Reconnaissance Frameworks

These frameworks aim to provide a complete suite of tools for web reconnaissance:

• FinalRecon: A Python-based reconnaissance tool offering a range of modules for different tasks like SSL certificate checking, Whois information gathering, header analysis, and crawling. Its modular structure enables easy customisation for specific needs.
• Recon-ng: A powerful framework written in Python that offers a modular structure with various modules for different reconnaissance tasks. It can perform DNS enumeration, subdomain discovery, port scanning, web crawling, and even exploit known vulnerabilities.
• theHarvester: Specifically designed for gathering email addresses, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and the SHODAN database. It is a command-line tool written in Python.
• SpiderFoot: An open-source intelligence automation tool that integrates with various data sources to collect information about a target, including IP addresses, domain names, email addresses, and social media profiles. It can perform DNS lookups, web crawling, port scanning, and more.
• OSINT Framework: A collection of various tools and resources for open-source intelligence gathering. It covers a wide range of information sources, including social media, search engines, public records, and more.

FinalRecon

FinalRecon offers a wealth of recon information:

• Header Information: Reveals server details, technologies used, and potential security misconfigurations.
• Whois Lookup: Uncovers domain registration details, including registrant information and contact details.
• SSL Certificate Information: Examines the SSL/TLS certificate for validity, issuer, and other relevant details.
• Crawler:
  • HTML, CSS, JavaScript: Extracts links, resources, and potential vulnerabilities from these files.
  • Internal/External Links: Maps out the website's structure and identifies connections to other domains.
  • Images, robots.txt, sitemap.xml: Gathers information about allowed/disallowed crawling paths and website structure.
  • Links in JavaScript, Wayback Machine: Uncovers hidden links and historical website data.
• DNS Enumeration: Queries over 40 DNS record types, including DMARC records for email security assessment.
• Subdomain Enumeration: Leverages multiple data sources (crt.sh, AnubisDB, ThreatMiner, CertSpotter, Facebook API, VirusTotal API, Shodan API, BeVigil API) to discover subdomains.
• Directory Enumeration: Supports custom wordlists and file extensions to uncover hidden directories and files.
• Wayback Machine: Retrieves URLs from the last five years to analyse website changes and potential vulnerabilities.

Installation is quick and easy:

        shellsession
Moyinthehacker@htb[/htb]$ git clone https://github.com/thewhiteh4t/FinalRecon.git
Moyinthehacker@htb[/htb]$ cd FinalRecon
Moyinthehacker@htb[/htb]$ pip3 install -r requirements.txt
Moyinthehacker@htb[/htb]$ chmod +x ./finalrecon.py
Moyinthehacker@htb[/htb]$ ./finalrecon.py --helpusage: finalrecon.py [-h] [--url URL] [--headers] [--sslinfo] [--whois]                     [--crawl] [--dns] [--sub] [--dir] [--wayback] [--ps]                     [--full] [-nb] [-dt DT] [-pt PT] [-T T] [-w W] [-r] [-s]                     [-sp SP] [-d D] [-e E] [-o O] [-cd CD] [-k K]FinalRecon - All in One Web Recon | v1.1.6optional arguments:  -h, --help  show this help message and exit  --url URL   Target URL  --headers   Header Information  --sslinfo   SSL Certificate Information  --whois     Whois Lookup  --crawl     Crawl Target  --dns       DNS Enumeration  --sub       Sub-Domain Enumeration  --dir       Directory Search  --wayback   Wayback URLs  --ps        Fast Port Scan  --full      Full ReconExtra Options:  -nb         Hide Banner  -dt DT      Number of threads for directory enum [ Default : 30 ]  -pt PT      Number of threads for port scan [ Default : 50 ]  -T T        Request Timeout [ Default : 30.0 ]  -w W        Path to Wordlist [ Default : wordlists/dirb_common.txt ]  -r          Allow Redirect [ Default : False ]  -s          Toggle SSL Verification [ Default : True ]  -sp SP      Specify SSL Port [ Default : 443 ]  -d D        Custom DNS Servers [ Default : 1.1.1.1 ]  -e E        File Extensions [ Example : txt, xml, php ]  -o O        Export Format [ Default : txt ]  -cd CD      Change export directory [ Default : ~/.local/share/finalrecon ]  -k K        Add API key [ Example : shodan@key ]

To get started, you will first clone the FinalRecon repository from GitHub using git clone https://github.com/thewhiteh4t/FinalRecon.git. This will create a new directory named "FinalRecon" containing all the necessary files.