reconFTW

reconFTW is a powerful automated reconnaissance tool designed for security researchers and penetration testers. It streamlines the process of gathering intelligence on a target by performing subdomain enumeration, vulnerability scanning, OSINT and more. With a modular design, extensive configuration options, and support for distributed scanning via AX Framework, reconFTW is built to deliver comprehensive results efficiently.

reconFTW leverages a wide range of techniques, including passive and active subdomain discovery, web vulnerability checks (e.g., XSS, SSRF, SQLi), OSINT, directory fuzzing, port scanning and screenshotting. It integrates with cutting-edge tools and APIs to maximize coverage and accuracy, ensuring you stay ahead in your reconnaissance efforts.

Key Features:

• Comprehensive subdomain enumeration (passive, bruteforce, permutations, certificate transparency, etc.)
• Vulnerability scanning for XSS, SSRF, SQLi, LFI, SSTI, and more
• OSINT for emails, metadata, API leaks, and third-party misconfigurations
• Distributed scanning with AX Framework for faster execution
• Customizable workflows with a detailed configuration file
• Integration with Faraday for reporting and visualization
• Support for Docker, Terraform and Ansible deployments

Disclaimer: Usage of reconFTW for attacking targets without prior consent is illegal. It is the user's responsibility to obey all applicable laws. The developers assume no liability for misuse or damage caused by this tool. Use responsibly.

📔 Table of Contents

• 📔 Table of Contents
• ✨ Features
• OSINT
• Subdomains
• Hosts
• Web Analysis
• Vulnerability Checks
• Extras
• 🏗️ Architecture
• 💿 Installation
• Local Installation (PC/VPS/VM)
• Docker
• Terraform + Ansible
• Trying the v2 beta (Go rewrite)
• ⚙️ Configuration
• 🚀 Usage
• Target Options
• Mode Options
• General Options
• Example Usage
• ☁️ Ax Framework Support (previously Axiom)
• 💻 Faraday Support
• 🧠 AI Integration
• 🗂️ Data Management
• Makefile
• Manual
• 🧪 Testing
• Mindmap/Workflow
• Sample video
• 🤝 How to Contribute
• 🔒 Security
• ❓ Need Help?
• 💖 Support This Project
• 🙏 Thanks
• 📝 Changelog
• 🛠️ Development
• 📜 License
• ⭐ Star History

✨ Features

reconFTW is packed with features to make reconnaissance thorough and efficient. Below is a detailed breakdown of its capabilities, updated to reflect the latest functionality in the script and configuration.

OSINT

• Domain Information: WHOIS lookup for domain registration details (whois).
• Email and Password Leaks: Searches for leaked emails and credentials (emailfinder and LeakSearch).
• Microsoft 365/Azure Mapping: Identifies Microsoft 365 and Azure tenants (msftrecon).
• Metadata Extraction: Extracts metadata from indexed office documents (metagoofil).
• API Leaks: Detects exposed APIs in public sources (porch-pirate, SwaggerSpy and postleaksNg).
• Google Dorking: Automated Google dork queries for sensitive information (dorks_hunter and xnldorker).
• GitHub Analysis: Scans GitHub organizations for repositories and secrets with selectable engines (enumerepo, trufflehog, gitleaks, titus, noseyparker).
• GitHub Actions Audit (Optional): Audits workflow artifacts and CI/CD exposure with gato.
• Third-Party Misconfigurations: Identifies misconfigured third-party services (misconfig-mapper).
• Mail Hygiene: Reviews SPF/DMARC configuration to flag spoofing or deliverability issues.
• Cloud Storage Enumeration: Surveys buckets across major providers for exposure (cloud_enum).
• Spoofable Domains: Checks for domains vulnerable to spoofing (spoofcheck).

Subdomains

• Passive Enumeration: Uses APIs and public sources for subdomain discovery (subfinder and github-subdomains).
• Certificate Transparency: Queries certificate transparency logs (crt).
• NOERROR Discovery: Identifies subdomains with DNS NOERROR responses (dnsx, more info here).
• Bruteforce: Performs DNS bruteforcing with customizable wordlists (puredns and custom wordlists).
• Permutations: Generates subdomain permutations using AI, regex and tools (Gotator as the single permutation engine, plus regulator and subwiz).
• Web Scraping: Extracts subdomains from passive URL sources and live web metadata (urlfinder, waymore, httpx, csprecon).
• DNS Records: Resolves DNS records for subdomains (dnsx).
• Google Analytics: Identifies subdomains via Analytics IDs (AnalyticsRelationships).
• TLS Handshake: Discovers subdomains via TLS ports (tlsx).
• Recursive Search: Performs recursive passive or bruteforce enumeration combined (dsieve).
• Subdomain Takeover: