🕵️ Recon Toolkit

Automated reconnaissance pipeline for subdomain enumeration, liveness checks, screenshotting and service scanning
Created by Dhruv Bhoir — Certified Ethical Hacker & Penetration Tester

---

Automate common reconnaissance tasks in a single script. Designed to streamline subdomain enumeration → alive-check → screenshot → port/service scan workflows for authorized security testing.

⚠️ AUTHORIZED USE ONLY — do not run this against targets without explicit permission.

⚠️ For educational and authorized testing only.
Do NOT scan or probe systems without explicit permission.

---

🚀 Features

• 🔎 Subdomain enumeration using multiple sources:
  • subfinder (fast, passive + some active sources)
  • assetfinder
  • (optional) amass for deep enumeration
• ✅ Alive detection using httprobe
• 📸 Screenshotting of live hosts with gowitness
• 🔍 Service/port scanning with nmap
• 🧩 Clean output folder structure per target for easy analysis

---

📦 Requirements

Install the following tools (example for Debian/Ubuntu):

sudo apt update && sudo apt upgrade -y
sudo apt install -y nmap
# Install other tools via their recommended installers:
# subfinder, assetfinder, httprobe, gowitness (see links below)

---

⚙️ Installation

1️⃣ Clone the repository

git clone https://github.com/Shree-Organization/Recon-Automation-Tool.git
cd Recon-Automation-Tool

2️⃣ Make it executable

chmod +x recon.sh

3️⃣ Ensure the required tools are installed

Tool	Purpose	Install Command
subfinder	Subdomain enumeration	go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
assetfinder	Asset discovery	go install github.com/tomnomnom/assetfinder@latest
httprobe	Check for live hosts	go install github.com/tomnomnom/httprobe@latest
gowitness (optional)	Capture screenshots	go install github.com/sensepost/gowitness@latest
nmap	Network scanning	sudo apt install nmap -y

Make sure $GOPATH/bin is in your PATH:

export PATH=$PATH:$(go env GOPATH)/bin

🧩 Usage

Basic Command

./recon.sh example.com

Output Example

[+] Launching Subfinder...
[+] Launching Assetfinder...
[+] Finding Alive Subdomains...
[+] Running Nmap on alive Subdomains...
✅ Recon Completed Successfully!

Example Run Summary

----------------------------------------
Recon Completed Successfully!
Results:
 - Subdomains: subdomains/all_subdomains.txt
 - Alive: subdomains/alive.txt
 - Screenshots: screenshots/
 - Scans: scans/nmap.txt
 - Logs: logs/recon.log
----------------------------------------
🎯 Recon completed for example.com

🧰 Tool Workflow

      ┌─────────────┐
      │   DOMAIN    │
      └──────┬──────┘
             │
             ▼
   ┌───────────────────────────┐
   │  Subfinder / Assetfinder  │
   └─────────┬─────────────────┘
             │
             ▼
       ┌─────────────┐
       │   httprobe  │
       └─────┬───────┘
             │
             ▼
   ┌────────────────────┐
   │  gowitness (opt.)  │
   └─────────┬──────────┘
             │
             ▼
          ┌──────┐
          │ nmap │
          └──────┘

🧠 Future Enhancements

• Add httpx and waybackurls for richer data
• Integrate masscan for faster port scanning
• Add JSON / HTML summary reports
• Parallel execution for faster recon
• Web dashboard for result visualization

🛡 Disclaimer

This tool is intended for educational and authorized security testing. The authors are not responsible for any misuse or damage caused by this tool.

🧑‍💻 Maintainers

• Dhruv Bhoir — Creator (Certified Ethical Hacker)
• Shree Organization — Repository maintainers
• GitHub: https://github.com/Shree-Organization
• Email: organizationshree@gmail.com

If this toolkit helps you, please ⭐ star the repo and share responsibly.

_{Built with ❤️ by Dhruv Bhoir, Mantra Patil & Shree Organization — Stay ethical and safe 🕵️‍♂️}