Hosts

• IP Information: Retrieves geolocation and WHOIS data (ipinfo).
• CDN Detection: Identifies IPs behind CDNs (cdncheck).
• WAF Detection: Detects Web Application Firewalls (wafw00f).
• Port Scanning: Active scanning with nmap (optionally preceded by naabu) and passive scanning with smap.
• Service Fingerprinting: Fingerprints exposed services on discovered host:port pairs with nerva.
• Service Vulnerabilities (Optional): Deep portscan profile can enrich results with CVE matching via vulners.
• Password Spraying: Attempts password spraying on identified services with engine selection (brutespray or brutus).
• Geolocation: Maps IP addresses to geographic locations (ipinfo).
• IPv6 Discovery: Optionally enumerates and scans discovered IPv6 targets when IPV6_SCAN is enabled.

Web Analysis

• Web Probing: Detects live web servers on standard and uncommon ports ((httpx)).
• Screenshots: Captures screenshots of web pages (nuclei).
• Virtual Host Fuzzing: Identifies virtual hosts by fuzzing HTTP headers (VhostFinder).
• CMS Detection: Identifies content management systems (CMSeeK).
• URL Extraction: Collects URLs passively and actively (urlfinder, waymore, katana, github-endpoints and JSA).
• URL Pattern Analysis: Classifies URLs using patterns (urless, gf and gf-patterns).
• Favicon Tech Recon: Identifies technologies from favicon hashes (favirecon).
• JavaScript Analysis: Extracts secrets and endpoints from JS files (subjs, JSA, xnLinkFinder, getjswords, mantra, jsluice).
• Source Map Extraction: Retrieves sensitive data from JavaScript source maps (sourcemapper).
• GraphQL Detection: Discovers GraphQL endpoints with nuclei and optionally performs in-depth introspection (GQLSpection).
• Parameter Discovery: Bruteforces hidden parameters on endpoints (arjun).
• WebSocket Auditing: Validates upgrade handshakes and origin handling on ws:// and wss:// endpoints.
• gRPC Reflection: Probes common gRPC ports for exposed service reflection (grpcurl).
• LLM Service Fingerprinting (Optional): Probes discovered web/API endpoints for exposed LLM services with julius.
• Fuzzing: Performs directory and parameter fuzzing (ffuf).
• File Extension Sorting: Organizes URLs by file extensions.
• Wordlist Generation: Creates custom wordlists for fuzzing.
• Password Dictionary: Generates password dictionaries from live content (cewler).
• IIS Shortname Scanning: Detects IIS shortname vulnerabilities (shortscan).

Vulnerability Checks

• CVEs: Checks for CVE and common vulnerabilites nuclei
• Nuclei DAST: Runs nuclei -dast templates over collected URLs and GF candidates for additional DAST coverage.
• XSS: Tests for cross-site scripting vulnerabilities (dalfox).
• SSL/TLS: Checks for SSL/TLS misconfigurations (testssl).
• SSRF: Tests for server-side request forgery (interactsh, parameter values with ffuf, and optional alternate protocol payloads).
• CRLF: Checks for CRLF injection vulnerabilities (crlfuzz).
• LFI: Tests for local file inclusion via fuzzing (ffuf).
• SSTI: Detects server-side template injection (TInjA).
• SQLi: Tests for SQL injection (SQLMap and ghauri).
• Broken Links: Identifies broken links and external references likely to be takeover-prone (second-order).
• Command Injection: Tests for command injection vulnerabilities (commix).
• HTTP Request Smuggling: Checks for request smuggling vulnerabilities (smugglex).
• Web Cache: Identifies web cache vulnerabilities (Web-Cache-Vulnerability-Scanner and toxicache).
• 4XX Bypassing: Attempts to bypass 4XX responses (nomore403).
• Parameter Fuzzing: Fuzzes URL parameters for vulnerabilities (nuclei).

Extras

• Multithreading: Optimizes performance (Interlace).
• Custom Resolvers: Generates DNS resolvers (dnsvalidator).
• Docker Support: Official Docker image on DockerHub.
• AWS Deployment: Deploys via Terraform and Ansible.
• IP/CIDR Support: Scans IP ranges and CIDR blocks.
• Scan Resumption: Resumes scans from the last completed step.
• Custom Output: Saves results to a user-defined directory.
• Diff Mode: Highlights new findings in subsequent scans.
• Scope Filtering: Supports in-scope and out-of-scope lists (inscope).
• Notifications: Sends alerts via Slack, Discord, or Telegram (notify).
• Result Zipping: Compresses and sends results.
• Faraday Integration: Exports results to Faraday for reporting .
• AI Report Generation: Generates reports using local AI models (reconftw_ai).
• Quick Rescan Mode: Skips heavy stages automatically when no new assets are discovered (--quick-rescan / QUICK_RESCAN).
• Hotlist Builder: Scores and highlights the riskiest assets (hotlist.txt) based on new findings.
• Command Tracing: Toggle SHOW_COMMANDS to log every executed command into target logs for debugging.
• Asset Store: Appends findings to assets.jsonl for downstream automation when ASSET_STORE is enabled.
• Consolidated Report: Auto-generates report/report.json and report/index.html at end of scan.
• ARM Support: Compatible with Raspberry Pi and ARM architectures (including MacOS MX).
• Health Check: Built-in system health check via --health-check (also used by Docker HEALTHCHECK).
• Incremental Mode: Only scan new findings since last run (--incremental).
• Adaptive Rate Limiting: Automatically back off on 429/503 errors (--adaptive-rate).
• Structured Logging: Optional JSON log output for advanced analysis (STRUCTURED_LOGGING).
• Input Sanitization: All user input is sanitized to prevent command injection.
• Dry-Run Mode: Preview what would be executed without running commands (--dry-run).
• Parallel Mode: Run independent functions in parallel for faster scans (--parallel, disable with --no-parallel).
• Modular Architecture: Codebase split into 8 focused modules for maintainability.
• Secrets Management: Environment variables, secrets.cfg, and Docker runtime secrets (see SECURITY.md).
• Circuit Breaker: Automatically skips tools after repeated failures to avoid scan hangs.
• Checkpoint System: Resume interrupted scans from the last successful phase.
• macOS Native Support: Full compatibility with macOS (BSD coreutils, Homebrew Bash 4+).

🏗️ Architecture

reconFTW uses a modular architecture. The main entry point (reconftw.sh) handles argument parsing and sources 8 specialized modules from the modules/ directory.

Directory Layout

reconftw/
├── reconftw.sh          # Entry point — arg parsing, module loading, dispatch
├── reconftw.cfg         # Default configuration
├── install.sh           # Installer
├── Makefile             # Data management, lint, fmt, test targets
├── modules/
│   ├── core.sh          # Lifecycle, logging, notifications, cleanup (1024 lines)
│   ├── modes.sh         # Scan modes, argument parsing, help (902 lines)
│   ├── subdomains.sh    # Subdomain enumeration (1938 lines)
│   ├── web.sh           # Web analysis, fuzzing, JS checks (1712 lines)
│   ├── vulns.sh         # Vulnerability scanning (926 lines)
│   ├── osint.sh         # OSINT functions (500 lines)
│   ├── axiom.sh         # Ax/Axiom fleet helpers (143 lines)
│   └── utils.sh         # Utilities, sanitization, validation (508 lines)
├── tests/
│   ├── run_tests.sh     # Test runner
│   ├── unit/            # bats-core unit tests
│   ├── integration/     # Integration tests
│   └── fixtures/        # Test data
├── Docker/
│   └── Dockerfile       # Official Docker image
└── Terraform/           # AWS deployment

Module Reference

The --source-only flag allows sourcing reconftw.sh without executing the main logic, enabling unit testing of individual functions.

💿 Installation

reconFTW supports multiple installation methods to suit different environments. Ensure you have sufficient disk space (at least 10 GB recommended) and a stable internet connection.

Quickstart

1. Clone and install

git clone https://github.com/six2dez/reconftw
cd reconftw
./install.sh --verbose

2. Run a scan (full + resume)

./reconftw.sh -d example.com -r

3. Minimal run (passive-only footprint)

./reconftw.sh -d example.com -p

Tip: re-run ./install.sh --tools later to refresh the toolchain without reinstalling system packages.

Local Installation (PC/VPS/VM)

1. Prerequisites:

   • Golang: Latest version (install_golang enabled by default in reconftw.cfg).
   • System Permissions: If not running as root, configure sudo to avoid prompts:

     sudo echo "${USERNAME} ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee -a /etc/sudoers.d/reconFTW
     

2. Steps:

   git clone https://github.com/six2dez/reconftw
   cd reconftw
   ./install.sh
   ./reconftw.sh -d target.com -r
   

3. Notes:

• The install.sh script installs dependencies, tools, and configures paths (GOROOT, GOPATH, PATH).
• Set install_golang=false in reconftw.cfg if Golang is already configured.
• For existing setups, run ./install.sh --tools to refresh Go binaries, pipx packages, and repositories without touching system packages.
• Check the Installation Guide for detailed instructions.

Docker

1. Pull the Image:

   docker pull six2dez/reconftw:main
   

2. Run the Container:

   docker run -it --rm \
     -v "${PWD}/OutputFolder/:/reconftw/Recon/" \
     six2dez/reconftw:main -d example.com -r
   

   For a list of targets, bind the list file into the container and reference the in-container path:

   docker run -it --rm \
     -v "${PWD}/domains.txt:/reconftw/domains.txt:ro" \
     -v "${PWD}/OutputFolder/:/reconftw/Recon/" \
     six2dez/reconftw:main -l /reconftw/domains.txt -r
   

3. View Results:

   • Results are saved in the OutputFolder directory on the host (not inside the container).

4. Customization:

   • Modify the Docker image or build your own; see the Docker Guide.
   • To skip Ax tooling in custom builds, pass --build-arg INSTALL_AXIOM=false.
   • Mount your notify config at ~/.config/notify/provider-config.yaml inside the container if you use notifications.

5. Secrets at Runtime:

   Pass API keys and secrets via environment variables — never bake them into the image:

   docker run -it --rm \
     -e SHODAN_API_KEY="your-key" \
     -e PDCP_API_KEY="your-projectdiscovery-key" \
     -e COLLAB_SERVER="your-server" \
     -e XSS_SERVER="your-server" \
     -v "${PWD}/OutputFolder/:/reconftw/Recon/" \
     six2dez/reconftw:main -d example.com -r
   

   See SECURITY.md for full secrets management guidance.

6. Health Check:

   The Docker image includes a built-in HEALTHCHECK that runs ./reconftw.sh --health-check every 60 seconds. You can also run it manually:

   docker exec  ./reconftw.sh --health-check
   

Terraform + Ansible

• Deploy reconFTW on AWS using Terraform and Ansible.
• Follow the guide in Terraform/README.md for setup instructions.

Trying the v2 beta (Go rewrite)

reconFTW is being rewritten in Go. The rewrite ships as an opt-in pre-release: it is listed on the releases page, and GitHub never points releases/latest at a pre-release — so if you do nothing, you keep getting the bash release. That is deliberate.

The Go binary is reconftw; the bash entry point is reconftw.sh. They do not overwrite each other, so you can keep both and fall back at any time.

The current beta is v5.0.0-beta.1. It is not served by releases/latest, so you name the tag explicitly:

curl -sSL "https://github.com/six2dez/reconftw/releases/download/v5.0.0-beta.1/reconftw_Linux_x86_64.tar.gz" | tar xz
sudo install -m 755 reconftw /usr/local/bin/reconftw
reconftw version

Pick the asset matching your platform from the release page — Darwin and arm64 builds, a static musl build, and .deb/.rpm packages are all published.

• What the beta is, and what it is not — including three things that are explicitly not finished yet.
• Report something — the v2 beta feedback template. Bugs in the bash release still go to the normal Bug report.

🛠️ Troubleshooting

• Bash 4+ on macOS: The scripts auto-relaunch under Homebrew Bash. If you see a message about Bash ](https://www.buymeacoffee.com/six2dez)

• DigitalOcean Referral: Referral Link

• GitHub Sponsorship: github.com/sponsors/six2dez

🙏 Thanks

Special thanks to the following services for supporting reconFTW:

• C99
• CIRCL
• NetworksDB
• ipinfo
• hackertarget
• Censys
• Fofa
• intelx
• Whoxy

📝 Changelog

See CHANGELOG.md for a detailed list of changes in each release.

🛠️ Development

Project Structure

reconftw/
├── reconftw.sh          # Main entry point (~500 lines)
├── reconftw.cfg         # Configuration file
├── modules/             # Phase modules
│   ├── utils.sh         # Utilities, sanitization, caching, circuit breaker
│   ├── core.sh          # Framework core, logging, lifecycle, health check
│   ├── modes.sh         # Scan modes, argument parsing
│   ├── subdomains.sh    # Subdomain enumeration
│   ├── web.sh           # Web analysis, nuclei scans
│   ├── vulns.sh         # Vulnerability scanning
│   ├── osint.sh         # OSINT functions
│   └── axiom.sh         # Ax/Axiom fleet helpers
├── lib/                 # Pure utility libraries
│   └── validation.sh    # Input validation functions
├── tests/               # Test suite (100+ tests)
│   ├── unit/            # Unit tests (bats)
│   ├── integration/     # Integration/smoke tests
│   └── security/        # Injection prevention tests
├── docs/                # Documentation
│   └── ARCHITECTURE.md  # Detailed architecture guide
└── secrets.cfg.example  # Template for API keys

Running Tests

make test          # Unit tests
make test-security # Security tests
make test-all      # All tests
make lint          # Shellcheck
make lint-fix      # Auto-fix with shfmt

Development Workflow

# 1. Source without executing (for testing)
source ./reconftw.sh --source-only

# 2. Test individual functions
sanitize_domain "test;domain.com"

# 3. Run health check
./reconftw.sh --health-check

# 4. Dry run to preview
./reconftw.sh -d example.com -r --dry-run

Contributing

See CONTRIBUTING.md for development guidelines and docs/ARCHITECTURE.md for technical details.

📜 License

reconFTW is licensed under the MIT License.

⭐ Star History