Reconftw – Simple Script For Full Recon

This is a simple script intended to perform a full recon on an objective with multiple subdomains

AMD Ryzen 9 3900X 12-core, 24-thread unlocked desktop processor with Wraith Prism LED Cooler $484.00

The world's most advanced processor in the desktop PC gaming segment Can deliver ultra-fast 100+ FPS performance in the world's most popular games 12 cores and 24 processing threads, bundled with the AMD Wraith Prism cooler with color controlled LED ... read more

(as of February 28, 2021 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)

AMD Ryzen 5 5600X 6-core, 12-Thread Unlocked Desktop Processor with Wraith Stealth Cooler $389.99 $377.10

AMD's fastest 6 core processor for mainstream desktop, with 12 processing threads Can deliver elite 100+ FPS performance in the world's most popular games Bundled with the quiet, capable AMD Wraith Stealth cooler 4.6 GHz Max Boost, unlocked for overc... read more

(as of February 28, 2021 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)

AMD Ryzen 5 2600 Processor with Wraith Stealth Cooler - YD2600BBAFBOX $199.00 $189.99

System ram type: DDR4_sdram

(as of February 28, 2021 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)

tl;dr

• Requires Go
• Run ./install.sh before first run (apt, rpm, pacman compatible)

git clone https://github.com/six2dez/reconftw
cd reconftw
chmod +x *.sh
./install.sh
./reconftw.sh -d target.com -a

Features

• Tools checker
• Google Dorks (based on deggogle_hunter)
• Subdomain enumeration (passive, resolution, bruteforce and permutations)
• Sub TKO (subjack and nuclei)
• Web Prober (httpx)
• Web screenshot (aquatone)
• Template scanner (nuclei)
• Port Scanner (naabu)
• Url extraction (waybackurls, gau, hakrawler, github-endpoints)
• Pattern Search (gf and gf-patterns)
• Param discovery (paramspider and arjun)
• XSS (Gxss and dalfox)
• Github Check (git-hound)
• Favicon Real IP (fav-up)
• JS Checks (LinkFinder, SecretFinder, scripts from JSFScan)
• Fuzzing (ffuf)
• Cors (Corsy)
• SSL Check (testssl)
• Interlace integration
• Custom output folder (default under Recon/target.com/)
• Run standalone steps (subdomains, subtko, web, gdorks…)
• Polished installer compatible with most distros

Mindmap/Workflow

Requirements

• Golang > 1.14 installed and env vars correctly set ($GOPATH,$GOROOT)
• Run ./install.sh

Installer is provided as is. Nobody knows your system better than you, so nobody can debug your system better than you. If you are experiencing some issues with the installer script I can help you out, but keep in mind that is not my main priority.

• It is highly recommended, and in some cases essential, set your api keys:
  • amass (~/.config/amass/config.ini)
  • subfinder (~/.config/subfinder/config.yaml)
  • git-hound (~/.githound/config.yml)
  • github-endpoints.py (GITHUB_TOKEN env var)
  • favup (shodan init SHODANPAIDAPIKEY)
• This script uses dalfox with blind-xss option, you must change to your own server, check xsshunter.com.

Usage examples

Full scan:

./reconftw.sh -d target.com -a

Subdomains scan:

./reconftw.sh -d target.com -s

Web scan (target list required):

./reconftw.sh -d target.com -l targets.txt -w

Dorks:

./reconftw.sh -d target.com -g

Improvement plan:

• Notification support (Slack, Discord and Telegram)
• CMS tools (wpscan, drupwn/droopescan, joomscan)
• Add menu option for every feature
• Any other interesting suggestion
• Open Redirect with Oralyzer
• Enhance this Readme
• Customize output folder
• Interlace usage
• Crawler
• SubDomainizer
• Install script
• Apt,rpm,pacman compatible installer

Thanks

For their great feedback, support, help or for nothing special but well deserved:

• @detonXX
• @cyph3r_asr
• @h4ms1k