GO KALI FREE

Recon-ng

Information Gathering

Intermediatelow risk

Recon-ng is a full-featured Web Reconnaissance Framework focused on open source intelligence. It provides a powerful environment to conduct web-based reconnaissance quickly and thoroughly via community modules.

Installation

sudo apt install recon-ng

Basic Syntax

recon-ng

Quick Facts

Full Name
Recon-ng
License
MIT
Author
Travis Richardson (lanmaster53)
Written In
Python
Platforms
Linux, macOS, Windows
Category
OSINT Framework
First Release
2012
Module Count
100+ modules

Tool Overview

Recon-ng is a full-featured web reconnaissance framework designed for open source intelligence (OSINT) gathering. It provides a powerful, modular environment where security professionals can conduct web-based reconnaissance quickly and thoroughly using community-contributed modules.

Created by Travis Richardson in 2012, Recon-ng fills a critical gap in the penetration testing toolkit by providing a structured approach to OSINT collection. Unlike single-purpose tools, Recon-ng offers workspace management, a built-in database, and a Python API for automation.

The framework organizes reconnaissance into logical phases — from subdomain discovery and email harvesting to web scraping and data analysis. Each module performs a specific intelligence-gathering task, and results are automatically stored in a SQLite database for later querying and export.

Common Commands

recon-ngLaunch workspace - Enter the interactive recon-ng shell framework
modules install hackertargetInstall module - Download specific OSINT discovery modules from marketplace
options set SOURCE example.comSet context - Bind a target domain into the module variables
marketplace searchSearch modules
marketplace install allInstall all modules
modules load recon/domains-hosts/hackertargetLoad module
runExecute loaded module
recon-ngLaunch Recon-Ng console
recon-ng -w workspaceLaunch with specific workspace
workspaces create testCreate new workspace
workspaces listList all workspaces
modules install recon/domains-hosts/hackertargetInstall a module
modules load recon/domains-hosts/hackertargetLoad a module
options set SOURCE example.comSet module option
runExecute loaded module

Step-by-Step Guide

  1. 1Launch the recon-ng framework from your terminal
  2. 2Create a dedicated workspace for your current engagement
  3. 3Browse the marketplace and install relevant intelligence gathering modules
  4. 4Configure your target parameters and any necessary API keys, then type 'run'
  5. 5Query the built-in database to view and extract the gathered information

Warnings

Use Cases

Subdomain Discovery

Enumerate subdomains of target domains using DNS brute-forcing and passive reconnaissance modules.

Email Harvesting

Collect email addresses associated with target organizations from public sources.

Web Scraping

Extract contact information, metadata, and structure from target websites.

DNS Enumeration

Discover DNS records, nameservers, and mail servers for target domains.

Credential Discovery

Search for leaked credentials and exposed data associated with target domains.

Technology Fingerprinting

Identify technologies, frameworks, and services used by target web applications.

Key Features

Related Tools

theHarvester

Information Gathering

Email and subdomain discovery from public sources. Complements Recon-ng's broader OSINT capabilities.

Amass

Information Gathering

OWASP project for deep network mapping and attack surface discovery.

Nmap

Information Gathering

Network scanner for port discovery and service detection on hosts found by Recon-ng.

WhatWeb

Web Application

Web technology fingerprinting for targets identified by Recon-ng.

Shodan

Information Gathering

Internet-wide search engine for discovering IoT devices and network services.

Frequently Asked Questions

What is Recon-ng used for?

Recon-ng is a full-featured web reconnaissance framework used for open source intelligence (OSINT) gathering. It provides a modular environment to perform DNS enumeration, subdomain discovery, email harvesting, and web scraping through community-contributed modules.

Is Recon-ng free to use?

Yes, Recon-ng is completely free and open source under the MIT license. However, many of its powerful modules require API keys from third-party services like Shodan, Hunter.io, or BuiltWith, which may have their own pricing.

How is Recon-ng different from theHarvester?

Recon-ng is a framework with a modular architecture and built-in database, while theHarvester is a single-purpose tool. Recon-ng supports automation, workspace management, and custom modules, making it better for large-scale OSINT engagements.

Do I need API keys for Recon-ng?

Some Recon-ng modules work without API keys, but many of the most powerful modules (like Shodan, Bing, Hunter.io) require API keys from third-party services. You can still use basic modules for DNS enumeration and subdomain discovery without any keys.

Can Recon-ng automate OSINT collection?

Yes, Recon-ng supports automation through its Python API. You can write scripts to chain multiple modules together, set targets programmatically, and export results automatically, making it ideal for repeatable OSINT workflows.

Is Recon-ng legal to use?

Recon-ng itself is legal software. However, the legality depends on how you use it. Passive OSINT gathering from public sources is generally legal, but active scanning or accessing systems without authorization is illegal. Always obtain proper authorization.

How do I create a workspace in Recon-ng?

Use: workspace create <name>. Workspaces organize your reconnaissance data, modules, and results for each engagement. Switch between workspaces with: workspace <name>. List all workspaces with: workspace list.

How do I install modules in Recon-ng?

Browse available modules with: marketplace search <keyword>. Install with: marketplace install <module_path>. Modules are installed into your workspace and can be managed with: market install, market remove, and market refresh.

Can I use Recon-ng for passive DNS enumeration?

Yes, Recon-ng has multiple passive DNS modules that query public sources like VirusTotal, PassiveTotal, and DNS databases without sending traffic to the target. These are ideal for stealthy reconnaissance.

How do I query the Recon-ng database?

Use: db query <SQL statement>. The database stores all gathered intelligence including hosts, contacts, credentials, and netblocks. Query with standard SQL to extract and correlate reconnaissance data.

Can Recon-ng integrate with other tools?

Recon-ng can export data in CSV/JSON formats for use with other tools. It also supports Python API integration for building custom automation pipelines with tools like Nmap, Nuclei, and Metasploit.

How do I search for Recon-ng modules?

Use: marketplace search <keyword> to find modules by functionality. Examples: marketplace search shodan, marketplace search email, marketplace search dns. Browse results and install with: marketplace install <module_path>.

Can Recon-ng perform DNS brute-forcing?

Yes, install DNS brute-force modules from the marketplace: marketplace search dns_brute. These modules use wordlists to brute-force subdomain names through DNS resolution, complementing passive enumeration modules.

How do I set API keys in Recon-ng?

Use: keys add <service> <api_key> to configure API keys. For example: keys add shodan_api ABC123. View existing keys with: keys list. Many powerful modules require valid API keys from third-party services.

Does Recon-ng support custom modules?

Yes, you can create custom modules by writing Python classes that inherit from the base Module class. Place custom modules in your workspace directory and load them with: modules load <custom_module>.

How do I import data into Recon-ng?

Use: db insert <table> to add data directly. You can also import CSV files with custom scripts or use the Python API to programmatically populate the database from external data sources.

Can Recon-ng generate reports from collected data?

Yes, query the database with db query SQL statements and export results. Use reporting modules from the marketplace for formatted reports, or export to CSV/JSON for custom report generation.

How do I manage multiple Recon-ng workspaces?

Use workspace list to view all workspaces, workspace load <name> to switch, and workspace remove <name> to delete. Each workspace maintains independent database tables, modules, and API keys.

Is Recon-ng similar to Metasploit?

Both use modular architectures and command-line interfaces, but Recon-ng focuses on OSINT reconnaissance while Metasploit focuses on exploitation. Recon-ng uses Python modules; Metasploit uses Ruby modules.

Tags

#reconnaissance#osint#framework#modular

Output Explanation

All discovered information is automatically saved into an internal SQLite database. You must use commands like 'show hosts' or 'show domains' to display the aggregated data tables in the console.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.