Recon Dashboard

Discover subdomains using passive and active methods

subfinder -d example.com -all -o ./recon/subdomains_subfinder.txt

amass enum -passive -d example.com -o ./recon/subdomains_amass.txt

amass enum -active -d example.com -o ./recon/subdomains_amass_active.txt

assetfinder --subs-only example.com | tee ./recon/subdomains_assetfinder.txt

findomain -t example.com -u ./recon/subdomains_findomain.txt

# Combine & deduplicate all subdomains
cat ./recon/subdomains_*.txt | sort -u > ./recon/all_subdomains.txt
wc -l ./recon/all_subdomains.txt

# Brute-force subdomains with wordlist
gobuster dns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -o ./recon/subdomains_brute.txt

# Certificate transparency logs
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u > ./recon/subdomains_crtsh.txt

Enumerate DNS records for zone transfers, mail servers, and hidden infrastructure

dig example.com ANY +noall +answer

dig example.com A +short

dig example.com MX +short

dig example.com NS +short

dig example.com TXT +short

# Attempt zone transfer
dig axfr @ns1.example.com example.com

host -t any example.com

dnsrecon -d example.com -t std

dnsrecon -d example.com -t axfr

dnsenum example.com

fierce --domain example.com

# Reverse DNS lookup
dig -x 10.10.10.10 +short

Gather organizational, registration, and historical intelligence

whois example.com

whois 10.10.10.10

# Certificate transparency via crt.sh
curl -s "https://crt.sh/?q=example.com&output=json" | jq '.[].name_value' | sort -u

# Wayback Machine URLs
waybackurls example.com | tee ./recon/wayback_urls.txt

# GAU (Get All URLs)
gau example.com | tee ./recon/gau_urls.txt

# TheHarvester — emails, hosts, IPs
theHarvester -d example.com -b all -f ./recon/theharvester.html

# Shodan CLI
shodan host 10.10.10.10

# Shodan domain search
shodan search hostname:example.com

Identify web technologies, frameworks, and server configurations

whatweb http://example.com -v

whatweb http://10.10.10.10 -a 3

# HTTP headers inspection
curl -sI http://example.com

# Follow redirects and show headers
curl -sIL http://example.com

# Wappalyzer CLI
wappalyzer http://example.com

# Check for common security headers
curl -sI http://example.com | grep -iE "x-frame|x-content|x-xss|strict-transport|content-security|referrer-policy|permissions-policy"

# SSL/TLS analysis
sslscan example.com

testssl.sh example.com

# Probe live hosts from subdomain list
cat ./recon/all_subdomains.txt | httpx -silent -status-code -title -tech-detect -o ./recon/httpx_results.txt

Chain multiple recon tools into automated workflows

# Full subdomain → live host → vulnerability pipeline
subfinder -d example.com -silent | httpx -silent | nuclei -severity medium,high,critical -o ./recon/vulns_pipeline.txt

# Subdomain → probe → screenshot
subfinder -d example.com -silent | httpx -silent | gowitness file -f - -P ./recon/screenshots/

# URL collection → parameter discovery
echo example.com | waybackurls | grep "=" | uro | tee ./recon/params.txt

# JavaScript file discovery
echo example.com | waybackurls | grep "\.js$" | sort -u | tee ./recon/js_files.txt

# Full automated pipeline script
mkdir -p ./recon
echo "[*] Starting recon for example.com"
subfinder -d example.com -all -silent > ./recon/subs.txt
amass enum -passive -d example.com >> ./recon/subs.txt
sort -u ./recon/subs.txt -o ./recon/subs.txt
echo "[*] Found $(wc -l < ./recon/subs.txt) unique subdomains"
cat ./recon/subs.txt | httpx -silent -status-code -title > ./recon/live_hosts.txt
echo "[*] $(wc -l < ./recon/live_hosts.txt) live hosts found"
cat ./recon/subs.txt | httpx -silent | nuclei -severity medium,high,critical -o ./recon/vulns.txt
echo "[*] Recon complete! Results in ./recon/"