recon-ng

GitHub - lanmaster53/recon-ng: Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.

Based on the provided sources, Recon-ng is a sophisticated tool used extensively during the Footprinting and Reconnaissance phase of ethical hacking. It is classified as an advanced, full-featured reconnaissance framework.

Overview and Function

• Type of Tool: Recon-ng is a full-featured web reconnaissance framework that includes independent modules and supports database interaction.
• Purpose: It is designed to provide a powerful environment for conducting open-source, web-based reconnaissance quickly and thoroughly.
• Methodology Phase: It is used during the Footprinting and Reconnaissance Phase.
• Information Gathering: Recon-ng assists attackers (or ethical hackers) in gathering information from public source-code repositories.

Usage and Features

The Recon-ng framework provides a command-line interface that allows users to manage workspaces, load modules, and run reconnaissance tasks.

1. Workspaces: Users can create workspaces to organize their reconnaissance activities, such as Github Repositories.
2. Modules: Recon-ng relies on modular architecture. For instance, attackers can load the recon/domains-hosts/brute_hosts module to extract a list of hosts associated with the target URL.
3. Command Examples:
   • To create a workspace: workspaces create Github Repositories.
   • To load a module to gather target hosts information: modules load recon/domains-hosts/brute_hosts.

In summary, Recon-ng is a critical tool for ethical hackers seeking to automate and streamline the process of collecting external, publicly available intelligence about a target organization, especially concerning domains, hosts, and exposed information in public source-code repositories.

Install all modules

marketplace install all

Display modules

modules search

Create new workspace

workspaces create BCC

Insert a new domain

db insert domains

Load a module

modules load recon/domains-hosts/brute_hosts 

modules load recon/domains-hosts/bing_domain_web

modules load recon/hosts-hosts/reverse_resolve

ARIN Whois RWS to harvest POC data from Whois queries for the given domain

modules load recon/domains-contacts/whois_pocs

options set SOURCE facebook.com

modules load recon/domains-hosts/hackertarget

Reporting

modules load reporting/

modules load reporting/html

options set CUSTOMER Bangladesh Computer Council

options set CREATOR Samidhya Sarker

Running a module

run