drag0nslay/rec0n_3ngin3 — explained in plain English
Analysis updated 2026-05-18
Run a safe, passive-only reconnaissance pass on a domain before deciding whether to scan further.
Chain subdomain enumeration, port scanning, crawling, and vulnerability scanning into one command.
Discover exposed secrets in JavaScript files and misconfigured cloud storage buckets on an authorized target.
Generate a prioritized report of findings that automatically diffs against a previous scan of the same domain.
| drag0nslay/rec0n_3ngin3 | 0marildo/imago | 0xdfi/glm-5.2-1m-4x-dgx-spark | |
|---|---|---|---|
| Stars | 3 | 3 | 3 |
| Language | Python | Python | Python |
| Setup difficulty | moderate | easy | hard |
| Complexity | 3/5 | 2/5 | 5/5 |
| Audience | researcher | general | researcher |
Figures from each repo's GitHub metadata at analysis time.
Requires installing many external CLI tools like subfinder, nmap, and nuclei plus API keys for some data sources.
reC0n_3ngin3 is a Python tool for bug bounty hunters and penetration testers that wraps a long list of existing security scanning tools, such as subfinder, httpx, naabu, nmap, and nuclei, into a single orchestrated pipeline. Instead of running each tool by hand and manually combining their output files, a user runs one command and gets a prioritized report covering everything from passive information gathering to vulnerability signals. The pipeline is organized into fourteen phases, grouped into four tiers so a user can choose how deep to go. Tier 1 only collects passive information from public sources like certificate transparency logs and never sends traffic to the target, making it safe to run without permission. Tier 2 adds DNS resolution, live host detection, and port scanning. Tier 3 adds crawling of historical and live URLs plus analysis of JavaScript files for exposed secrets. Tier 4 runs everything, including vulnerability scanning with nuclei, directory bruteforcing, cloud storage bucket discovery, and deeper DNS enumeration. A user can also call focused subcommands, such as enum, scan, crawl, or vuln, to run just the tools relevant to one phase. Because tiers 2 through 4 send real network traffic to the target, the tool includes a hard authorization gate in its configuration file. Active modules refuse to run unless the user has explicitly set an authorized flag to true, and the documentation states plainly that this tool must only be pointed at systems the user owns or has explicit written permission to test, since unauthorized scanning can violate computer misuse laws in various countries. Results are stored per target domain in a local SQLite database along with a plain text summary report and a full markdown report, so scanning the same domain again later automatically compares against the previous run. Setup involves cloning the repository, copying an example configuration file, adding API keys for the underlying tools, and installing the Python dependencies. The project is released under the MIT license.
reC0n_3ngin3 orchestrates existing security scanning tools like subfinder, nmap, and nuclei into one tiered pipeline that produces a prioritized recon report for authorized targets.
Mainly Python. The stack also includes Python, nmap, nuclei.
MIT license, use freely including commercially as long as the copyright notice is kept.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly researcher.
This repo across BitVibe Labs
double-check against the repo, no cap.