reconFTW

https://docs.reconftw.com/
Admin
reconFTW is a modular reconnaissance automation framework that orchestrates 80+ security tools to...
Tokens:76,479
Snippets:1,201
Trust Score:5.1
Update:6 months ago
Show doc for...
Tokens:
Raw
### Initial VPS Setup for reconFTW

Source: https://docs.reconftw.com/deployment/deployment

Steps to set up a VPS for reconFTW, including connecting, updating the system, creating a non-root user, and installing reconFTW.

```bash
# Connect to VPS
ssh root@your-vps-ip

# Update system
apt update && apt upgrade -y

# Create non-root user
adduser recon
usermod -aG sudo recon

# Switch to user
su - recon

# Install reconFTW
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh
```

--------------------------------

### Quick Local Installation of reconFTW

Source: https://docs.reconftw.com/deployment/deployment

Use this for a fast setup on a single machine. It clones the repository and runs the installer script.

```bash
# Clone repository
git clone https://github.com/six2dez/reconftw.git
cd reconftw

# Run installer
./install.sh

# Verify installation
./reconftw.sh --check-tools
```

--------------------------------

### Clone reconFTW Repository and Run Installer

Source: https://docs.reconftw.com/getting-started/getting-started

Clones the reconFTW repository and executes the interactive installation script. This is the recommended local installation method.

```bash
# Clone the repository
git clone https://github.com/six2dez/reconftw.git
cd reconftw

# Run the installer (interactive)
./install.sh
```

--------------------------------

### Configure Golang Environment

Source: https://docs.reconftw.com/configuration/configuration

Sets Go installation paths and installation preferences.

```bash
install_golang=true              # Install Go if not found
export GOROOT="/usr/local/go"    # Go installation path
export GOPATH="$HOME/go"         # Go workspace
```

--------------------------------

### Install reconFTW

Source: https://docs.reconftw.com/welcome/first-30-minutes

Clone the repository and run the installation script. This process may take around 15-20 minutes.

```bash
# Clone and install
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh
```

--------------------------------

### Install Axiom

Source: https://docs.reconftw.com/integrations/axiom

Methods to install the Axiom framework via script or repository cloning.

```bash
# Install axiom
bash <(curl -s https://raw.githubusercontent.com/pry0cc/axiom/master/interact/axiom-configure)

# Or clone and install
git clone https://github.com/pry0cc/axiom ~/.axiom
cd ~/.axiom && ./interact/axiom-configure
```

--------------------------------

### Install Go and Configure PATH

Source: https://docs.reconftw.com/help/troubleshooting

Use these commands to install Go on Linux and add the necessary directories to your shell environment.

```bash
# Install Go
wget https://go.dev/dl/go1.21.0.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.21.0.linux-amd64.tar.gz

# Add to PATH
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

# Verify
go version
```

--------------------------------

### Manual Local Installation Dependencies

Source: https://docs.reconftw.com/deployment/deployment

Installs system dependencies required for manual setup on Ubuntu. Ensure Go environment variables are set correctly.

```bash
# Install system dependencies
sudo apt update
sudo apt install -y git curl wget python3 python3-pip ruby golang jq

# Set up Go environment
export GOPATH=$HOME/go
export PATH=$PATH:$GOPATH/bin
echo 'export GOPATH=$HOME/go' >> ~/.bashrc
echo 'export PATH=$PATH:$GOPATH/bin' >> ~/.bashrc

# Clone and install
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh
```

--------------------------------

### Install and Run reconFTW

Source: https://docs.reconftw.com/

Commands to clone the repository, install dependencies, and execute basic or full scans.

```bash
# Install reconFTW
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh

# Run your first scan
./reconftw.sh -d example.com -r

# Full scan with vulnerabilities
./reconftw.sh -d example.com -a
```

--------------------------------

### Proxmox LXC Container Setup for reconFTW

Source: https://docs.reconftw.com/deployment/deployment

Steps to create and configure an LXC container on Proxmox for running reconFTW. This includes container creation, starting, entering, and installing reconFTW within the container.

```bash
# Create container
pct create 100 local:vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst \
  --hostname reconftw \
  --memory 4096 \
  --cores 2 \
  --rootfs local-lvm:50 \
  --net0 name=eth0,bridge=vmbr0,ip=dhcp

# Start container
pct start 100

# Enter container
pct enter 100

# Install reconFTW
apt update && apt install -y git
git clone https://github.com/six2dez/reconftw.git
cd reconftw && ./install.sh
```

--------------------------------

### Install and Run Axiom

Source: https://docs.reconftw.com/welcome/faq

Commands for setting up Axiom and executing a distributed scan.

```bash
bash <(curl -s https://raw.githubusercontent.com/pry0cc/axiom/master/interact/axiom-configure)
```

```bash
./reconftw.sh -d example.com -a -v
```

--------------------------------

### Log file example

Source: https://docs.reconftw.com/guides/data-model

Sample content from the main reconftw.log file.

```text
[2024-01-15 10:30:00] [INFO] Starting reconnaissance for example.com
[2024-01-15 10:30:05] [INFO] Running sub_passive
[2024-01-15 10:35:00] [INFO] sub_passive found 150 subdomains
[2024-01-15 10:35:01] [INFO] Running sub_brute
[2024-01-15 10:45:00] [ERROR] nuclei timeout on https://slow.example.com
```

--------------------------------

### Manage Configuration Files

Source: https://docs.reconftw.com/help/troubleshooting

Verify the existence of the configuration file or create one from the provided example.

```bash
# Check config exists
ls -la reconftw.cfg

# Create from example
cp reconftw.cfg.example reconftw.cfg

# Or specify path
./reconftw.sh -d example.com -r -f /path/to/reconftw.cfg
```

--------------------------------

### Install Base Dependencies for Ubuntu/Debian

Source: https://docs.reconftw.com/getting-started/getting-started

Installs essential packages required for reconFTW on Ubuntu or Debian-based systems. Run this before the main installation script.

```bash
sudo apt update
sudo apt install -y git curl wget python3 python3-pip ruby golang jq
```

--------------------------------

### Verify Tool Installation

Source: https://docs.reconftw.com/welcome/faq

Commands to troubleshoot missing or improperly installed dependencies.

```bash
go version
```

```bash
echo $PATH | grep go
```

```bash
./install.sh
```

```bash
which httpx
```

--------------------------------

### CI/CD Integration Example

Source: https://docs.reconftw.com/usage/usage

Non-interactive configuration suitable for automated pipelines.

```bash
# Non-interactive, minimal output
./reconftw.sh -d target.com -r -z --dry-run
```

--------------------------------

### Install Homebrew and Required macOS Packages

Source: https://docs.reconftw.com/getting-started/getting-started

Installs Homebrew if not present and then installs essential GNU tools and utilities required for reconFTW on macOS.

```bash
# Install Homebrew if not installed
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# Install required formulae
brew install bash coreutils gnu-sed gnu-getopt findutils grep

# Use Homebrew's bash (required for reconFTW)
# reconFTW will automatically use /opt/homebrew/bin/bash on Apple Silicon
```

--------------------------------

### Verify Tool Installation

Source: https://docs.reconftw.com/usage/usage

Use --check-tools to validate that all required dependencies are installed.

```bash
./reconftw.sh --check-tools
```

--------------------------------

### Install Base Dependencies for macOS (Homebrew)

Source: https://docs.reconftw.com/getting-started/getting-started

Installs necessary dependencies for reconFTW on macOS using Homebrew. Ensure Homebrew is installed first.

```bash
brew install git curl wget python@3 ruby go jq gnu-getopt coreutils gnu-sed bash
```

--------------------------------

### Quick Reference Card

Source: https://docs.reconftw.com/getting-started/getting-started

Summary of common commands for installation, scanning, and maintenance.

```bash
# Installation
git clone https://github.com/six2dez/reconftw.git && cd reconftw && ./install.sh

# Basic scans
./reconftw.sh -d target.com -r          # Full recon
./reconftw.sh -d target.com -s          # Subdomains only
./reconftw.sh -d target.com -p          # Passive only
./reconftw.sh -d target.com -a          # Full + vulns

# Advanced options
./reconftw.sh -d target.com -r --deep   # Deep/thorough scan
./reconftw.sh -d target.com -r -v       # With Axiom (distributed)
./reconftw.sh -l targets.txt -r         # Multiple targets

# Maintenance
./reconftw.sh --check-tools             # Verify installation
./reconftw.sh --health-check            # System health
./install.sh --tools                    # Update tools
```

--------------------------------

### Verify Installation and System Health

Source: https://docs.reconftw.com/getting-started/getting-started

Check the status of installed tools and verify system dependencies and configuration.

```bash
# Verify all tools are installed
./reconftw.sh --check-tools
```

```bash
# Run system health check
./reconftw.sh --health-check
```

--------------------------------

### Configure VPS Infrastructure

Source: https://docs.reconftw.com/guides/opsec-legal

Initial setup commands for cloud-based scanning environments. Use neutral hostnames to maintain operational security.

```bash
# Use cloud VPS, not home IP
# Provider: DigitalOcean, Linode, Vultr, Hetzner

# Change hostname to something neutral
hostnamectl set-hostname scanner-01

# Use separate VPS per engagement (if possible)
```

--------------------------------

### Verify Tool Installation

Source: https://docs.reconftw.com/welcome/first-30-minutes

Checks if all required tools for ReconFTW are installed and properly configured. Run this to ensure your environment is ready.

```bash
./reconftw.sh --check-tools   # Verify installation
```

--------------------------------

### Troubleshoot Fleet Startup

Source: https://docs.reconftw.com/integrations/axiom

Verify cloud provider credentials and check available images if the fleet fails to start.

```bash
# Check cloud provider credentials
axiom-configure

# Verify API key
doctl auth init  # DigitalOcean
aws configure    # AWS

# Check available images
axiom-images ls
```

--------------------------------

### Verify tool installation and functionality

Source: https://docs.reconftw.com/tools-reference/tools

Commands to check tool paths, versions, and basic functionality.

```bash
# Check tool path
which httpx

# Check version
httpx -version

# Test functionality
echo example.com | httpx -silent
```

--------------------------------

### Bug Bounty Workflow Example

Source: https://docs.reconftw.com/usage/usage

Common sequence for initial reconnaissance and vulnerability assessment.

```bash
# Initial reconnaissance
./reconftw.sh -d target.com -r

# Follow-up with vulnerabilities
./reconftw.sh -d target.com -a

# Quick rescan after some time
./reconftw.sh -d target.com -r --quick-rescan --incremental
```

--------------------------------

### Verify and Install Missing Tools

Source: https://docs.reconftw.com/help/troubleshooting

Check for tool availability and reinstall if necessary, ensuring the Go bin directory is in the PATH.

```bash
# Check if tool exists
which subfinder

# If missing, install manually
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Verify Go bin in PATH
echo $PATH | grep -q "$HOME/go/bin" || export PATH=$PATH:$HOME/go/bin

# Run tool check
./reconftw.sh --check-tools
```

--------------------------------

### Setup Python Virtual Environment

Source: https://docs.reconftw.com/help/troubleshooting

Isolate Python dependencies by creating and activating a virtual environment.

```bash
# Create virtual environment
python3 -m venv ~/reconftw-venv
source ~/reconftw-venv/bin/activate

# Install dependencies
pip install -r requirements.txt
```

--------------------------------

### Parameter Discovery Sample Output

Source: https://docs.reconftw.com/modules/web-analysis

Example output from the parameter discovery module, showing discovered parameters for different URLs.

```text
https://api.example.com/search
  Found: q, page, limit, sort, debug, admin
  
https://example.com/user
  Found: id, action, redirect, token
```

--------------------------------

### Verify reconFTW Installation and Health

Source: https://docs.reconftw.com/tools-reference/tools

Use these commands to ensure all integrated tools are correctly installed and the system is functioning properly.

```bash
# Check all tool installations
./reconftw.sh --check-tools

# System health check
./reconftw.sh --health-check
```

--------------------------------

### Quick reconFTW Examples

Source: https://docs.reconftw.com/usage/usage

Demonstrates common reconFTW usage patterns for single domain, multiple targets, full scans, and passive reconnaissance.

```bash
# Single domain reconnaissance
./reconftw.sh -d example.com -r
```

```bash
# Multiple targets from file
./reconftw.sh -l targets.txt -r
```

```bash
# Full scan with vulnerabilities
./reconftw.sh -d example.com -a
```

```bash
# Passive only (stealth)
./reconftw.sh -d example.com -p
```

--------------------------------

### Example hotlist.txt content

Source: https://docs.reconftw.com/guides/data-model

Displays the format for risk-scored priority findings.

```text
[CRITICAL] https://api.example.com/admin - nuclei:cve-2021-44228
[HIGH] staging.example.com - subdomain takeover
[MEDIUM] https://www.example.com - cors misconfiguration
```

--------------------------------

### Install Faraday

Source: https://docs.reconftw.com/integrations/faraday

Commands to install Faraday via Docker or Python pip.

```bash
# Docker installation (recommended)
docker pull faradaysec/faraday:latest
docker run -d --name faraday -p 5985:5985 faradaysec/faraday

# Or native installation
pip install faradaysec
```

--------------------------------

### Example secrets.cfg Content

Source: https://docs.reconftw.com/configuration/configuration

Template for storing sensitive API keys and tokens.

```bash
# API Keys
SHODAN_API_KEY="abc123..."
WHOISXML_API="xyz789..."

# Callback servers
XSS_SERVER="https://xss.example.com"
COLLAB_SERVER="https://interact.example.com"

# Notifications
slack_channel="C0XXXXXXXXX"
slack_auth="xoxb-..."
```

--------------------------------

### Verify Tool Installation

Source: https://docs.reconftw.com/integrations/axiom

Update tools on the fleet and verify specific tool availability.

```bash
# Update tools on fleet
axiom-exec "axiom-build tools"

# Verify tool installation
axiom-exec "which nuclei"
```

--------------------------------

### Stealth Configuration Example

Source: https://docs.reconftw.com/configuration/configuration

A minimal noise configuration for stealthy scanning, disabling active scanning and fuzzing.

```bash
# Minimal noise configuration
SUBBRUTE=false
SUBPERMUTE=false
PORTSCAN_ACTIVE=false
FUZZ=false
VULNS_GENERAL=false
HTTPX_RATELIMIT=10
NUCLEI_RATELIMIT=10
```

--------------------------------

### Large-Scale Scanning Example

Source: https://docs.reconftw.com/usage/usage

Configuration for scanning multiple targets using Axiom and custom output paths.

```bash
# Multiple targets with Axiom
./reconftw.sh -l targets.txt -r -v --deep

# With custom output
./reconftw.sh -m client-assessment -l targets.txt -a -o /data/assessments
```

--------------------------------

### Setup DNS Resolvers

Source: https://docs.reconftw.com/advanced/advanced

Validate and configure DNS resolvers for improved performance and reliability.

```bash
# Validate resolvers
dnsvalidator -tL public_resolvers.txt -threads 100 -o resolvers.txt

# Use validated resolvers
RESOLVERS="$SCRIPTPATH/resolvers.txt"
```

--------------------------------

### Configure Tool Paths

Source: https://docs.reconftw.com/configuration/configuration

Defines the installation directory for tools and the script execution path.

```bash
# Path where tools are installed
tools=$HOME/Tools

# Auto-detected script path (don't change)
SCRIPTPATH="$( cd "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
```

--------------------------------

### Aggressive Configuration Example

Source: https://docs.reconftw.com/configuration/configuration

Configuration for maximum coverage, enabling deep scanning, extensive subdomain enumeration, and fuzzing with higher rate limits.

```bash
# Maximum coverage
DEEP=true
SUBBRUTE=true
SUBPERMUTE=true
SUB_RECURSIVE_BRUTE=true
VULNS_GENERAL=true
FUZZ=true
HTTPX_THREADS=100
NUCLEI_RATELIMIT=500
```

--------------------------------

### Verify reconFTW Installation

Source: https://docs.reconftw.com/welcome/first-30-minutes

Check if all necessary tools for reconFTW are installed correctly. Successful checks display green checkmarks (✓).

```bash
# Check all tools installed
./reconftw.sh --check-tools
```

--------------------------------

### Update reconFTW

Source: https://docs.reconftw.com/welcome/faq

Use these commands to pull the latest changes from the repository and run the installation script.

```bash
cd reconftw
git pull
./install.sh
```

--------------------------------

### Verify Installation and Health

Source: https://docs.reconftw.com/deployment/deployment

Commands to check tool dependencies, system health, and perform a test scan.

```bash
# Check tools
./reconftw.sh --check-tools

# System health
./reconftw.sh --health-check

# Test scan
./reconftw.sh -d example.com -p
```

--------------------------------

### Resolve Installation Issues

Source: https://docs.reconftw.com/getting-started/getting-started

Fix common errors related to missing dependencies, permissions, or outdated tools.

```bash
# Install Go manually
wget https://go.dev/dl/go1.21.linux-amd64.tar.gz
sudo tar -C /usr/local -xzf go1.21.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin
export GOPATH=$HOME/go
export PATH=$PATH:$GOPATH/bin
```

```bash
# Fix permissions
chmod +x reconftw.sh install.sh
```

```bash
# Reinstall specific tools
./install.sh --tools
```

--------------------------------

### Launch Axiom Fleet for ReconFTW

Source: https://docs.reconftw.com/integrations/axiom

Launches a specified number of Axiom fleet instances for ReconFTW. Ensure Axiom is installed and configured.

```bash
# Launch fleet
axiom-fleet reconftw -i 10
```

--------------------------------

### CI/CD Pipeline Integration

Source: https://docs.reconftw.com/understanding-reconftw/concepts

Example configuration for running reconFTW within GitHub Actions and checking for critical vulnerabilities.

```yaml
# GitHub Actions example
- name: Security Recon
  run: |
    ./reconftw.sh -d ${{ secrets.TARGET }} -p -z
    
- name: Check Critical Vulns
  run: |
    if [ -s Recon/*/vulns/nuclei_critical.json ]; then
      echo "Critical vulnerabilities found!"
      exit 1
    fi
```

--------------------------------

### Example Alert Output

Source: https://docs.reconftw.com/guides/case-studies

A sample notification report summarizing new subdomains and critical/high severity vulnerabilities found during the weekly scan.

```text
🔔 Weekly Recon Report - 2024-01-15

=== New Subdomains (12) ===
new-api.company.com
staging2.company.com
...

=== New Vulnerabilities (3) ===
[CRITICAL] api.company.com - CVE-2024-XXXX
[HIGH] staging.company.com - exposed-admin
[HIGH] new-api.company.com - default-credentials

Full report: /opt/recon_results/2024-01-15/
```

--------------------------------

### Bug Bounty Configuration Example

Source: https://docs.reconftw.com/configuration/configuration

A balanced configuration for bug bounty hunting, enabling OSINT and subdomain enumeration while keeping vulnerability scanning optional and enabling differential mode.

```bash
# Balanced for bug bounty
OSINT=true
SUBDOMAINS_GENERAL=true
VULNS_GENERAL=false  # Enable with -a flag
NOTIFICATION=true
DIFF=true
```

--------------------------------

### Run reconFTW Installer Non-Interactively

Source: https://docs.reconftw.com/getting-started/getting-started

Executes the reconFTW installer non-interactively, automatically selecting the option to install all dependencies and tools.

```bash
echo 1 | ./install.sh
```

--------------------------------

### GraphQL Endpoint Detection Example

Source: https://docs.reconftw.com/modules/web-analysis

This snippet shows the configuration for enabling GraphQL endpoint detection and deep introspection.

```bash
GRAPHQL_CHECK=true
GQLSPECTION=true
```

--------------------------------

### SQLi Sample Output

Source: https://docs.reconftw.com/modules/vulnerabilities

Example output from an SQL injection scan, indicating a vulnerable parameter and the backend database.

```text
[VULNERABLE] https://example.com/user?id=1
  Parameter: id
  Type: Boolean-based blind
  Backend: MySQL
```

--------------------------------

### Docker Resource Limits Configuration

Source: https://docs.reconftw.com/deployment/deployment

Example of setting resource limits (CPU and memory) for the reconFTW service within a docker-compose.yml file.

```yaml
# docker-compose.yml with limits
services:
  reconftw:
    image: six2dez/reconftw:latest
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 8G
        reservations:
          cpus: '2'
          memory: 4G
```

--------------------------------

### Example reconFTW Output Directory Structure

Source: https://docs.reconftw.com/guides/data-model

This illustrates the typical directory structure created by reconFTW for storing scan results, organized by category like subdomains, web probing, hosts, OSINT, and vulnerabilities.

```bash
Recon/<domain>/
├── .called_fn/              # Checkpoint markers (hidden)
├── .log/                    # Execution logs (hidden)
│   └── reconftw.log
├── .tmp/                    # Temporary files (hidden)
│
├── subdomains/              # Subdomain enumeration results
│   ├── subdomains.txt       # [KEY] Final merged subdomains
│   ├── subdomains_crt.txt   # CT log subdomains
│   ├── subdomains_passive.txt
│   ├── subdomains_brute.txt
│   ├── subdomains_permut.txt
│   ├── subdomains_dnsrecords.txt  # DNS record details
│   └── takeover.txt         # Subdomain takeover findings
│
├── webs/                    # Web probing results
│   ├── webs.txt             # [KEY] Live HTTP/HTTPS servers
│   ├── webs_all.txt         # All probed URLs with metadata
│   ├── webs_info.txt        # Detailed web info (title, status, tech)
│   └── url_extract.txt      # Extracted URLs from crawling
│
├── hosts/                   # Host/IP information
│   ├── ips.txt              # [KEY] Resolved IP addresses
│   ├── cdn.txt              # CDN IPs (filtered)
│   ├── portscan_active.txt  # Open ports
│   └── portscan_active.xml  # Nmap XML output
│
├── osint/                   # OSINT results
│   ├── dorks.txt            # Google dork results
│   ├── github_company_secrets.json  # GitHub leaks
│   ├── github_dorks.txt
│   ├── emails.txt           # [KEY] Discovered emails
│   ├── passwords.txt        # Leaked credentials
│   └── metadata_results.txt # Document metadata
│
├── vulns/                   # Vulnerability findings
│   ├── nuclei_output.txt    # Nuclei text output
│   ├── nuclei_output.json   # [KEY] Nuclei JSON (parseable)
│   ├── xss.txt              # XSS vulnerabilities
│   ├── sqli.txt             # SQL injection
│   ├── cors.txt             # CORS misconfigs
│   ├── ssrf.txt             # SSRF findings
│   └── ...                  # Other vuln types
│
├── js/                      # JavaScript analysis
│   ├── js_livelinks.txt     # Found JS files
│   ├── js_secrets.txt       # [KEY] Secrets in JS
│   └── js_endpoints.txt     # API endpoints
│
├── screenshots/             # Web screenshots
│   └── *.png
│
├── fuzzing/                 # Directory fuzzing
│   └── fuzzing_full.txt     # Discovered paths
│
└── hotlist.txt              # [KEY] Priority findings (risk-scored)
```

--------------------------------

### VPS Security Hardening

Source: https://docs.reconftw.com/deployment/deployment

Essential security measures for a VPS, including disabling root SSH login, setting up a firewall, and installing fail2ban.

```bash
# Disable root login
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config

# Setup firewall
sudo ufw allow ssh
sudo ufw enable

# Install fail2ban
sudo apt install fail2ban
sudo systemctl enable fail2ban
```

--------------------------------

### Prepare Scope Files for Enterprise Assessment

Source: https://docs.reconftw.com/guides/case-studies

This setup involves creating text files to define the scope for an enterprise security assessment. `scope-in.txt` includes wildcard subdomains to be scanned, while `scope-out.txt` lists specific subdomains to be excluded from the scan.

```bash
# Create scope files
echo "*.corp.example.com" > scope-in.txt
echo "*.internal.example.com" >> scope-in.txt

echo "vpn.corp.example.com" > scope-out.txt
echo "mail.corp.example.com" >> scope-out.txt
```

--------------------------------

### Start reconFTW Scan in screen

Source: https://docs.reconftw.com/deployment/deployment

Launches a reconFTW scan within a screen session. Detach using Ctrl+A, D and reattach with 'screen -r recon'.

```bash
# Use screen
screen -S recon
./reconftw.sh -d example.com -a

# Detach: Ctrl+A, then D
# Reattach: screen -r recon
```

--------------------------------

### Weekly Scan Configuration

Source: https://docs.reconftw.com/guides/case-studies

Configure ReconFTW for regular monitoring. This example prioritizes passive enumeration, web checks, and critical vulnerability detection, with Slack notifications enabled.

```bash
# weekly.cfg - Balanced for regular monitoring

# Standard enumeration
SUBBRUTE=false          # Passive only for regular scans
SUBPERMUTE=false

# Web checks
WEBPROBESIMPLE=true
SCREENSHOT=true

# Vulnerability focus
NUCLEICHECK=true
NUCLEI_SEVERITY="critical,high"
SUBTAKEOVER=true

# Notifications
SLACK_WEBHOOK="https://hooks.slack.com/services/XXX"
NOTIFY=true
NOTIFY_CONFIG="${tools}/notify-config.yaml"
```

--------------------------------

### Show Help Information

Source: https://docs.reconftw.com/welcome/first-30-minutes

Displays all available command-line flags and options for ReconFTW. Useful for understanding the full range of capabilities.

```bash
./reconftw.sh -h              # Show help
```

--------------------------------

### Create and Use Custom Configuration

Source: https://docs.reconftw.com/configuration/configuration

Copy the default configuration file to a new file, edit it for specific client requirements, and execute the scan using the custom configuration.

```bash
# Create custom config
cp reconftw.cfg client_config.cfg

# Edit for specific client
vim client_config.cfg

# Use custom config
./reconftw.sh -d target.com -r -f client_config.cfg
```

--------------------------------

### Run Docker with Custom Configuration and Environment Variables

Source: https://docs.reconftw.com/getting-started/getting-started

Launches the reconFTW Docker container, mounting custom configuration files and setting environment variables like Shodan API key.

```bash
docker run --rm \
  -v $(pwd)/Recon:/reconftw/Recon \
  -v $(pwd)/my_config.cfg:/reconftw/reconftw.cfg \
  -e SHODAN_API_KEY="your_key" \
  six2dez/reconftw:latest -d example.com -r
```

--------------------------------

### macOS Local Installation Dependencies

Source: https://docs.reconftw.com/deployment/deployment

Installs dependencies using Homebrew for macOS. It also sets up PATH for GNU versions of core utilities.

```bash
# Install Homebrew dependencies
brew install git curl wget python3 go ruby jq coreutils gnu-sed

# Use GNU versions
export PATH="/opt/homebrew/opt/coreutils/libexec/gnubin:$PATH"
export PATH="/opt/homebrew/opt/gnu-sed/libexec/gnubin:$PATH"

# Clone and install
git clone https://github.com/six2dez/reconftw.git
cd reconftw
./install.sh
```

--------------------------------

### Google Dorking Example Queries

Source: https://docs.reconftw.com/modules/osint

Examples of Google dork queries used by the OSINT module to find sensitive files, pages, and information exposure. These queries target specific file types, URL patterns, and titles.

```bash
site:example.com filetype:pdf
site:example.com filetype:sql
site:example.com inurl:admin
site:example.com intitle:"index of"
site:example.com ext:log
```

--------------------------------

### Configure Plugin System

Source: https://docs.reconftw.com/advanced/advanced

Enable and configure the plugin system in the configuration file.

```bash
# In reconftw.cfg
PLUGINS=true
PLUGINS_PATH="$SCRIPTPATH/plugins"
```

--------------------------------

### Configure Axiom Cost Optimization

Source: https://docs.reconftw.com/guides/tuning

Set instance types for cost-effective cloud scanning.

```bash
# Cheapest instances
AXIOM_INSTANCE_TYPE="s-1vcpu-1gb"  # $0.007/hr on DO

# Cost example:
# 10 instances × 2 hours × $0.007 = $0.14 per scan
```

--------------------------------

### Configure API Keys and Tokens

Source: https://docs.reconftw.com/getting-started/getting-started

Set up secrets and GitHub tokens to enable enhanced functionality and avoid rate limiting.

```bash
cp secrets.cfg.example secrets.cfg
chmod 600 secrets.cfg
```

```bash
# API keys for enhanced functionality
SHODAN_API_KEY="your_shodan_api_key"
WHOISXML_API="your_whoisxml_api_key"
XSS_SERVER="your_xss_hunter_server"
COLLAB_SERVER="your_interactsh_server"
```

```bash
ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ghp_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
```

```bash
# Test with a simple scan
./reconftw.sh -d example.com -p --dry-run
```

--------------------------------

### Get Version Information

Source: https://docs.reconftw.com/help/troubleshooting

Commands to retrieve the current version for bug reporting.

```bash
git rev-parse --abbrev-ref HEAD
git describe --tags 2>/dev/null || git rev-parse --short HEAD
```

```bash
cat /etc/os-release
```

--------------------------------

### Set Execution Permissions

Source: https://docs.reconftw.com/help/troubleshooting

Grant execute permissions to the main script and the installation script.

```bash
chmod +x reconftw.sh
chmod +x install.sh
```

--------------------------------

### Stealth Assessment Example

Source: https://docs.reconftw.com/usage/usage

Passive scanning configuration to avoid direct contact with the target.

```bash
# Passive only - no direct contact with target
./reconftw.sh -d target.com -p -q 5
```

--------------------------------

### Configure Cloud Provider Credentials

Source: https://docs.reconftw.com/integrations/axiom

Initialize cloud provider authentication settings.

```bash
# Run axiom configuration
axiom-configure
```

--------------------------------

### Configure webprobe_full

Source: https://docs.reconftw.com/modules/web-analysis

Environment variables for extended port probing.

```bash
WEBPROBEFULL=true
HTTPX_UNCOMMONPORTS_THREADS=100
HTTPX_UNCOMMONPORTS_TIMEOUT=10
UNCOMMON_PORTS_WEB="81,300,591,..."
```

--------------------------------

### Nuclei Sample Output

Source: https://docs.reconftw.com/modules/vulnerabilities

Example JSON output from a Nuclei scan, detailing a critical vulnerability.

```json
{
  "template-id": "CVE-2021-44228",
  "name": "Apache Log4j RCE",
  "severity": "critical",
  "matched-at": "https://api.example.com/search",
  "extracted-results": ["jndi:ldap://..."]
}
```

--------------------------------

### Initialize secrets.cfg

Source: https://docs.reconftw.com/configuration/configuration

Commands to create and secure the secrets configuration file.

```bash
cp secrets.cfg.example secrets.cfg
chmod 600 secrets.cfg  # Restrict permissions
```

--------------------------------

### Key Output: Live Web Servers

Source: https://docs.reconftw.com/guides/data-model

The 'webs.txt' file lists live web servers that respond to HTTP/HTTPS requests after DNS resolution and successful TCP connection.

```bash
https://www.example.com
https://api.example.com
http://staging.example.com:8080
```

--------------------------------

### Key Output: Detailed Web Server Info

Source: https://docs.reconftw.com/guides/data-model

The 'webs_all.txt' file provides detailed information for each probed URL, including status code, page title, server software, and content type.

```bash
https://www.example.com [200] [Example Corp] [nginx/1.18] [text/html]
https://api.example.com [401] [API Gateway] [kong/2.5] [application/json]
```

--------------------------------

### Pre-Scan Authorization Checklist

Source: https://docs.reconftw.com/guides/opsec-legal

A template for documenting legal authorization and technical configuration before starting a scan.

```markdown
## Pre-Scan Authorization Checklist

### Legal Authorization
- [ ] Written permission from asset owner (email, contract, or bug bounty policy)
- [ ] Scope document clearly defines in-scope assets
- [ ] Out-of-scope assets are documented and excluded
- [ ] Testing window defined (if applicable)
- [ ] Rate limits agreed upon (if any)

### Technical Preparation
- [ ] Scope file created (`-i inscope.txt`)
- [ ] Exclusions configured (`-x outofscope.txt`)
- [ ] Rate limits set appropriately
- [ ] VPS/cloud instance ready (recommended)

### Communication
- [ ] Emergency contact identified
- [ ] Reporting channel established
- [ ] NDA signed (if required)
```

--------------------------------

### Build and Use Custom Axiom Images

Source: https://docs.reconftw.com/integrations/axiom

Create a custom image with all necessary tools and set it for use in scans.

```bash
# Build custom image with all tools
axiom-build reconftw --install-tools

# Use custom image
AXIOM_IMAGE="reconftw-image"
```

--------------------------------

### Automated Weekly Monitoring

Source: https://docs.reconftw.com/understanding-reconftw/concepts

Examples for scheduling recurring scans using cron jobs or Docker containers.

```bash
# Cron job (every Sunday at 2 AM)
0 2 * * 0 cd /path/to/reconftw && ./reconftw.sh -d target.com -r --incremental -z

# Or use Docker
0 2 * * 0 docker run -v /data/recon:/reconftw/Recon six2dez/reconftw -d target.com -r --incremental
```

--------------------------------

### Configure Fleet Instances

Source: https://docs.reconftw.com/integrations/axiom

Define hardware and regional parameters for cloud instances.

```bash
# Fleet instance settings
AXIOM_INSTANCE_TYPE="s-1vcpu-1gb"  # DigitalOcean size
AXIOM_REGION="nyc1"                # Deployment region
AXIOM_IMAGE="axiom-default"        # Base image name
```

--------------------------------

### Automate Weekly Scans via Cron

Source: https://docs.reconftw.com/guides/case-studies

Setup for scheduling automated scans using cron jobs.

```bash
# /etc/cron.d/reconftw-weekly
0 2 * * 0 /opt/reconftw/scripts/weekly_scan.sh
```

```bash
#!/bin/bash
```

--------------------------------

### Configure screenshot module

Source: https://docs.reconftw.com/modules/web-analysis

Enable the web screenshot capture feature.

```bash
WEBSCREENSHOT=true
```

--------------------------------

### Reset Go Proxy Settings

Source: https://docs.reconftw.com/help/troubleshooting

Fix module installation failures by resetting the Go proxy to the default value.

```bash
# Check Go proxy settings
go env GOPROXY

# Reset to default
go env -w GOPROXY=https://proxy.golang.org,direct

# Retry installation
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
```

--------------------------------

### Run reconFTW with Docker

Source: https://docs.reconftw.com/deployment/deployment

Pulls the latest Docker image and runs a scan, mounting local directories for output and configuration.

```bash
# Pull latest image
docker pull six2dez/reconftw:latest

# Run scan
docker run -it --rm \
  -v $(pwd)/Recon:/reconftw/Recon \
  -v $(pwd)/reconftw.cfg:/reconftw/reconftw.cfg \
  -v $(pwd)/secrets.cfg:/reconftw/secrets.cfg \
  six2dez/reconftw:latest \
  -d example.com -r
```

--------------------------------

### Configure webprobe_simple

Source: https://docs.reconftw.com/modules/web-analysis

Environment variables for standard port probing (80, 443).

```bash
WEBPROBESIMPLE=true
HTTPX_THREADS=50
HTTPX_RATELIMIT=150
HTTPX_TIMEOUT=10
HTTPX_FLAGS=" -follow-redirects -random-agent -status-code -silent -title -web-server -tech-detect -location -content-length"
```

--------------------------------

### XSS Sample Output

Source: https://docs.reconftw.com/modules/vulnerabilities

Example output from an XSS scan, showing the vulnerable URL, type, parameter, and payload.

```text
[POC] https://example.com/search?q="><script>alert(1)</script>
  Type: Reflected
  Parameter: q
  Payload: "><script>alert(1)</script>
```

--------------------------------

### Configure Checkpoint System

Source: https://docs.reconftw.com/advanced/advanced

Enable the checkpoint system and specify the directory for markers in the configuration file.

```bash
USE_CHECKPOINT=true      # Enable checkpoint system
CHECKPOINT_DIR=".called_fn"
```

--------------------------------

### Configure macOS GNU Tools

Source: https://docs.reconftw.com/help/troubleshooting

Install and configure GNU core utilities to replace default BSD tools on macOS.

```bash
# Install GNU tools
brew install coreutils gnu-sed findutils grep

# Add to PATH (add to ~/.zshrc or ~/.bashrc)
export PATH="/opt/homebrew/opt/coreutils/libexec/gnubin:$PATH"
export PATH="/opt/homebrew/opt/gnu-sed/libexec/gnubin:$PATH"
export PATH="/opt/homebrew/opt/findutils/libexec/gnubin:$PATH"
export PATH="/opt/homebrew/opt/grep/libexec/gnubin:$PATH"
```

--------------------------------

### Configure Token Files

Source: https://docs.reconftw.com/configuration/configuration

Paths to files containing lists of GitHub and GitLab tokens.

```bash
# GitHub tokens (one per line for rate limit distribution)
GITHUB_TOKENS=${tools}/.github_tokens

# GitLab tokens
GITLAB_TOKENS=${tools}/.gitlab_tokens
```

--------------------------------

### ReconFTW Passive Mode Example

Source: https://docs.reconftw.com/understanding-reconftw/recon-methodology

Use this command to run reconFTW in passive mode, which avoids direct interaction with the target.

```bash
./reconftw.sh -d target.com -p
```

--------------------------------

### Generate AI-Powered Reports

Source: https://docs.reconftw.com/usage/usage

Enable AI report generation with the -y flag. Requires local AI model setup.

```bash
./reconftw.sh -d example.com -r -y
```

--------------------------------

### Docker Compose Configuration for reconFTW

Source: https://docs.reconftw.com/deployment/deployment

Defines a Docker Compose setup for reconFTW, specifying image, volumes, and command arguments.

```yaml
version: '3.8'

services:
  reconftw:
    image: six2dez/reconftw:latest
    container_name: reconftw
    volumes:
      - ./Recon:/reconftw/Recon
      - ./reconftw.cfg:/reconftw/reconftw.cfg
      - ./secrets.cfg:/reconftw/secrets.cfg
      - ./wordlists:/reconftw/wordlists
    environment:
      - TERM=xterm-256color
    stdin_open: true
    tty: true
    command: ["-d", "example.com", "-r"]
```

--------------------------------

### Create Plugins

Source: https://docs.reconftw.com/advanced/advanced

Define hooks and register plugins to extend functionality after specific scan stages.

```bash
# plugins/my-plugin.sh
#!/bin/bash

# Hook: after_subdomains
plugin_after_subdomains() {
    echo "[PLUGIN] Processing subdomains..."
    # Custom post-processing
}

# Hook: after_scan
plugin_after_scan() {
    echo "[PLUGIN] Scan completed, generating custom report..."
    # Custom reporting
}

# Register plugin
plugins_register "my-plugin" "after_subdomains,after_scan"
```

--------------------------------

### Download Recommended Wordlists

Source: https://docs.reconftw.com/guides/tuning

Commands to fetch external wordlist repositories.

```bash
# Download optimized wordlists
# SecLists
git clone https://github.com/danielmiessler/SecLists.git ~/wordlists

# Assetnote
wget https://wordlists-cdn.assetnote.io/data/manual/best-dns-wordlist.txt
```

--------------------------------

### Define API Keys and Tokens

Source: https://docs.reconftw.com/configuration/configuration

Environment variables for API keys and callback servers.

```bash
# Shodan API for passive port scanning
SHODAN_API_KEY="your_shodan_api_key"

# WhoisXML API for domain lookups
WHOISXML_API="your_whoisxml_api_key"

# Blind XSS callback server
XSS_SERVER="https://your.xss.hunter"

# SSRF/OOB callback server
COLLAB_SERVER="https://your.interact.sh"

# Slack notifications
slack_channel="C0XXXXXXXXX"
slack_auth="xoxb-xxxxx-xxxxx-xxxxx"
```

--------------------------------

### Resume Interrupted Scan

Source: https://docs.reconftw.com/welcome/first-30-minutes

If a scan is interrupted, simply re-run the same command with the '-r' flag to continue from where it left off. No special setup is required.

```bash
# Run the same command again - it continues from where it stopped
./reconftw.sh -d example.com -r
```

--------------------------------

### Configure Custom Wordlists

Source: https://docs.reconftw.com/advanced/advanced

Define paths for custom wordlists in the configuration file.

```bash
# In reconftw.cfg

# Custom subdomain wordlists
subs_wordlist="$SCRIPTPATH/wordlists/custom_subdomains.txt"
subs_wordlist_big="$SCRIPTPATH/wordlists/custom_subdomains_big.txt"

# Custom directory wordlists
fuzz_wordlist="$SCRIPTPATH/wordlists/custom_dirs.txt"

# Optional vuln-specific wordlists
lfi_wordlist="$SCRIPTPATH/wordlists/custom_lfi.txt"
ssti_wordlist="$SCRIPTPATH/wordlists/custom_ssti.txt"
```

--------------------------------

### Probe live hosts with httpx

Source: https://docs.reconftw.com/tools-reference/tools

Probes for live hosts and extracts metadata. Configuration variables define performance limits.

```bash
cat subdomains.txt | httpx -ports 80,443,8080 -title -tech-detect
```

```bash
HTTPX_THREADS=50
HTTPX_RATELIMIT=150
HTTPX_TIMEOUT=10
```

--------------------------------

### ReconFTW Lifecycle Functions

Source: https://docs.reconftw.com/understanding-reconftw/concepts

Provides functions for managing the lifecycle of scan functions, including starting and ending them, and checking if they have already been executed.

```bash
start_func(name, description)  # Begin a function, check if already done
end_func(message, name)        # Complete a function, mark as done

```

```bash
function some_scan() {
    if [[ ! -f "$called_fn_dir/.${FUNCNAME[0]}" ]] || [[ $DIFF == true ]]; then
        start_func "${FUNCNAME[0]}" "Running some scan..."
        
        # ... actual scan logic ...
        
        end_func "Results saved in..." "${FUNCNAME[0]}"
    fi
}

```

--------------------------------

### Asset Tracking Settings

Source: https://docs.reconftw.com/configuration/configuration

Configure asset tracking, including appending to assets.jsonl, quick rescan options, chunk limits, and highlighting top risky assets.

```bash
ASSET_STORE=true                     # Append to assets.jsonl
QUICK_RESCAN=false                   # Skip heavy steps if no new assets
CHUNK_LIMIT=2000                     # Split large lists
HOTLIST_TOP=50                       # Top risky assets to highlight
```

--------------------------------

### Configure GitHub Repository Scanning

Source: https://docs.reconftw.com/modules/osint

Set environment variables to enable GitHub repository analysis and specify the path to your GitHub tokens file. Ensure tokens have 'read:org' and 'repo' scopes.

```bash
GITHUB_DORKS=true
GITHUB_REPOS=true

# Token file path
GITHUB_TOKENS=${tools}/.github_tokens
```

--------------------------------

### Use Custom Configuration File

Source: https://docs.reconftw.com/usage/usage

Specify a custom configuration file using the -f flag to override default settings.

```bash
# Create custom config
cp reconftw.cfg custom_config.cfg
# Edit custom_config.cfg...

# Use custom config
./reconftw.sh -d example.com -r -f custom_config.cfg
```

--------------------------------

### Reading Nuclei JSON Output

Source: https://docs.reconftw.com/output/output

Example of a Nuclei JSON output structure. Useful for understanding the data format collected by Nuclei scans.

```json
{
  "template-id": "cve-2021-44228-log4j-rce",
  "info": {
    "name": "Apache Log4j2 RCE (CVE-2021-44228)",
    "severity": "critical",
    "description": "Apache Log4j2 allows remote code execution...",
    "reference": ["https://nvd.nist.gov/vuln/detail/CVE-2021-44228"],
    "tags": ["cve", "cve2021", "rce", "log4j", "apache"]
  },
  "type": "http",
  "host": "https://api.example.com",
  "matched-at": "https://api.example.com/api/v1/log",
  "extracted-results": ["dns-callback-received"],
  "curl-command": "curl -X POST ...",
  "timestamp": "2023-06-15T10:30:45.123456789Z"
}
```

--------------------------------

### Build Custom Docker Image for reconFTW

Source: https://docs.reconftw.com/getting-started/getting-started

Builds a custom Docker image for reconFTW from the Dockerfile located in the 'Docker' subdirectory.

```bash
cd reconftw/Docker
docker build -t my-reconftw .

```

--------------------------------

### Enable Distributed Scanning with Axiom

Source: https://docs.reconftw.com/usage/usage

Use the -v flag to enable distributed scanning via Axiom. Requires prior installation and fleet configuration.

```bash
./reconftw.sh -d example.com -r -v
```

--------------------------------

### Deploy reconFTW using Terraform and Ansible

Source: https://docs.reconftw.com/getting-started/getting-started

Initializes Terraform, applies the configuration to deploy infrastructure (e.g., on AWS), and then runs an Ansible playbook to set up reconFTW.

```bash
cd reconftw/Terraform

# Configure your AWS credentials
export AWS_ACCESS_KEY_ID="your_key"
export AWS_SECRET_ACCESS_KEY="your_secret"

# Deploy infrastructure
terraform init
terraform apply

# Run Ansible playbook
ansible-playbook -i inventory reconFTW.yml
```

--------------------------------

### Run Health Check and Reconnaissance

Source: https://docs.reconftw.com/usage/usage

Execute a system health check before starting a full reconnaissance scan on a target domain. Requires the script to be executable.

```bash
./reconftw.sh --health-check && ./reconftw.sh -d target.com -r -z
```

--------------------------------

### Run Passive Reconnaissance

Source: https://docs.reconftw.com/welcome/first-30-minutes

Initiates a safe and fast passive reconnaissance scan. This is a good starting point for initial discovery without direct interaction.

```bash
# Passive (safe, fast)
./reconftw.sh -d target.com -p
```

--------------------------------

### Configure Callback Servers

Source: https://docs.reconftw.com/modules/vulnerabilities

Set the interactsh URL and optional token in the configuration file to enable detection for blind vulnerabilities.

```bash
INTERACTSH_URL="https://interact.sh"
INTERACTSH_TOKEN=""  # Optional, for private server
```

--------------------------------

### Run reconFTW Docker Image in Interactive Mode

Source: https://docs.reconftw.com/getting-started/getting-started

Starts an interactive shell within the reconFTW Docker container, allowing for manual command execution.

```bash
docker run -it --rm -v $(pwd)/Recon:/reconftw/Recon six2dez/reconftw:latest /bin/bash
```

--------------------------------

### Module Execution Order in ReconFTW

Source: https://docs.reconftw.com/modules/05-modules

Illustrates the sequential execution order of ReconFTW modules during a full scan, showing how each module builds upon the previous one's output.

```text
1. OSINT          → Intelligence gathering
2. Subdomains     → Asset discovery  
3. Hosts          → Infrastructure analysis
4. Web Analysis   → Application mapping
5. Vulnerabilities → Security testing
```

--------------------------------

### Create GitHub Tokens File

Source: https://docs.reconftw.com/modules/osint

Create a file containing GitHub personal access tokens, with one token per line. Secure the file with read/write permissions for the owner only.

```bash
# Create file with one token per line
cat > ~/Tools/.github_tokens << EOF
ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ghp_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy
EOF

# Secure permissions
chmod 600 ~/Tools/.github_tokens
```

--------------------------------

### Configure gRPC Reflection Probing

Source: https://docs.reconftw.com/modules/web-analysis

Enable gRPC reflection scanning by setting GRPC_SCAN to true. Note that this feature is disabled by default and requires grpcurl to be installed.

```bash
GRPC_SCAN=false    # Disabled by default (requires grpcurl)
```

--------------------------------

### Running Long Scans with tmux on VPS

Source: https://docs.reconftw.com/deployment/deployment

Installs and uses tmux on a VPS to manage long-running reconFTW scans, ensuring sessions persist even if disconnected.

```bash
# Use tmux for persistent sessions
sudo apt install tmux
tmux new -s recon
```
Tokens:
Raw