Recon Automation Tool

Python-based reconnaissance and attack-surface discovery tool for authorized bug bounty programs, VAPT engagements, CTFs, and assets you own.

The tool focuses only on:

• Subdomain discovery
• Live HTTP/HTTPS host discovery
• Passive URL collection
• Katana crawling
• URL normalization and deduplication
• JavaScript URL discovery

It does not perform vulnerability scanning, exploitation, parameter fuzzing, secret detection, or JavaScript downloading/parsing.

Features

• Subdomain Enumeration with subfinder
• Live Host Detection with httpx
• Historical URL Collection with gau
• Historical URL Collection with waybackurls
• Web Crawling with katana
• Python-based URL normalization and deduplication
• JavaScript URL discovery
• Resumable stages
• Optional forced re-run
• Configurable HTTPX/Katana rate limit
• Configurable HTTPX thread count
• Authorization confirmation before scanning

Requirements

• Python 3
• subfinder
• httpx
• katana
• gau
• waybackurls

No other external security tools are required.

Installation

git clone https://github.com/tejassroot/recon-automation-tool.git
cd recon-automation-tool

chmod +x recon
sudo ln -sf "$(pwd)/recon" /usr/local/bin/recon

Verify:

recon -h

Usage

Basic:

recon -d example.com

With rate limit and threads:

recon -d example.com --rate-limit 5 --threads 10

Skip Katana crawling:

recon -d example.com --no-crawl

Set a custom timeout:

recon -d example.com --timeout 300

Use a custom output directory:

recon -d example.com -o /home/kali/recon-results

Force stages to run again:

recon -d example.com --force

Skip the interactive authorization confirmation:

recon -d example.com --yes

Recon Pipeline

Authorization
     ↓
subfinder
     ↓
Python subdomain cleanup
     ↓
httpx
     ↓
Python live URL extraction
     ↓
gau + waybackurls
     ↓
Python URL normalization/deduplication
     ↓
katana
     ↓
Python final URL normalization/deduplication
     ↓
JavaScript URL discovery

Output Structure

example.com/
├── subdomains/
│   ├── subfinder.txt
│   └── all.txt
│
├── live_hosts/
│   ├── httpx.txt
│   └── urls.txt
│
├── urls/
│   ├── gau.txt
│   ├── wayback.txt
│   ├── katana.txt
│   └── all.txt
│
└── js/
    └── js_files.txt

File Description

subdomains/subfinder.txt Raw subdomain results from subfinder.

subdomains/all.txt Cleaned and deduplicated in-scope subdomains.

live_hosts/httpx.txt Raw HTTPX output containing discovered live HTTP/HTTPS services.

live_hosts/urls.txt Clean URLs extracted from HTTPX results.

urls/gau.txt URLs collected by gau.

urls/wayback.txt URLs collected from Wayback Machine using waybackurls.

urls/katana.txt URLs discovered by Katana crawling.

urls/all.txt Final normalized and deduplicated URL collection.

js/js_files.txt Discovered JavaScript URLs only. The tool does not download or analyze JavaScript files.

Rate Limiting

The --rate-limit option is passed directly to the native rate-limiting options of httpx and katana.

Example:

recon -d example.com --rate-limit 5

This tool does not implement a separate Python-side HTTP request limiter.

--threads controls the HTTPX thread count only:

recon -d example.com --threads 10

Resume Support

Existing non-empty output files are reused automatically.

To rerun the stages:

recon -d example.com --force

Authorization

Before active reconnaissance, the tool asks you to confirm that the target is authorized and in scope.

Use:

recon -d example.com

and enter the target domain when prompted.

For automation or CI environments:

recon -d example.com --yes

Only use this against targets you are authorized to test.

Scope

This project is intentionally recon-only.

It does not perform:

• Vulnerability scanning
• Exploitation
• Parameter fuzzing
• Secret detection
• JavaScript downloading
• JavaScript source analysis
• Credential attacks
• Authentication bypass
• Authorization bypass
• Automated vulnerability classification

The output is an attack-surface map intended for subsequent manual security testing.

Disclaimer

This tool is intended only for authorized security testing, bug bounty programs, CTFs, and systems you own or have explicit permission to assess.

You are responsible for verifying target scope and complying with the applicable program rules, authorization, and laws.