> ## Content Index > Fetch the complete content index at: https://darkwebinformer.com/llms.txt > Use this file to discover other available public pages before exploring further. # reconFTW: The Ultimate Tool for Automated Domain Reconnaissance and Vulnerability Scanning - URL: https://darkwebinformer.com/reconftw-the-ultimate-tool-for-automated-domain-reconnaissance-and-vulnerability-scanning-2/ - Published: 2024-09-07T21:00:54.000Z - Updated: 2025-09-04T22:26:48.000Z - Author: Dark Web Informer - Tags: OSINT, Tools GitHub: Last Commit: September 5th, 2024 --- ![](https://i.ibb.co/g45d48s/1249984122.gif) **reconFTW** automates the entire process of reconnaissance for you. It outperforms the work of subdomain enumeration along with various vulnerability checks and obtaining maximum information about your target. reconFTW uses a lot of techniques (passive, bruteforce, permutations, certificate transparency, source code scraping, analytics, DNS records...) for subdomain enumeration which helps you to get the maximum and the most interesting subdomains so that you be ahead of the competition. It also performs various vulnerability checks like XSS, Open Redirects, SSRF, CRLF, LFI, SQLi, SSL tests, SSTI, DNS zone transfers, and much more. Along with these, it performs OSINT techniques, directory fuzzing, dorking, ports scanning, screenshots, nuclei scan on your target. So, what are you waiting for? Go! Go! Go! đŸ’Ĩ ## 📔 Table of Contents [](https://github.com/six2dez/reconftw#-table-of-contents) --- - [⚙ī¸ Config file](https://github.com/six2dez/reconftw#%EF%B8%8F-config-file) - [Usage](https://github.com/six2dez/reconftw#usage) - [TARGET OPTIONS](https://github.com/six2dez/reconftw#target-options) - [MODE OPTIONS](https://github.com/six2dez/reconftw#mode-options) - [GENERAL OPTIONS](https://github.com/six2dez/reconftw#general-options) - [Example Usage](https://github.com/six2dez/reconftw#example-usage) - [To perform a full recon on single target](https://github.com/six2dez/reconftw#to-perform-a-full-recon-on-single-target) - [To perform a full recon on a list of targets](https://github.com/six2dez/reconftw#to-perform-a-full-recon-on-a-list-of-targets) - [Perform full recon with more time intense tasks *(VPS intended only)*](https://github.com/six2dez/reconftw#perform-full-recon-with-more-time-intense-tasks-vps-intended-only) - [Perform recon in a multi domain target](https://github.com/six2dez/reconftw#perform-recon-in-a-multi-domain-target) - [Perform recon with axiom integration](https://github.com/six2dez/reconftw#perform-recon-with-axiom-integration) - [Perform all steps (whole recon + all attacks) a.k.a. YOLO mode](https://github.com/six2dez/reconftw#perform-all-steps-whole-recon--all-attacks-aka-yolo-mode) - [Show help section](https://github.com/six2dez/reconftw#show-help-section) - [Axiom Support ☁ī¸](https://github.com/six2dez/reconftw#axiom-support-cloud) - [Sample video](https://github.com/six2dez/reconftw#sample-video) - [đŸ”Ĩ Features đŸ”Ĩ](https://github.com/six2dez/reconftw#fire-features-fire) - [Osint](https://github.com/six2dez/reconftw#osint) - [Subdomains](https://github.com/six2dez/reconftw#subdomains) - [Hosts](https://github.com/six2dez/reconftw#hosts) - [Webs](https://github.com/six2dez/reconftw#webs) - [Vulnerability checks](https://github.com/six2dez/reconftw#vulnerability-checks) - [Extras](https://github.com/six2dez/reconftw#extras) - [Mindmap/Workflow](https://github.com/six2dez/reconftw#mindmapworkflow) - [Data Keep](https://github.com/six2dez/reconftw#data-keep) - [Makefile](https://github.com/six2dez/reconftw#makefile) - [Manual](https://github.com/six2dez/reconftw#manual) - [Main commands](https://github.com/six2dez/reconftw#main-commands) - [How to contribute](https://github.com/six2dez/reconftw#how-to-contribute) - [Need help? ℹī¸](https://github.com/six2dez/reconftw#need-help-information%5Fsource) - [Support this project](https://github.com/six2dez/reconftw#support-this-project) - [Buymeacoffee](https://github.com/six2dez/reconftw#buymeacoffee) - [DigitalOcean referral link](https://github.com/six2dez/reconftw#digitalocean-referral-link) - [GitHub sponsorship](https://github.com/six2dez/reconftw#github-sponsorship) - [Thanks 🙏](https://github.com/six2dez/reconftw#thanks-pray) - [Disclaimer](https://github.com/six2dez/reconftw#disclaimer) --- ## đŸ’ŋ Installation [](https://github.com/six2dez/reconftw#-installation) ## a) Using a PC/VPS/VM [](https://github.com/six2dez/reconftw#a-using-a-pcvpsvm) > You can check out our wiki for the installation guide [Installation Guide](https://github.com/six2dez/reconftw/wiki/0.-Installation-Guide) 📖 - Requires [Golang](https://golang.org/dl/) \> **1.15.0+** installed and paths correctly set (**$GOPATH**, **$GOROOT**) Important: if you are not running reconftw as root, run `sudo echo "${USERNAME} ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee -a /etc/sudoers.d/reconFTW`, to make sure no sudo prompts are required to run the tool and to avoid any permission issues. git clone https://github.com/six2dez/reconftw cd reconftw/ ./install.sh ./reconftw.sh -d target.com -r ## b) Docker Image đŸŗ (3 options) [](https://github.com/six2dez/reconftw#b-docker-image--3-options) - Pull the image docker pull six2dez/reconftw:main - Run the container docker run -it --rm \\ \-v "${PWD}/OutputFolder/":'/reconftw/Recon/' \\ six2dez/reconftw:main -d example.com -r - View results (they're NOT in the Docker container) - As the folder you cloned earlier (named `reconftw`) is being renamed to `OutputFolder`, you'll have to go to that folder to view results. If you wish to: 1. Dynamically modify the behaviour & function of the image 2. Build your own container 3. Build an Axiom Controller on top of the official image Please refer to the [Docker](https://github.com/six2dez/reconftw/wiki/4.-Docker) documentation. ## c) Terraform + Ansible [](https://github.com/six2dez/reconftw#c-terraform--ansible) Yes! reconFTW can also be easily deployed with Terraform and Ansible to AWS, if you want to know how to do it, you can check the guide [here](https://github.com/six2dez/reconftw/blob/main/Terraform/README.md) # ⚙ī¸ Config file [](https://github.com/six2dez/reconftw#%EF%B8%8F-config-file) > You can find a detailed explanation of the configuration file [here](https://github.com/six2dez/reconftw/wiki/3.-Configuration-file) 📖 - Through `reconftw.cfg` file the whole execution of the tool can be controlled. - Hunters can set various scanning modes, execution preferences, tools, config files, APIs/TOKENS, personalized wordlists and much more. 👉 Click here to view default config file 👈 # Usage [](https://github.com/six2dez/reconftw#usage) > Check out the wiki section to know which flag performs what all steps/attacks [Usage Guide](https://github.com/six2dez/reconftw/wiki/2.-Usage-Guide) 📖 ## TARGET OPTIONS [](https://github.com/six2dez/reconftw#target-options) | Flag | Description | | ---- | ---------------------------------------- | | \-d | Single Target domain *(example.com)* | | \-l | List of targets *(one per line)* | | \-m | Multiple domain target *(companyName)* | | \-x | Exclude subdomains list *(Out Of Scope)* | | \-i | Include subdomains list *(In Scope)* | ## MODE OPTIONS [](https://github.com/six2dez/reconftw#mode-options) | Flag | Description | | ---- | --------------------------------------------------------------------------------- | | \-r | Recon - Full recon process (without attacks like sqli,ssrf,xss,ssti,lfi etc.) | | \-s | Subdomains - Perform only subdomain enumeration, web probing, subdomain takeovers | | \-p | Passive - Perform only passive steps | | \-a | All - Perform whole recon and all active attacks | | \-w | Web - Perform only vulnerability checks/attacks on particular target | | \-n | OSINT - Performs an OSINT scan (no subdomain enumeration and attacks) | | \-c | Custom - Launches specific function against target | | \-h | Help - Show this help menu | ## GENERAL OPTIONS [](https://github.com/six2dez/reconftw#general-options) | Flag | Description | | ------- | ------------------------------------------------------------------------- | | \--deep | Deep scan (Enable some slow options for deeper scan, *vps intended mode*) | | \-f | Custom config file path | | \-o | Output directory | | \-v | Axiom distributed VPS | | \-q | Rate limit in requests per second | ## Example Usage [](https://github.com/six2dez/reconftw#example-usage) **NOTE: this is applicable when you've installed reconFTW on the host (e.g. VM/VPS/cloud) and not in a Docker container.** ### To perform a full recon on single target [](https://github.com/six2dez/reconftw#to-perform-a-full-recon-on-single-target)./reconftw.sh -d target.com -r ### To perform a full recon on a list of targets [](https://github.com/six2dez/reconftw#to-perform-a-full-recon-on-a-list-of-targets)./reconftw.sh -l sites.txt -r -o /output/directory/ ### Perform full recon with more time intense tasks *(VPS intended only)* [](https://github.com/six2dez/reconftw#perform-full-recon-with-more-time-intense-tasks-vps-intended-only)./reconftw.sh -d target.com -r --deep -o /output/directory/ ### Perform recon in a multi domain target [](https://github.com/six2dez/reconftw#perform-recon-in-a-multi-domain-target)./reconftw.sh -m company -l domains\_list.txt -r ### Perform recon with axiom integration [](https://github.com/six2dez/reconftw#perform-recon-with-axiom-integration)./reconftw.sh -d target.com -r -v ### Perform all steps (whole recon + all attacks) a.k.a. YOLO mode [](https://github.com/six2dez/reconftw#perform-all-steps-whole-recon--all-attacks-aka-yolo-mode)./reconftw.sh -d target.com -a ### Show help section [](https://github.com/six2dez/reconftw#show-help-section)./reconftw.sh -h # Axiom Support ☁ī¸ [](https://github.com/six2dez/reconftw#axiom-support-cloud) ![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/09/82198491.png) > Check out the wiki section for more info [Axiom Support](https://github.com/six2dez/reconftw/wiki/5.-Axiom-version) - As reconFTW actively hits the target with a lot of web traffic, hence there was a need to move to Axiom distributing the work load among various instances leading to reduction of execution time. - During the configuration of axiom you need to select `reconftw` as provisoner. - You can create your own axiom's fleet before running reconFTW or let reconFTW to create and destroy it automatically just modifying reconftw.cfg file. # Sample video ![](https://i.ibb.co/g45d48s/1249984122.gif) [](https://github.com/six2dez/reconftw#sample-video) # đŸ”Ĩ Features đŸ”Ĩ [](https://github.com/six2dez/reconftw#fire-features-fire) ## Osint [](https://github.com/six2dez/reconftw#osint) - Domain information ([whois](https://github.com/rfc1036/whois)) - Emails addresses and passwords leaks ([emailfinder](https://github.com/Josue87/EmailFinder) and [LeakSearch](https://github.com/JoelGMSec/LeakSearch)) - Metadata finder ([MetaFinder](https://github.com/Josue87/MetaFinder)) - API leaks search ([porch-pirate](https://github.com/MandConsultingGroup/porch-pirate) and [SwaggerSpy](https://github.com/UndeadSec/SwaggerSpy)) - Google Dorks ([dorks\_hunter](https://github.com/six2dez/dorks%5Fhunter)) - Github Dorks ([gitdorks\_go](https://github.com/damit5/gitdorks%5Fgo)) - GitHub org analysis ([enumerepo](https://github.com/trickest/enumerepo), [trufflehog](https://github.com/trufflesecurity/trufflehog) and [gitleaks](https://github.com/gitleaks/gitleaks)) - 3rd parties misconfigurations([misconfig-mapper](https://github.com/intigriti/misconfig-mapper)) - Spoofable domains ([spoofcheck](https://github.com/MattKeeley/Spoofy)) ## Subdomains [](https://github.com/six2dez/reconftw#subdomains) - Passive ([subfinder](https://github.com/projectdiscovery/subfinder) and [github-subdomains](https://github.com/gwen001/github-subdomains)) - Certificate transparency ([crt](https://github.com/cemulus/crt)) - NOERROR subdomain discovery ([dnsx](https://github.com/projectdiscovery/dnsx), more info [here](https://www.securesystems.de/blog/enhancing-subdomain-enumeration-ents-and-noerror/)) - Bruteforce ([puredns](https://github.com/d3mondev/puredns)) - Permutations ([Gotator](https://github.com/Josue87/gotator), [ripgen](https://github.com/resyncgg/ripgen) and [regulator](https://github.com/cramppet/regulator)) - JS files & Source Code Scraping ([katana](https://github.com/projectdiscovery/katana)) - DNS Records ([dnsx](https://github.com/projectdiscovery/dnsx)) - Google Analytics ID ([AnalyticsRelationships](https://github.com/Josue87/AnalyticsRelationships)) - TLS handshake ([tlsx](https://github.com/projectdiscovery/tlsx)) - Recursive search ([dsieve](https://github.com/trickest/dsieve)). - Subdomains takeover ([nuclei](https://github.com/projectdiscovery/nuclei)) - DNS takeover ([dnstake](https://github.com/pwnesia/dnstake)) - DNS Zone Transfer ([dig](https://linux.die.net/man/1/dig)) - Cloud checkers ([S3Scanner](https://github.com/sa7mon/S3Scanner) and [cloud\_enum](https://github.com/initstring/cloud%5Fenum)) ## Hosts [](https://github.com/six2dez/reconftw#hosts) - IP info ([whoisxmlapi API](https://www.whoisxmlapi.com/)) - CDN checker ([ipcdn](https://github.com/six2dez/ipcdn)) - WAF checker ([wafw00f](https://github.com/EnableSecurity/wafw00f)) - Port Scanner (Active with [nmap](https://github.com/nmap/nmap) and passive with [smap](https://github.com/s0md3v/Smap)) - Port services vulnerability checks ([vulners](https://github.com/vulnersCom/nmap-vulners)) - Password spraying ([brutespray](https://github.com/x90skysn3k/brutespray)) - Geolocalization info (ipapi.co) ## Webs [](https://github.com/six2dez/reconftw#webs) - Web Prober ([httpx](https://github.com/projectdiscovery/httpx)) - Web screenshoting ([nuclei](https://github.com/projectdiscovery/nuclei)) - Web templates scanner ([nuclei](https://github.com/projectdiscovery/nuclei) and [nuclei geeknik](https://github.com/geeknik/the-nuclei-templates.git)) - CMS Scanner ([CMSeeK](https://github.com/Tuhinshubhra/CMSeeK)) - Url extraction ([gau](https://github.com/lc/gau),[waymore](https://github.com/xnl-h4ck3r/waymore), [katana](https://github.com/projectdiscovery/katana), [github-endpoints](https://gist.github.com/six2dez/d1d516b606557526e9a78d7dd49cacd3) and [JSA](https://github.com/w9w/JSA)) - URL patterns Search and filtering ([urless](https://github.com/xnl-h4ck3r/urless), [gf](https://github.com/tomnomnom/gf) and [gf-patterns](https://github.com/1ndianl33t/Gf-Patterns)) - Favicon Real IP ([fav-up](https://github.com/pielco11/fav-up)) - Javascript analysis ([subjs](https://github.com/lc/subjs), [JSA](https://github.com/w9w/JSA), [xnLinkFinder](https://github.com/xnl-h4ck3r/xnLinkFinder), [getjswords](https://github.com/m4ll0k/BBTz), [mantra](https://github.com/MrEmpy/mantra), [jsluice](https://github.com/BishopFox/jsluice)) - Sourcemap JS extraction ([sourcemapper](https://github.com/denandz/sourcemapper)) - Fuzzing ([ffuf](https://github.com/ffuf/ffuf)) - URL sorting by extension - Wordlist generation - Passwords dictionary creation ([pydictor](https://github.com/LandGrey/pydictor)) ## Vulnerability checks [](https://github.com/six2dez/reconftw#vulnerability-checks) - XSS ([dalfox](https://github.com/hahwul/dalfox)) - Open redirect ([Oralyzer](https://github.com/r0075h3ll/Oralyzer)) - SSRF (headers [interactsh](https://github.com/projectdiscovery/interactsh) and param values with [ffuf](https://github.com/ffuf/ffuf)) - CRLF ([crlfuzz](https://github.com/dwisiswant0/crlfuzz)) - Cors ([Corsy](https://github.com/s0md3v/Corsy)) - LFI Checks ([ffuf](https://github.com/ffuf/ffuf)) - SQLi Check ([SQLMap](https://github.com/sqlmapproject/sqlmap) and [ghauri](https://github.com/r0oth3x49/ghauri)) - SSTI ([ffuf](https://github.com/ffuf/ffuf)) - SSL tests ([testssl](https://github.com/drwetter/testssl.sh)) - Broken Links Checker ([katana](https://github.com/projectdiscovery/katana)) - Prototype Pollution ([ppmap](https://github.com/kleiton0x00/ppmap)) - Web Cache Vulnerabilities ([Web-Cache-Vulnerability-Scanner](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner)) - 4XX Bypasser ([nomore403](https://github.com/devploit/nomore403)) ## Extras [](https://github.com/six2dez/reconftw#extras) - Multithreading ([Interlace](https://github.com/codingo/Interlace)) - Custom resolvers generated list ([dnsvalidator](https://github.com/vortexau/dnsvalidator)) - Docker container included and [DockerHub](https://hub.docker.com/r/six2dez/reconftw) integration - Ansible + Terraform deployment over AWS - Allows IP/CIDR as target - Resume the scan from last performed step - Custom output folder option - All in one installer/updater script compatible with most distros - Diff support for continuous running (cron mode) - Support for targets with multiple domains - Raspberry Pi/ARM support - 6 modes (recon, passive, subdomains, web, osint and all) - Out of Scope Support + optional [inscope](https://github.com/tomnomnom/hacks/tree/master/inscope) support - Notification system with Slack, Discord and Telegram ([notify](https://github.com/projectdiscovery/notify)) and sending zipped results support ## Mindmap/Workflow [](https://github.com/six2dez/reconftw#mindmapworkflow) ![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/09/924891298491.png) ## Data Keep [](https://github.com/six2dez/reconftw#data-keep) Follow these simple steps to end up with a private repository with your `API Keys` and `/Recon` data. ### Makefile [](https://github.com/six2dez/reconftw#makefile) A `Makefile` is provided to quickly bootstrap a private repo. To use it, you'll need the [Github CLI](https://cli.github.com/) installed. Once done, just run: \# below line is optional, the default is \~/reconftw-data export PRIV\_REPO="$HOME/reconftw-data" make bootstrap To sync your private repo with upstream: make sync To upload juicy recon data: make upload ### Manual [](https://github.com/six2dez/reconftw#manual) - Create a private **blank** repository on `Git(Hub|Lab)` (Take into account size limits regarding Recon data upload) - Clone your project: `git clone https://gitlab.com/example/reconftw-data` - Get inside the cloned repository: `cd reconftw-data` - Create a new branch with an empty commit: `git commit --allow-empty -m "Empty commit"` - Add the official repo as a new remote: `git remote add upstream https://github.com/six2dez/reconftw` (`upstream` is an example) - Update upstream's repo: `git fetch upstream` - Rebase current branch with the official one: `git rebase upstream/main master` ### Main commands [](https://github.com/six2dez/reconftw#main-commands) - Upload changes to your personal repo: `git add . && git commit -m "Data upload" && git push origin master` - Update tool anytime: `git fetch upstream && git rebase upstream/main master` ## How to contribute [](https://github.com/six2dez/reconftw#how-to-contribute) If you want to contribute to this project, you can do it in multiple ways: - Submitting an [issue](https://github.com/six2dez/reconftw/issues/new/choose) because you have found a bug or you have any suggestion or request. - Making a Pull Request from [dev](https://github.com/six2dez/reconftw/tree/dev) branch because you want to improve the code or add something to the script. ## Need help? ℹī¸ [](https://github.com/six2dez/reconftw#need-help-information%5Fsource) - Take a look at the [wiki](https://github.com/six2dez/reconftw/wiki) section. - Check [FAQ](https://github.com/six2dez/reconftw/wiki/7.-FAQs) for commonly asked questions. - Join our [Discord server](https://discord.gg/R5DdXVEdTy) - Ask for help in the [Telegram group](https://t.me/joinchat/TO%5FR8NYFhhbmI5co)