# RECON-NG

**Recon-ng** is a modular, open-source web reconnaissance framework written in Python. Think of it as the Metasploit of recon. It's CLI-driven, database-backed, and designed for automation of **OSINT (Open Source Intelligence)** gathering.

In the underground, **information is leverage**, and recon-ng turns passive recon into a surgical operation. While script kiddies run `whois` and `nslookup`, recon-ng gives you **scalable recon** with structured data you can feed into your attack pipeline.

You’re not just gathering domains — you’re **profiling targets**, pivoting off their infrastructure, chaining data points to build an actionable pre-exploitation picture.

Core Capabilities That Make It Dangerous

| Capability           | Black Hat Use                                                                                                                                   |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
| Modular System       | Dozens of plug-and-play modules — use only what you need. Think `recon/domains-hosts/bing_domain_web` or `contacts-credspills`.                 |
| Workspace Management | Set up isolated recon workspaces per target. Keeps your intel clean and organized.                                                              |
| Database Integration | Auto-stores results in an internal database. Perfect for later correlation or feeding into phishing kits, exploit dev, or password spray tools. |
| API Integration      | Uses public APIs (Shodan, HaveIBeenPwned, GitHub, etc.) — stealthy, passive, and **completely anonymous if proxied properly**.                  |
| Chained Modules      | You can **chain modules** — i.e., enumerate subdomains → resolve to IPs → scan for exposed services, all within recon-ng.                       |

Workflow

**Setup Workspace**

```bash
workspaces create targetcorp
```

**Import Target Domain**

```bash
add domains targetcorp.com
```

**Enumerate Subdomains**

```bash
recon/domains-hosts/brute_hosts
run
```

**Resolve to IPs**

```bash
recon/hosts-hosts/resolve
run
```

**Discover Contacts**

```bash
recon/hosts-contacts/whois_pocs
run
```

**Pull Breached Creds**

```bash
recon/contacts-credentials/hibp_pwned
run
```

Now you’ve got:

* Valid subdomains
* IP ranges
* Email addresses of employees
* Breached creds

Feed that into:

* A phishing campaign
* Credential stuffing attacks
* VPN brute-force
* Pivot into DevOps leaks (GitHub, GitLab, S3 buckets)

Anonymity Layer Integration

Expert black hats always obfuscate intel gathering:

* Route recon-ng traffic via **ProxyChains + Tor + dynamic proxies**
* Rotate API keys using disposable accounts
* Feed data into **custom recon DBs** to correlate with Shodan, Censys, etc.

In expert hands, it becomes the *intelligence arm of your attack kill chain*. It reduces time-to-pwn by **front-loading contextual data**, so you waste zero time on noisy scans or dead vectors.

Combine it with:

* **theHarvester** (manual recon)
* **Amass** (graph-based enum)
* **Custom Python tooling**
* and you’ve got a **dark recon suite** that maps entire digital footprints before you ever touch a target port.

#### **Workspace Isolation + Proxies**

```bash
proxychains recon-ng
```

Inside recon-ng:

```bash
workspaces create targetcorp
set TIMEOUT 15
set MAX_THREADS 10
```

You can also rotate proxies through `proxychains.conf` with dynamic lists (more below).

Seed Target Domain

```bash
add domains targetcorp.com
```

Subdomain Enurmeration&#x20;

Start with passive, low-footprint modules

```
use recon/domains-hosts/bing_domain_web
run

use recon/domains-hosts/brute_hosts
run

use recon/domains-hosts/google_site_web
run

use recon/domains-hosts/netcraft
run
```

Followed by resolution

```
use recon/hosts-hosts/resolve
run
```

Extract employees and emails

```
use recon/domains-contacts/whois_pocs
run

use recon/domains-contacts/google_mails
run

use recon/domains-contacts/jigsaw
run
```

Now that you have contacts

```
use recon/contacts-credentials/hibp_pwned
run
```

You’ve just found **valid email addresses + exposed creds** from public breaches. These can be used in:

* Password spraying
* MFA exhaustion
* Social engineering lures

Pull down public code and secrets

```
use recon/domains-vulnerabilities/github_push
run
```

Check commits, emails, and leaked tokens from their developers. You’ll often find:

* `.env` files
* AWS credentials
* Slack or SMTP creds

Combine this with a GitHub dork scanner or use GitRob for deeper exploration.

Export everything for custom analysis

```
export csv /root/recon/targetcorp.csv
```

From here, you can:

* Pipe into tools like **EyeWitness** for screenshots
* Use **Nmap** on the IPs for service discovery (only if you’re going active)
* Check **Shodan / Censys** for indexed service banners (anonymous)

Custom Automation Script

```python
# fetch_proxies.py

import requests

url = 'https://api.proxyscrape.com/?request=getproxies&proxytype=http&timeout=1000&country=all&ssl=all&anonymity=elite'

with open('/etc/proxychains4/proxychains.conf', 'w') as file:
    file.write("[ProxyList]\n")
    proxies = requests.get(url).text.strip().split('\n')
    for p in proxies[:20]:
        ip, port = p.split(":")
        file.write(f"http {ip} {port}\n")

print("[+] Proxychains config updated with fresh elite proxies.")
```

*Run this before recon to rotate IPs.*

Advanced Ideas to Chain

| Target Type       | Add This                                                                                      |
| ----------------- | --------------------------------------------------------------------------------------------- |
| **Web App**       | Feed subdomains into **dirsearch**, **ffuf**, or **Burp** for endpoint discovery              |
| **Employees**     | Use **LinkedIn scraping tools** or `sherlock` to find usernames on 50+ platforms              |
| **Git Leaks**     | GitRob, TruffleHog, or `gitleaks` on any public repo tied to the domain                       |
| **IP Ranges**     | Use `asnmap` or `ipinfo.io` to find their ASN → map out owned CIDRs                           |
| **Cloud Targets** | Feed domains into **S3Scanner**, **Bucket Finder**, or **CloudSploit** for exposed AWS assets |

Build the Kill Chain

Now that you have:

* Emails + leaked passwords
* Subdomains + IPs
* Developer leaks
* Exposed credentials
* DNS map + live assets

You’re ready to:

1. Run **credential stuffing** on their VPN or Outlook Web App.
2. Clone login portals for phishing.
3. Drop into their CI/CD via GitHub secrets.
4. Find a forgotten dev/test subdomain and pivot in.

OPSEC Tips

| Tip                                                                  | Benefit                       |
| -------------------------------------------------------------------- | ----------------------------- |
| Use **tailscale** or **Mullvad bridge**                              | Masks origin, drops logs      |
| Script browser scrapers via `selenium-wire` over Tor                 | Undetectable by recon-ng logs |
| Never touch the target directly unless needed                        | Passive recon keeps you safe  |
| Store data in local **SQLite** or **Elastic DB** for repeat analysis | Useful for multiple campaigns |

Here's a full **Python automation script** to:

1. Fetch fresh elite proxies
2. Update `proxychains.conf`
3. Launch `recon-ng`
4. Auto-run a recon module chain via recon-ng CLI commands
5. Export the data for post-processing

**Run this as root**, and make sure `recon-ng` and `proxychains4` are properly installed

```python
#!/usr/bin/env python3

import subprocess
import requests
import os
import time

# === SETTINGS ===
TARGET_DOMAIN = "targetcorp.com"
WORKSPACE_NAME = "targetcorp"
PROXY_COUNT = 20
RECON_EXPORT_PATH = f"/root/recon/{TARGET_DOMAIN}.csv"
PROXYCHAINS_CONF = "/etc/proxychains4/proxychains.conf"

# === STEP 1: Fetch fresh proxies and update proxychains ===
def update_proxychains():
    print("[*] Fetching elite proxies...")
    url = 'https://api.proxyscrape.com/?request=getproxies&proxytype=http&timeout=1000&country=all&ssl=all&anonymity=elite'
    try:
        response = requests.get(url, timeout=10)
        proxies = response.text.strip().split('\n')[:PROXY_COUNT]
        with open(PROXYCHAINS_CONF, 'w') as f:
            f.write("[ProxyList]\n")
            for p in proxies:
                ip, port = p.strip().split(':')
                f.write(f"http {ip} {port}\n")
        print(f"[+] Updated proxychains with {len(proxies)} proxies.")
    except Exception as e:
        print(f"[!] Proxy update failed: {e}")

# === STEP 2: Create recon-ng RC script ===
def generate_recon_script():
    script = f"""
workspaces create {WORKSPACE_NAME}
add domains {TARGET_DOMAIN}

use recon/domains-hosts/bing_domain_web
run

use recon/domains-hosts/google_site_web
run

use recon/domains-hosts/netcraft
run

use recon/domains-hosts/brute_hosts
run

use recon/hosts-hosts/resolve
run

use recon/domains-contacts/whois_pocs
run

use recon/domains-contacts/google_mails
run

use recon/domains-contacts/jigsaw
run

use recon/contacts-credentials/hibp_pwned
run

use recon/domains-vulnerabilities/github_push
run

export csv {RECON_EXPORT_PATH}
exit
"""
    script_path = f"/tmp/recon-{TARGET_DOMAIN}.rc"
    with open(script_path, "w") as f:
        f.write(script)
    return script_path

# === STEP 3: Execute recon-ng via proxychains ===
def run_recon(script_path):
    print("[*] Running recon-ng with proxychains...")
    cmd = ["proxychains4", "recon-ng", "-r", script_path]
    subprocess.run(cmd)

# === MAIN ===
if __name__ == "__main__":
    os.makedirs(os.path.dirname(RECON_EXPORT_PATH), exist_ok=True)
    update_proxychains()
    rc_script = generate_recon_script()
    run_recon(rc_script)
    print(f"[+] Recon complete. Exported to: {RECON_EXPORT_PATH}")
```

Usage&#x20;

```
sudo python3 auto_recon.py
```

What the script does

* Grabs **20 elite proxies** and overwrites `/etc/proxychains4/proxychains.conf`
* Generates a custom `.rc` file for `recon-ng`
* Chains passive recon modules:
  * Subdomain + email enum
  * WHOIS, GitHub, breach lookups
* **Exports** everything to `/root/recon/targetcorp.csv`

Passive-Only Modules

`recon-ng` is OPSEC-safe *only if* you restrict yourself to **modules that do not query the target's infrastructure** directly.

These do not touch the target, only third-party sources instead

```
recon/domains-hosts/bing_domain_web
recon/domains-hosts/netcraft
recon/domains-hosts/brute_hosts (careful if misconfigured)
recon/domains-contacts/google_mails
recon/domains-contacts/whois_pocs
recon/domains-contacts/jigsaw
recon/contacts-credentials/hibp_pwned
recon/domains-vulnerabilities/github_push
```

Avoid

* Any module that sends requests to subdomains directly (e.g., `http`, `ssl`, `dns`, `geo` modules)
* `hostnames-to-ports`, `hostnames-to-http` type modules

Global Anonymity with ProxyChains + Tor + SOCKS5 Bridge

```
proxychains4 recon-ng
```

Inside `/etc/proxychains4/proxychains.conf`:

```
dynamic_chain
proxy_dns
tcp_read_time_out 15000
tcp_connect_time_out 8000

[ProxyList]
socks5 127.0.0.1 9050
http 192.252.208.67 14287
http 198.8.94.174 39002
```

Never use DNS outside the proxy chain. Always set `proxy_dns`.

Isolation with Tailscale + Ephemeral Linux Envs

* Route recon-ng through a **VPN** → **Tor** → **proxychains** triple stack
* If in a lab, use **Tailscale** or **WireGuard** as the first layer for encrypted point-to-point routing
* Run recon-ng from:
  * Live ISO (Tails, Whonix)
  * Isolated Qubes VM
  * Disposable container (`docker run -it --rm kalilinux/kali-rolling`)

Avoid Artifact Leaks: Clean Storage + Exfil Handling

Recon-ng stores output in `.recon-ng/` SQLite DB. Protect or exfil that data securely:

* Clean workspace post-run: `workspaces delete NAME`
* Avoid storing exports in `/root/` or known locations
* Store to mounted encrypted volume:

```
mkdir /mnt/encrypted && cryptsetup luksOpen /dev/sdb1 stealthvol && mount /dev/mapper/stealthvol /mnt/encrypted
```

Exfil using `scp` over a hidden VPS or OnionShare

Randomization, Delays, and Noise Blending

To avoid triggering OSINT abuse alerts (like Jigsaw or WHOIS rate-limits):

```
set MAX_THREADS 5
set TIMEOUT 10
```

You can inject delays inside your `.rc` script:

```
sleep 3
run
sleep 5
```

Or dynamically from a Python controller that:

* Selects a random module order
* Introduces randomized sleep intervals
* Disguises automation fingerprints

Audit your OPSEC

After recon-ng is done:

* Inspect your DNS leaks:

  ```bash
  dig +short whoami.akamai.net @ns1-1.akamaitech.net
  ```
* Check your public IPs:

  ```bash
  curl ifconfig.me
  torsocks curl ifconfig.me
  ```
* Clean history:

  ```bash
  history -c
  shred -u ~/.recon-ng/*.db
  ```

Use `iptables` or `firejail` to ensure recon-ng *only* runs over Tor/proxy:

```
firejail --net=torproxy recon-ng
```

Conceptual Application

| Scenario           | Technique                                                              |
| ------------------ | ---------------------------------------------------------------------- |
| Prepping phishing  | Enumerate valid emails → correlate breaches → verify names via OSINT   |
| Red team recon     | Export recon-ng data → import into Maltego/Neo4j for visualization     |
| Insider attacks    | Use GitHub modules to clone devs' commits → leak tokens                |
| Dark web extortion | Correlate exposed infrastructure + emails with breached forum accounts |

OPSEC-Focused Script Overview

* Uses only passive recon-ng modules
* Randomizes module order
* Inserts artificial randomized delays
* Routes all traffic via proxychains (Tor + HTTP proxies)
* Clears disk artifacts and logs after execution

```python
#!/usr/bin/env python3

import subprocess
import random
import time
import os
import shutil

# === CONFIGURATION ===
TARGET_DOMAIN = "targetcorp.com"
WORKSPACE_NAME = "stealth_" + TARGET_DOMAIN.replace('.', '_')
EXPORT_PATH = f"/dev/shm/{TARGET_DOMAIN}_export.csv"
RC_SCRIPT_PATH = f"/tmp/.rc_{TARGET_DOMAIN}.tmp"
PROXYCHAINS_CONF = "/etc/proxychains4/proxychains.conf"
PASSIVE_MODULES = [
    "recon/domains-hosts/bing_domain_web",
    "recon/domains-hosts/netcraft",
    "recon/domains-hosts/brute_hosts",
    "recon/domains-contacts/whois_pocs",
    "recon/domains-contacts/google_mails",
    "recon/domains-contacts/jigsaw",
    "recon/contacts-credentials/hibp_pwned",
    "recon/domains-vulnerabilities/github_push"
]

# === STEP 1: Randomize Module Order & Add Sleep Delays ===
def generate_rc_script():
    random.shuffle(PASSIVE_MODULES)
    with open(RC_SCRIPT_PATH, "w") as f:
        f.write(f"workspaces create {WORKSPACE_NAME}\n")
        f.write(f"add domains {TARGET_DOMAIN}\n")
        for mod in PASSIVE_MODULES:
            sleep_time = random.randint(3, 8)
            f.write(f"use {mod}\n")
            f.write("run\n")
            f.write(f"sleep {sleep_time}\n")
        f.write(f"export csv {EXPORT_PATH}\n")
        f.write("exit\n")

# === STEP 2: Run recon-ng with Proxychains ===
def run_recon():
    subprocess.run(["proxychains4", "recon-ng", "-r", RC_SCRIPT_PATH])

# === STEP 3: Secure Clean-Up ===
def shred(path):
    if os.path.isfile(path):
        subprocess.run(["shred", "-u", path])
    elif os.path.isdir(path):
        for root, dirs, files in os.walk(path, topdown=False):
            for name in files:
                shred(os.path.join(root, name))
            for name in dirs:
                os.rmdir(os.path.join(root, name))
        os.rmdir(path)

def full_cleanup():
    print("[*] Cleaning up traces...")
    # Remove recon-ng history
    home = os.path.expanduser("~")
    recon_db = os.path.join(home, ".recon-ng")
    if os.path.isdir(recon_db):
        shred(recon_db)
    # Remove generated scripts/exports
    for path in [RC_SCRIPT_PATH, EXPORT_PATH]:
        if os.path.exists(path):
            shred(path)
    # Clear shell history
    subprocess.run(["history", "-c"])
    subprocess.run(["shred", "-u", os.path.expanduser("~/.bash_history")])
    print("[+] Cleanup complete.")

# === MAIN ===
if __name__ == "__main__":
    generate_rc_script()
    run_recon()
    print(f"[+] Recon complete. Export saved to {EXPORT_PATH}")
    input("[!] Press Enter to initiate full OPSEC cleanup...")
    full_cleanup()
```

DNS Leak Prevention

Make sure `/etc/proxychains4/proxychains.conf` includes:

```
proxy_dns
dynamic_chain
[ProxyList]
socks5 127.0.0.1 9050
```

Full Erasure Checklist

| Artifact           | Command to Erase                                     |
| ------------------ | ---------------------------------------------------- |
| Shell history      | `history -c && shred -u ~/.bash_history`             |
| recon-ng workspace | `~/.recon-ng` (use `shred -u -z -n 5` recursively)   |
| Logs               | `journalctl --rotate && journalctl --vacuum-time=1s` |
| Temp files         | `/tmp`, `/var/tmp`, `/dev/shm` → shred or use tmpfs  |
| Memory             | `swapoff -a && swapon -a` (flush swap)               |
| Exported data      | Use `EXPORT_PATH` to `/dev/shm` or encrypted FS      |

Real-World Use Case Flow

* Connect to jump-box (VPS or burner Pi over cellular)
* Boot encrypted live OS (Tails or Whonix)
* Use `proxychains4` with layered Tor/proxy/VPN
* Run `stealth_recon.py` against target
* Pipe results into temporary RAM (e.g., `/dev/shm`)
* Copy to external device or exfil via `scp`
* Initiate secure wipe
