Recon-ng Web reconnaissance Framework aide-mémoire

📋 Copy All commandes 📄 Generate PDF

Overview

Recon-ng is a full-featured web reconnaissance framework written in Python. It provides a powerful environment for conducting open source web-based reconnaissance quickly and thoroughly. The framework features independent modules, database interaction, built-in convenience functions, interactive help, and commande completion. It's designed to be modular, allowing users to easily add custom modules and extend functionality.

⚠️ Legal Notice: Only use Recon-ng on cibles you own or have explicit permission to test. Unauthorized reconnaissance may violate terms of service and local laws.

Installation

Kali Linux Installation

# Recon-ng is pre-installed on Kali Linux
recon-ng --help

# Update to latest version
sudo apt update
sudo apt install recon-ng

# Alternative: Install from GitHub
git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng
pip3 install -r REQUIREMENTS

Ubuntu/Debian Installation

# Install dependencies
sudo apt update
sudo apt install python3 python3-pip git

# Clone repository
git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng

# Install Python dependencies
pip3 install -r REQUIREMENTS

# Make executable
chmod +x recon-ng

# Create symlink for global access
sudo ln -s $(pwd)/recon-ng /usr/local/bin/recon-ng

Docker Installation

# Pull official Docker image
docker pull lanmaster53/recon-ng

# Run with Docker
docker run -it --rm lanmaster53/recon-ng

# Build from source
git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng
docker build -t recon-ng .

# Run custom build with volume mount
docker run -it --rm -v $(pwd)/data:/recon-ng/data recon-ng

Python Virtual Environment

# Create virtual environment
python3 -m venv recon-ng-env
source recon-ng-env/bin/activate

# Clone and install
git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng
pip install -r REQUIREMENTS

# Run Recon-ng
python3 recon-ng

Basic utilisation

Starting Recon-ng

# Start interactive mode
recon-ng

# Start with specific workspace
recon-ng -w workspace_name

# Run specific module
recon-ng -m recon/domains-hôtes/hackercible

# Execute commandes from file
recon-ng -r commandes.txt

# Show version and exit
recon-ng --version

Core commandes

# Help system
help
help modules
help <commande>

# Workspace management
workspaces list
workspaces create <name>
workspaces select <name>
workspaces delete <name>

# Module management
modules search
modules search <cléword>
modules load <module>
modules reload

# Database operations
db schema
db query <sql>
db insert <table> <data>
db delete <table> <conditions>

Workspace Management

Creating and Managing Workspaces

# List available workspaces
[recon-ng][default] > workspaces list

# Create new workspace
[recon-ng][default] > workspaces create exemple_com

# Select workspace
[recon-ng][default] > workspaces select exemple_com

# Show current workspace
[recon-ng][exemple_com] > workspaces list

# Delete workspace
[recon-ng][exemple_com] > workspaces delete old_workspace

Database Schema

# View database schema
[recon-ng][exemple_com] > db schema

# Common tables:
# - domains: cible domains
# - hôtes: Discovered hôtes/IPs
# - contacts: Email addresses and contacts
# - identifiants: Found identifiants
# - leaks: Data breach information
# - locations: Geographic information
# - netblocks: IP ranges
# - ports: Open ports
# - profiles: Social media profiles
# - repositories: Code repositories
# - vulnerabilities: Security vulnerabilities

Manual Data Entry

# Add domain
[recon-ng][exemple_com] > db insert domains exemple.com

# Add hôte
[recon-ng][exemple_com] > db insert hôtes 192.168.1.1 exemple.com

# Add contact
[recon-ng][exemple_com] > db insert contacts John Doe john.doe@exemple.com

# View data
[recon-ng][exemple_com] > show domains
[recon-ng][exemple_com] > show hôtes
[recon-ng][exemple_com] > show contacts

Module System

Module Categories

# Discovery modules
modules search discovery

# exploitation modules
modules search exploit

# Import modules
modules search import

# Recon modules
modules search recon

# Reporting modules
modules search reporting

Loading and Using Modules

# Load a module
[recon-ng][exemple_com] > modules load recon/domains-hôtes/hackercible

# Show module info
[recon-ng][exemple_com][hackercible] > info

# Show module options
[recon-ng][exemple_com][hackercible] > options list

# Set module options
[recon-ng][exemple_com][hackercible] > options set SOURCE exemple.com

# Run module
[recon-ng][exemple_com][hackercible] > run

# Go back to main menu
[recon-ng][exemple_com][hackercible] > back

Popular reconnaissance Modules

# DNS énumération
modules load recon/domains-hôtes/hackercible
modules load recon/domains-hôtes/threatcrowd
modules load recon/domains-hôtes/certificat_transparency

# Subdomain discovery
modules load recon/domains-hôtes/google_site_web
modules load recon/domains-hôtes/bing_domain_web
modules load recon/domains-hôtes/netcraft

# hôte énumération
modules load recon/hôtes-hôtes/resolve
modules load recon/hôtes-ports/shodan_hôtename
modules load recon/netblocks-hôtes/shodan_net

# Contact harvesting
modules load recon/domains-contacts/whois_pocs
modules load recon/domains-contacts/metacrawler
modules load recon/contacts-contacts/fullcontact

# Social media profiling
modules load recon/profiles-profiles/twitter
modules load recon/contacts-profiles/fullcontact

API clé Management

Setting Up API clés

# Show required API clés
[recon-ng][exemple_com] > clés list

# Add API clé
[recon-ng][exemple_com] > clés add shodan_api <your_api_clé>
[recon-ng][exemple_com] > clés add google_api <your_api_clé>
[recon-ng][exemple_com] > clés add bing_api <your_api_clé>

# Remove API clé
[recon-ng][exemple_com] > clés remove shodan_api

# Show configured clés
[recon-ng][exemple_com] > clés list

Common API services

# Shodan (for hôte/port information)
clés add shodan_api <shodan_api_clé>

# Google Custom Search (for web searches)
clés add google_api <google_api_clé>
clés add google_cse <custom_search_engine_id>

# Bing Search API
clés add bing_api <bing_api_clé>

# FullContact (for contact information)
clés add fullcontact_api <fullcontact_api_clé>

# Hunter.io (for email discovery)
clés add hunter_api <hunter_api_clé>

# SecurityTrails (for DNS data)
clés add securitytrails_api <securitytrails_api_clé>

# VirusTotal (for domain/IP reputation)
clés add virustotal_api <virustotal_api_clé>

Advanced reconnaissance Workflows

Domain reconnaissance Workflow

#!/bin/bash
# recon-ng-domain-workflow.sh

DOMAIN="$1"
WORKSPACE="$2"

if [ $# -ne 2 ]; then
    echo "utilisation: $0 <domain> <workspace>"
    exit 1
fi

# Create Recon-ng resource script
cat > domain_recon.rc << EOF
workspaces create $WORKSPACE
workspaces select $WORKSPACE
db insert domains $DOMAIN

# DNS énumération
modules load recon/domains-hôtes/hackercible
options set SOURCE $DOMAIN
run

modules load recon/domains-hôtes/threatcrowd
options set SOURCE $DOMAIN
run

modules load recon/domains-hôtes/certificat_transparency
options set SOURCE $DOMAIN
run

# Subdomain discovery
modules load recon/domains-hôtes/google_site_web
options set SOURCE $DOMAIN
run

modules load recon/domains-hôtes/bing_domain_web
options set SOURCE $DOMAIN
run

# Contact harvesting
modules load recon/domains-contacts/whois_pocs
options set SOURCE $DOMAIN
run

modules load recon/domains-contacts/metacrawler
options set SOURCE $DOMAIN
run

# hôte resolution
modules load recon/hôtes-hôtes/resolve
run

# scan de ports (if Shodan API available)
modules load recon/hôtes-ports/shodan_hôtename
run

# Generate report
modules load reporting/html
options set FILENAME $WORKSPACE_report.html
run

show domains
show hôtes
show contacts
EOF

echo "Running Recon-ng domain reconnaissance for $DOMAIN"
recon-ng -r domain_recon.rc

Company Intelligence Gathering

# Create company intelligence script
cat > company_recon.rc << 'EOF'
workspaces create company_intel
workspaces select company_intel

# Add company domain
db insert domains company.com

# Employee énumération
modules load recon/domains-contacts/whois_pocs
options set SOURCE company.com
run

modules load recon/domains-contacts/metacrawler
options set SOURCE company.com
run

# Social media profiling
modules load recon/contacts-profiles/fullcontact
run

modules load recon/profiles-profiles/twitter
run

# Technology stack identification
modules load recon/domains-hôtes/hackercible
options set SOURCE company.com
run

# Infrastructure discovery
modules load recon/hôtes-ports/shodan_hôtename
run

modules load recon/netblocks-hôtes/shodan_net
run

# Generate comprehensive report
modules load reporting/html
options set FILENAME company_intelligence.html
run

show summary
EOF

Automated reconnaissance Script

#!/usr/bin/env python3
# automated-recon.py

import subprocessus
import json
import time
import os

class ReconNGAutomation:
    def __init__(self, workspace_name):
        self.workspace = workspace_name
        self.results = \\\\{\\\\}

    def create_workspace(self):
        """Create and select workspace"""
        commandes = [
            f"workspaces create \\\\{self.workspace\\\\}",
            f"workspaces select \\\\{self.workspace\\\\}"
        ]
        return commandes

    def add_domains(self, domains):
        """Add domains to workspace"""
        commandes = []
        for domain in domains:
            commandes.append(f"db insert domains \\\\{domain\\\\}")
        return commandes

    def run_reconnaissance_modules(self, cible_type="domains"):
        """Run reconnaissance modules based on cible type"""
        modules = \\\\{
            "domains": [
                "recon/domains-hôtes/hackercible",
                "recon/domains-hôtes/threatcrowd",
                "recon/domains-hôtes/certificat_transparency",
                "recon/domains-hôtes/google_site_web",
                "recon/domains-contacts/whois_pocs"
            ],
            "hôtes": [
                "recon/hôtes-hôtes/resolve",
                "recon/hôtes-ports/shodan_hôtename"
            ],
            "contacts": [
                "recon/contacts-profiles/fullcontact",
                "recon/contacts-contacts/fullcontact"
            ]
        \\\\}

        commandes = []
        for module in modules.get(cible_type, []):
            commandes.extend([
                f"modules load \\\\{module\\\\}",
                "run",
                "back"
            ])

        return commandes

    def generate_reports(self):
        """Generate various reports"""
        commandes = [
            "modules load reporting/html",
            f"options set FILENAME \\\\{self.workspace\\\\}_report.html",
            "run",
            "back",
            "modules load reporting/json",
            f"options set FILENAME \\\\{self.workspace\\\\}_data.json",
            "run",
            "back"
        ]
        return commandes

    def create_resource_script(self, domains, output_file="auto_recon.rc"):
        """Create complete resource script"""
        all_commandes = []

        # Setup workspace
        all_commandes.extend(self.create_workspace())

        # Add domains
        all_commandes.extend(self.add_domains(domains))

        # Run reconnaissance
        all_commandes.extend(self.run_reconnaissance_modules("domains"))
        all_commandes.extend(self.run_reconnaissance_modules("hôtes"))
        all_commandes.extend(self.run_reconnaissance_modules("contacts"))

        # Generate reports
        all_commandes.extend(self.generate_reports())

        # Add summary commandes
        all_commandes.extend([
            "show domains",
            "show hôtes",
            "show contacts",
            "show profiles"
        ])

        # Write to file
        with open(output_file, 'w') as f:
            for commande in all_commandes:
                f.write(commande + '\n')

        return output_file

    def run_automation(self, domains):
        """Run complete automation"""
        script_file = self.create_resource_script(domains)

        print(f"Running automated reconnaissance for \\\\{len(domains)\\\\} domains")
        print(f"Workspace: \\\\{self.workspace\\\\}")
        print(f"Script: \\\\{script_file\\\\}")

        try:
            result = subprocessus.run(
                ['recon-ng', '-r', script_file],
                capture_output=True,
                text=True,
                timeout=3600  # 1 hour timeout
            )

            if result.returncode == 0:
                print("reconnaissance completed successfully")
                self.parse_results()
            else:
                print(f"Error: \\\\{result.stderr\\\\}")

        except subprocessus.TimeoutExpired:
            print("reconnaissance timed out")
        except Exception as e:
            print(f"Error running reconnaissance: \\\\{e\\\\}")

    def parse_results(self):
        """Parse and summarize results"""
        json_file = f"\\\\{self.workspace\\\\}_data.json"

        if os.path.exists(json_file):
            try:
                with open(json_file, 'r') as f:
                    data = json.load(f)

                print("\n=== reconnaissance Summary ===")
                for table, records in data.items():
                    if records:
                        print(f"\\\\{table.title()\\\\}: \\\\{len(records)\\\\} found")

                        # Show sample data
                        if len(records) > 0:
                            sample = records[0]
                            print(f"  Sample: \\\\{sample\\\\}")

            except Exception as e:
                print(f"Error parsing results: \\\\{e\\\\}")

def main():
    import sys

    if len(sys.argv) < 3:
        print("utilisation: python3 automated-recon.py <workspace> <domain1> [domain2] ...")
        sys.exit(1)

    workspace = sys.argv[1]
    domains = sys.argv[2:]

    automation = ReconNGAutomation(workspace)
    automation.run_automation(domains)

if __name__ == "__main__":
    main()

Database Operations

Advanced Queries

# Custom SQL queries
[recon-ng][exemple_com] > db query SELECT * FROM domains WHERE domain LIKE '%.exemple.com'

# Count records
[recon-ng][exemple_com] > db query SELECT COUNT(*) FROM hôtes

# Join tables
[recon-ng][exemple_com] > db query SELECT d.domain, h.ip_address FROM domains d JOIN hôtes h ON d.domain = h.hôte

# Export data
[recon-ng][exemple_com] > db query SELECT * FROM contacts WHERE email LIKE '%@exemple.com'

Data Import/Export

# Import from CSV
modules load import/csv_file
options set FILENAME contacts.csv
options set TABLE contacts
run

# Import from Nmap XML
modules load import/nmap
options set FILENAME nmap_scan.xml
run

# Export to various formats
modules load reporting/csv
options set FILENAME export.csv
run

modules load reporting/json
options set FILENAME export.json
run

modules load reporting/xml
options set FILENAME export.xml
run

Database Backup and Restore

# Backup workspace database
cp ~/.recon-ng/workspaces/exemple_com/data.db backup_exemple_com.db

# Restore workspace database
cp backup_exemple_com.db ~/.recon-ng/workspaces/exemple_com/data.db

# Export workspace data
[recon-ng][exemple_com] > modules load reporting/json
[recon-ng][exemple_com][json] > options set FILENAME full_backup.json
[recon-ng][exemple_com][json] > run

Custom Module Development

Module Template

#!/usr/bin/env python3
# custom_module.py

from recon.core.module import BaseModule

class Module(BaseModule):

    meta = \\\\{
        'name': 'Custom reconnaissance Module',
        'author': 'Your Name ``<your.email@exemple.com>``',
        'version': '1.0',
        'Description': 'Description of what the module does',
        'required_clés': ['api_clé'],
        'dependencies': ['requests'],
        'files': [],
        'options': (
            ('source', None, True, 'source of input (see \'show info\' for details)'),
            ('limit', 100, False, 'limit number of results'),
        ),
    \\\\}

    def module_run(self, sources):
        """Main module execution"""
        for source in sources:
            self.heading(f"processusing: \\\\{source\\\\}", level=0)

            # Your reconnaissance logic here
            results = self.custom_recon_function(source)

            # processus results
            for result in results:
                self.insert_hôtes(
                    hôte=result['hôte'],
                    ip_address=result['ip'],
                    region=result.get('region'),
                    country=result.get('country')
                )

    def custom_recon_function(self, cible):
        """Custom reconnaissance function"""
        # Implement your reconnaissance logic
        # Return list of dictionaries with results
        results = []

        try:
            # exemple API call or data processusing
            response = self.request('GET', f'https://api.exemple.com/lookup/\\\\{cible\\\\}')
            data = response.json()

            for item in data.get('results', []):
                results.append(\\\\{
                    'hôte': item['hôtename'],
                    'ip': item['ip_address'],
                    'region': item.get('region'),
                    'country': item.get('country')
                \\\\})

        except Exception as e:
            self.error(f"Error processusing \\\\{cible\\\\}: \\\\{e\\\\}")

        return results

Installing Custom Modules

# Copy module to modules directory
cp custom_module.py ~/.recon-ng/modules/recon/domains-hôtes/

# Reload modules
[recon-ng][exemple_com] > modules reload

# Load custom module
[recon-ng][exemple_com] > modules load recon/domains-hôtes/custom_module

# Use custom module
[recon-ng][exemple_com][custom_module] > options set SOURCE exemple.com
[recon-ng][exemple_com][custom_module] > run

Integration with Other Tools

Nmap Integration

#!/bin/bash
# recon-ng-nmap-integration.sh

WORKSPACE="$1"
NMAP_OUTPUT="nmap_results.xml"

if [ $# -ne 1 ]; then
    echo "utilisation: $0 <workspace>"
    exit 1
fi

# Export hôtes from Recon-ng
cat > export_hôtes.rc << EOF
workspaces select $WORKSPACE
db query SELECT DISTINCT ip_address FROM hôtes WHERE ip_address IS NOT NULL
EOF

# Get IP addresses
| recon-ng -r export_hôtes.rc | grep -oE '([0-9]\\\\{1,3\\\\}\.)\\\\{3\\\\}[0-9]\\\\{1,3\\\\}' | sort -u > ips.txt |

if [ -s ips.txt ]; then
    echo "Scanning $(wc -l < ips.txt) IP addresses with Nmap"

    # Run Nmap scan
    nmap -sS -sV -O -oX "$NMAP_OUTPUT" -iL ips.txt

    # Import results back to Recon-ng
    cat > import_nmap.rc << EOF
workspaces select $WORKSPACE
modules load import/nmap
options set FILENAME $NMAP_OUTPUT
run
EOF

    recon-ng -r import_nmap.rc
    echo "Nmap results imported to Recon-ng workspace: $WORKSPACE"
else
    echo "No IP addresses found in workspace"
fi

Metasploit Integration

#!/bin/bash
# recon-ng-metasploit-integration.sh

WORKSPACE="$1"
MSF_WORKSPACE="$2"

if [ $# -ne 2 ]; then
    echo "utilisation: $0 <recon_workspace> <msf_workspace>"
    exit 1
fi

# Export data from Recon-ng
cat > export_data.rc << EOF
workspaces select $WORKSPACE
modules load reporting/json
options set FILENAME recon_data.json
run
EOF

recon-ng -r export_data.rc

# Create Metasploit resource script
python3 << 'PYTHON_SCRIPT'
import json
import sys

try:
    with open('recon_data.json', 'r') as f:
        data = json.load(f)

    with open('metasploit_import.rc', 'w') as f:
        f.write(f"workspace -a \\\\{sys.argv[1]\\\\}\n")
        f.write(f"workspace \\\\{sys.argv[1]\\\\}\n\n")

        # Import hôtes
        if 'hôtes' in data:
            for hôte in data['hôtes']:
                if hôte.get('ip_address'):
                    f.write(f"hôtes -a \\\\{hôte['ip_address']\\\\}")
                    if hôte.get('hôte'):
                        f.write(f" -n \\\\{hôte['hôte']\\\\}")
                    f.write("\n")

        # Import services/ports
        if 'ports' in data:
            for port in data['ports']:
                if port.get('ip_address') and port.get('port'):
                    f.write(f"services -a -p \\\\{port['port']\\\\}")
                    if port.get('protocole'):
                        f.write(f" -s \\\\{port['protocole']\\\\}")
                    f.write(f" \\\\{port['ip_address']\\\\}\n")

        # Add notes for contacts
        if 'contacts' in data:
            for contact in data['contacts']:
                if contact.get('email'):
                    f.write(f"notes -a -t email -d \"\\\\{contact['email']\\\\}\"")
                    if contact.get('first_name') and contact.get('last_name'):
                        f.write(f" -n \"\\\\{contact['first_name']\\\\} \\\\{contact['last_name']\\\\}\"")
                    f.write("\n")

        f.write("\nworkspace\nhôtes\nservices\nnotes\n")

    print("Metasploit resource script created: metasploit_import.rc")
    print(f"Run with: msfconsole -r metasploit_import.rc")

except Exception as e:
    print(f"Error: \\\\{e\\\\}")
PYTHON_SCRIPT "$MSF_WORKSPACE"

OSINT Framework Integration

#!/usr/bin/env python3
# osint-framework-integration.py

import json
import requests
import subprocessus
from pathlib import Path

class OSINTFrameworkIntegration:
    def __init__(self, workspace):
        self.workspace = workspace
        self.results = \\\\{\\\\}

    def export_recon_data(self):
        """Export data from Recon-ng workspace"""
        script_content = f"""
workspaces select \\\\{self.workspace\\\\}
modules load reporting/json
options set FILENAME osint_export.json
run
"""

        with open('export_script.rc', 'w') as f:
            f.write(script_content)

        try:
            subprocessus.run(['recon-ng', '-r', 'export_script.rc'], check=True)

            with open('osint_export.json', 'r') as f:
                self.results = json.load(f)

            return True
        except Exception as e:
            print(f"Error exporting data: \\\\{e\\\\}")
            return False

    def run_additional_osint(self):
        """Run additional Outil OSINTs on discovered data"""
        if 'domains' in self.results:
            for domain_record in self.results['domains']:
                domain = domain_record.get('domain')
                if domain:
                    print(f"Running additional OSINT for: \\\\{domain\\\\}")

                    # Run theHarvester
                    self.run_theharvester(domain)

                    # Run Shodan lookup
                    self.run_shodan_lookup(domain)

                    # Run certificat transparency lookup
                    self.run_crt_sh_lookup(domain)

    def run_theharvester(self, domain):
        """Run theHarvester on domain"""
        try:
            cmd = ['theharvester', '-d', domain, '-l', '100', '-b', 'google,bing']
            result = subprocessus.run(cmd, capture_output=True, text=True, timeout=300)

            if result.returncode == 0:
                # Parse theHarvester output
                output_file = f"theharvester_\\\\{domain.replace('.', '_')\\\\}.txt"
                with open(output_file, 'w') as f:
                    f.write(result.stdout)
                print(f"theHarvester results saved: \\\\{output_file\\\\}")

        except Exception as e:
            print(f"Error running theHarvester for \\\\{domain\\\\}: \\\\{e\\\\}")

    def run_shodan_lookup(self, domain):
        """Run Shodan lookup on domain"""
        try:
            # This would require Shodan API clé
            # Placeholder for Shodan integration
            print(f"Shodan lookup for \\\\{domain\\\\} (requires API clé)")
        except Exception as e:
            print(f"Error with Shodan lookup: \\\\{e\\\\}")

    def run_crt_sh_lookup(self, domain):
        """Run certificat transparency lookup"""
        try:
            url = f"https://crt.sh/?q=\\\\{domain\\\\}&output;=json"
            response = requests.get(url, timeout=30)

            if response.status_code == 200:
                certs = response.json()
                output_file = f"crtsh_\\\\{domain.replace('.', '_')\\\\}.json"

                with open(output_file, 'w') as f:
                    json.dump(certs, f, indent=2)

                print(f"certificat transparency results saved: \\\\{output_file\\\\}")

        except Exception as e:
            print(f"Error with crt.sh lookup for \\\\{domain\\\\}: \\\\{e\\\\}")

    def generate_comprehensive_report(self):
        """Generate comprehensive OSINT report"""
        report_file = f"comprehensive_osint_\\\\{self.workspace\\\\}.html"

        html_content = f"""
<!DOCTYPE html>
<html>
<head>
    <title>Comprehensive OSINT Report - \\\\{self.workspace\\\\}</title>
    <style>
        body \\\\{\\\\{ font-family: Arial, sans-serif; margin: 20px; \\\\}\\\\}
        .section \\\\{\\\\{ margin: 20px 0; \\\\}\\\\}
        .section h2 \\\\{\\\\{ color: #333; border-bottom: 2px solid #ccc; \\\\}\\\\}
        table \\\\{\\\\{ border-collapse: collapse; width: 100%; \\\\}\\\\}
        th, td \\\\{\\\\{ border: 1px solid #ddd; padding: 8px; text-align: left; \\\\}\\\\}
        th \\\\{\\\\{ background-color: #f2f2f2; \\\\}\\\\}
    </style>
</head>
<body>
    <h1>Comprehensive OSINT Report</h1>
    <p><strong>Workspace:</strong> \\\\{self.workspace\\\\}</p>
    <p><strong>Generated:</strong> \\\\{Path().cwd()\\\\}</p>

    <div class="section">
        <h2>Summary</h2>
        <ul>
            <li>Domains: \\\\{len(self.results.get('domains', []))\\\\}</li>
            <li>hôtes: \\\\{len(self.results.get('hôtes', []))\\\\}</li>
            <li>Contacts: \\\\{len(self.results.get('contacts', []))\\\\}</li>
            <li>Profiles: \\\\{len(self.results.get('profiles', []))\\\\}</li>
        </ul>
    </div>

    <div class="section">
        <h2>Domains</h2>
        <table>
            <tr><th>Domain</th><th>Module</th></tr>
"""

        for domain in self.results.get('domains', []):
            html_content += f"""
            <tr>
                <td>\\\\{domain.get('domain', '')\\\\}</td>
                <td>\\\\{domain.get('module', '')\\\\}</td>
            </tr>
"""

        html_content += """
        </table>
    </div>

    <div class="section">
        <h2>hôtes</h2>
        <table>
            <tr><th>hôte</th><th>IP Address</th><th>Region</th><th>Country</th></tr>
"""

        for hôte in self.results.get('hôtes', []):
            html_content += f"""
            <tr>
                <td>\\\\{hôte.get('hôte', '')\\\\}</td>
                <td>\\\\{hôte.get('ip_address', '')\\\\}</td>
                <td>\\\\{hôte.get('region', '')\\\\}</td>
                <td>\\\\{hôte.get('country', '')\\\\}</td>
            </tr>
"""

        html_content += """
        </table>
    </div>
</body>
</html>
"""

        with open(report_file, 'w') as f:
            f.write(html_content)

        print(f"Comprehensive report generated: \\\\{report_file\\\\}")

def main():
    import sys

    if len(sys.argv) != 2:
        print("utilisation: python3 osint-framework-integration.py <workspace>")
        sys.exit(1)

    workspace = sys.argv[1]

    integration = OSINTFrameworkIntegration(workspace)

    if integration.export_recon_data():
        integration.run_additional_osint()
        integration.generate_comprehensive_report()
    else:
        print("Failed to export Recon-ng data")

if __name__ == "__main__":
    main()

Best Practices

reconnaissance Methodology

1. Planning Phase:
    - Define scope and objectives
    - Identify cible domains/organizations
    - Set up proper workspace organization
    - Configure API clés for enhanced data

2. Passive reconnaissance:
    - Start with DNS énumération
    - Use certificat transparency logs
    - Gather contact information
    - Avoid direct cible interaction

3. Data Validation:
    - Cross-reference findings
    - Validate discovered hôtes
    - Verify contact information
    - Check for false positives

4. documentation:
    - Maintain detailed workspace records
    - Generate comprehensive reports
    - Document methodology used
    - Preserve evidence chain

Operational Security

#!/bin/bash
# recon-ng-opsec-checklist.sh

echo "Recon-ng OPSEC Checklist"
echo "========================"

echo "1. Network Security:"
echo "   □ Use VPN or proxy"
echo "   □ Rotate IP addresses"
echo "   □ Monitor API rate limits"
echo "   □ Use different user agents"

echo -e "\n2. Data Security:"
echo "   □ Encrypt workspace databases"
echo "   □ Secure API clé storage"
echo "   □ Use secure file permissions"
echo "   □ Regular backup procedures"

echo -e "\n3. Legal Compliance:"
echo "   □ Verify autorisation scope"
echo "   □ Respect API terms of service"
echo "   □ Document all activities"
echo "   □ Follow local regulations"

echo -e "\n4. Technical Measures:"
echo "   □ Use isolated environment"
echo "   □ Monitor system resources"
echo "   □ Implement logging"
echo "   □ Regular tool updates"

dépannage

Common Issues

# Issue: Module not found
# Solution: Reload modules
[recon-ng][workspace] > modules reload

# Issue: API clé errors
# Check API clé configuration
[recon-ng][workspace] > clés list

# Issue: Database errors
# Check database schema
[recon-ng][workspace] > db schema

# Issue: No results from modules
# Verify cible data exists
[recon-ng][workspace] > show domains
[recon-ng][workspace] > show hôtes

Debug Mode

# Enable debug mode
recon-ng --debug

# Check module dependencies
[recon-ng][workspace] > modules load <module>
[recon-ng][workspace][module] > info

# Verify API connectivity
[recon-ng][workspace] > clés list

Performance Optimization

# Use specific modules instead of running all
# Implement delays for API rate limiting
# Use workspace-specific configurations
# Regular database maintenance

# Clean up old workspaces
[recon-ng][workspace] > workspaces delete old_workspace

# Optimize database queries
[recon-ng][workspace] > db query VACUUM

Resources

• Recon-ng GitHub Repository
• Recon-ng Wiki
• Recon-ng Module Development
• OSINT Framework
• Web reconnaissance Methodology

---

This aide-mémoire provides comprehensive guidance for using Recon-ng for web reconnaissance and OSINT activities. Always ensure proper autorisation and legal compliance before conducting any reconnaissance activities.