ReconMaster: Advanced Reconnaissance Framework

Features • Installation • Usage • Workflow • Tools Integrated • Output Structure • Examples • Troubleshooting

ReconMaster is a comprehensive reconnaissance automation framework designed for security professionals, bug bounty hunters, and penetration testers. It orchestrates numerous specialized security tools into a single streamlined workflow, significantly reducing the time and effort required for thorough reconnaissance.

Features

Comprehensive Reconnaissance Pipeline

• Subdomain Discovery

  • Passive enumeration via subfinder, assetfinder, and amass
  • Active brute forcing with optimized ffuf configurations
  • Fully concurrent processing for maximum efficiency

• Asset Validation & Exploration

  • Live domain verification with httpx
  • Technology stack detection
  • Automatic screenshot capture with gowitness
  • Subdomain takeover vulnerability checks with subzy

• Content Discovery

  • Intelligent web crawling with katana
  • Automatic JavaScript file extraction and analysis
  • Efficient directory brute forcing with intelligent target selection
  • Parameter discovery with arjun

• Security Analysis

  • Broken link discovery for potential hijacking
  • Strategic port scanning with nmap
  • Comprehensive vulnerability reporting

• Performance Optimization

  • Asynchronous execution of all components
  • Intelligent rate limiting to avoid detection
  • Smart resource allocation based on target size
  • Parallel processing of all tasks

Installation

Automatic Installation (Recommended)

1. Clone the repository and navigate to the directory:

git clone https://github.com/viphacker-100/reconmaster-v2.git
cd reconmaster-v2

2. Make the installation script executable:

chmod +x install_reconmaster.sh

3. Run with root privileges:

sudo ./install_reconmaster.sh

The script will automatically install all required dependencies and configure your system for optimal performance.

Manual Installation

For those who prefer manual control:

1. Install the required system packages:

sudo apt install python3 python3-pip golang-go git nmap

2. Install the Go tools:

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/tomnomnom/assetfinder@latest
go install -v github.com/OWASP/Amass/v3/...@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/ffuf/ffuf@latest
go install -v github.com/sensepost/gowitness@latest
go install -v github.com/projectdiscovery/katana/cmd/katana@latest
go install -v github.com/LukaSikic/subzy@latest

3. Add Go binaries to your PATH:

echo 'export PATH=$PATH:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

4. Install Python dependencies:

pip3 install requests argparse tqdm colorama arjun

5. Download wordlists:

mkdir -p ~/tools/wordlists/n0kovo_subdomains/fuzz
wget https://raw.githubusercontent.com/n0kovo/n0kovo_subdomains/main/n0kovo_subdomains.txt -O ~/tools/wordlists/n0kovo_subdomains/n0kovo_subdomains.txt
wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Discovery/Web-Content/directory-list-2.3-medium.txt -O ~/tools/wordlists/n0kovo_subdomains/fuzz/directory-list.txt

6. Make the script executable:

chmod +x reconmaster.py

7. (Optional) Create a symlink:

sudo ln -s $(pwd)/reconmaster.py /usr/local/bin/reconmaster

Usage

Basic Usage

reconmaster -d target.com

This will run a full reconnaissance on the domain target.com and store results in the default output directory.

Advanced Options

reconmaster -d target.com -o ./custom_output -t 30 -w custom_wordlist.txt

This will run reconnaissance with 30 concurrent threads, using a custom wordlist for subdomain enumeration, and store results in ./custom_output.

Passive Mode

To only perform passive reconnaissance (useful for sensitive targets):

reconmaster -d target.com --passive-only

Full Command Reference

usage: reconmaster.py [-h] -d DOMAIN [-o OUTPUT] [-t THREADS] [-w WORDLIST] [--passive-only]

ReconMaster: Automated Reconnaissance Framework

optional arguments:
  -h, --help            show this help message and exit
  -d DOMAIN, --domain DOMAIN
                        Target domain to scan
  -o OUTPUT, --output OUTPUT
                        Output directory for results (default: ./recon_results)
  -t THREADS, --threads THREADS
                        Number of threads to use (default: 10)
  -w WORDLIST, --wordlist WORDLIST
                        Custom wordlist for subdomain brute forcing
  --passive-only        Only perform passive reconnaissance

Workflow

ReconMaster follows a logical sequence of operations:

1. Subdomain Enumeration: Discovers all possible subdomains using both passive and active methods
2. Live Domain Resolution: Filters the subdomain list to identify live assets
3. Asset Profiling: Captures screenshots and identifies technology stacks
4. Subdomain Takeover Analysis: Checks for potential subdomain takeover vulnerabilities
5. Content Discovery: Crawls the web applications to discover endpoints and JavaScript files
6. Directory Enumeration: Performs intelligent directory brute forcing
7. Parameter Discovery: Identifies possible injection points
8. Security Testing: Performs additional tests including broken link detection and port scanning
9. Reporting: Generates a comprehensive markdown report with all findings

Each step is fully optimized with:

• Concurrent processing for maximum speed
• Intelligent rate limiting to avoid detection
• Error handling and timeout management
• Progress tracking and logging

Tools Integrated

ReconMaster orchestrates the following best-in-class security tools:

Category	Tools
Subdomain Discovery	subfinder, assetfinder, amass, ffuf
Domain Processing	httpx, gowitness, subzy
Content Discovery	katana, ffuf
Parameter Discovery	arjun (placeholder)
Security Analysis	nmap

Output Structure

ReconMaster creates a well-organized directory structure for each reconnaissance target:

recon_results/
└── target.com_YYYYMMDD_HHMMSS/
    ├── subdomains/
    │   ├── all_passive.txt          # Domains from passive enumeration
    │   ├── all_subdomains.txt       # All discovered subdomains
    │   ├── live_domains.txt         # Verified live domains
    │   └── takeovers.txt            # Potential subdomain takeovers
    ├── screenshots/                 # Visual snapshots of all sites
    ├── endpoints/
    │   ├── urls.txt                 # All discovered URLs
    │   ├── js_endpoints.txt         # Endpoints from JavaScript analysis
    │   └── interesting_dirs.txt     # Notable directories
    ├── js/
    │   └── js_files.txt             # JavaScript files for review
    ├── params/
    │   └── parameters.txt           # Discovered parameters
    └── reports/
        ├── broken_links.txt         # Potential broken links
        ├── *_nmap.txt               # Port scan results
        └── summary_report.md        # Comprehensive findings summary

Examples

Basic Reconnaissance

reconmaster -d example.com

Bug Bounty Mode

reconmaster -d hackerone.com -t 20 --output ./bounties/hackerone

Targeted Scan with Custom Wordlist

reconmaster -d sensitive-target.com -w large_wordlist.txt --passive-only

Optimizing Performance

• Increase threads for faster scanning of large targets: -t 30
• Use custom wordlists for more thorough subdomain discovery: -w custom_list.txt
• For sensitive targets, use --passive-only to avoid active probing
• Limit specific domains to scan using inclusion/exclusion patterns

Troubleshooting

Common Issues

1. Tools not found after installation

   • Make sure Go binaries are in your PATH: source ~/.bashrc
   • Verify tool installation: which subfinder

2. Permission issues

   • Ensure the script is executable: chmod +x reconmaster.py
   • Run with proper permissions for writing output

3. Rate limiting or IP blocking

   • Reduce threads: -t 5
   • Use passive mode: --passive-only
   • Consider using a VPN or proxy

4. Missing wordlists

   • Verify wordlist paths match those in the script
   • Download wordlists manually if needed

Getting Help

If you encounter any issues:

1. Check the logs for specific error messages
2. Verify all dependencies are installed correctly
3. Try running individual tools manually to isolate the issue

---

Made with ❤️ for VIPHACKER.100 community