recon

--- name: recon description: Run the full recon pipeline on a target:subdomain enumeration (ChaosAPI, and subfinder), live host discovery (dnsx and httpx), URL crawl (katana, waybackurls, and gau), GF pattern classification, and Nuclei scan. Outputs to the recon/<target>/ directory. Usage: /recon target.com --- # /recon Run the full recon pipeline on a target and produce a prioritized attack surface. ## What This Does 1. Enumerates subdomains (Chaos API + subfinder + assetfinder) 2. Resolves DNS and finds live hosts (dnsx + httpx with status/title/tech) 3. Crawls URLs (katana deep crawl + waybackurls + gau historical) 4. Classifies URLs by bug class (gf patterns) 5. Runs nuclei for known CVEs and misconfigurations 6. Outputs a prioritized attack surface summary ## Usage `` /recon target.com Or with specific focus: /recon target.com --focus api /recon target.com --focus auth /recon target.com --fast (skip historical URLs) ## Steps ### Step 1: Subdomain Enumeration bash TARGET="$1" mkdir -p recon/$TARGET # Chaos API (ProjectDiscovery : most comprehensive) curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \ -H "Authorization: $CHAOS_API_KEY" \ | jq -r '.[]' > recon/$TARGET/subdomains.txt # subfinder + assetfinder subfinder -d $TARGET -silent | anew recon/$TARGET/subdomains.txt assetfinder --subs-only $TARGET | anew recon/$TARGET/subdomains.txt echo "[+] Subdomains: $(wc -l < recon/$TARGET/subdomains.txt)" ### Step 2: Live Host Discovery bash # DNS resolve + HTTP probe with tech detection cat recon/$TARGET/subdomains.txt \ | dnsx -silent \ | httpx -silent -status-code -title -tech-detect \ | tee recon/$TARGET/live-hosts.txt echo "[+] Live hosts: $(wc -l < recon/$TARGET/live-hosts.txt)" ### Step 3: URL Crawl bash # Active crawl cat recon/$TARGET/live-hosts.txt | awk '{print $1}' \ | katana -d 3 -jc -kf all -silent \ | anew recon/$TARGET/urls.txt # Historical URLs echo $TARGET | waybackurls | anew recon/$TARGET/urls.txt gau $TARGET --subs | anew recon/$TARGET/urls.txt echo "[+] Total URLs: $(wc -l < recon/$TARGET/urls.txt)" ### Step 4: Classify URLs ``bash # Bug class classification : gf patterns cat recon/$TARGET/urls.txt | gf xss > recon/$TARGET/xss-candidates.txt cat recon/$TARGET/urls.txt | gf ssrf > recon/$TARGET/ssrf-candidates.txt cat recon/$TARGET/urls.txt | gf idor > recon/$TARGET/idor-candidates.txt cat recon/$TARGET/urls.txt | gf sqli > recon/$TARGET/sqli-candidates.txt cat recon/$TARGET/urls.txt | gf redirect > recon/$TARGET/redirect-candidates.txt cat recon/$TARGET/urls.txt | gf lfi > recon/$TARGET/lfi-candidates.txt cat recon/$TARGET/urls.txt | gf rce > recon/$TARGET/rce-candidates.txt cat recon/$TARGET/urls.txt | gf ssti > recon/$TARGET/ssti-candidates.txt cat recon/$TARGET/urls.txt | gf interestingparams > recon/$TARGET/interesting-candidates.txt # Open redirect parameters (additional patterns not in gf) grep -E "(\?|&)(redirect|next|return|dest|destination|go|forward|target|redir|url|continue|returnTo|returnUrl|callback|out|link)=" \ recon/$TARGET/urls.txt | anew recon/$TARGET/redirect-candidates.txt # CORS check candidates grep -E "(\?|&)(callback|jsonp|cb|callback)=" recon/$TARGET/urls.txt \ > recon/$TARGET/cors-jsonp-candidates.txt # Host header / password reset candidates cat recon/$TARGET/urls.txt | grep -E "/(forgot|reset|password|recovery)" \ > recon/$TARGET/host-header-candidates.txt # File upload candidates cat recon/$TARGET/urls.txt | grep -E "/(upload|import|attach|file|document|image|avatar|profile)" \ > recon/$TARGET/upload-candidates.txt # API endpoints cat recon/$TARGET/urls.txt | grep -E "/api /|/v1 /|/v2 /|/v3 /|/graphql|/rest /|/gql" \ > recon/$TARGET/api-endpoints.txt # Auth/session endpoints cat recon/$TARGET/urls.txt | grep -E "/(login|logout|signin|signup|register|auth|oauth|sso|token|session)" \ > recon/$TARGET/auth-endpoints.txt # Admin panels cat recon/$TARGET/live-hosts.txt | awk '{print $1}' | while read host; do for path in /admin /admin / /dashboard /wp-admin /jenkins /grafana /kibana /phpmyadmin /adminer; do STATUS=$(curl -s -o /dev/null -w "%{httpcode}" --max-time 5 "$host$p