Reconnoitre - A security tool for multithreaded information gath

项目说明

!Reconnnoitre

A reconnaissance 工具 made for the OSCP labs to automate information gathering and service enumeration whilst creating a directory structure to store results, findings and exploits used for each host, recommended commands to execute and directory structures for storing loot and flags.

Contributions are more than welcome!

![Python 3.2|3.6]() ![License]() ![Build Status]() ![Twitter]()

Important

Reconnoitre although a well loved 工具 I' for a few years now, in my opinion, pales in functionality to building your own enumeration approach within Interlace. I strongly recommend anybody looking to take Infosec beyond the OSCP to spend some time looking into this project.

Credit

This 工具 is based heavily upon the work made public in Mike Czumak's (T_) OSCP review (link) along with considerable influence and 代码 taken from Re4son's mix-recon (link). host scanning is originally adapted from teknogeek's work which is heavily influenced by jobertabma's host discovery script (link). Further Host scanning 代码 has been adapted from a project by Tim Kent and I, a here (link).

Installation

To install Reconnoitre first make a local copy of the repository by performing the following where you wish it to be located:

After you have done this run setup.py with the following:

After setup has run Reconnoitre will now be in your path (as reconnoitre) and you can launch it anywhere using:

Usage

This 工具 can be used and copied for personal use freely howe and credit should be offered to Mike Czumak who originally started the process of automating this work.

| Argument | Description |
| ------------- |:-------------|
| -h, --help | Display help message and exit |
| -t TARGET_HOSTS | Set either a target range of addresses or a single host to target. May also be a file containing hosts. |
| -o OUTPUT_DIRECTORY | Set the target directory where results should be written. |
| -w WORDLIST | Optionally specify your own wordlist to use for pre-compiled commands, or executed attacks. |
| --pingsweep | Write a new target.txt file in the OUTPUT_DIRECTORY by performing a ping sweep and disco li. |
| --dns, --dnssweep | Find DNS servers from the list of target(s). |
| --snmp | Find hosts responding to SNMP requests from the list of target(s). |
| --services | Perform a service scan over the target(s) and write recommendations for further commands to execute. |
| --hostnames | Attempt to disco hostnames and write to hostnames.txt. |
| -- | Attempt to disco hosts using the specified wordlist. This can be expended hostnames. |
| --ignore-http-codes | Comma separated list of http codes to ignore with host scans. |
| --ignore-content-length | Ignore content lengths of specificed amount. This may become useful when a ser a static page on every host guess. |
| --quiet | Supress banner and headers and limit feedback to grepable results. |
| --quick | Move to the next target after performing a quick scan and writing first-round recommendations. |
| --no-udp | Disable UDP service scanning, which is ON by default. |

Usage Examples

_Note that these are some examples to give you insight into potential use cases for this 工具. Command lines can be added or remo on what you wish to accomplish with your scan._

Scan a single host, create a file structure and disco

An example output would look like:

Which would also write the following recommendations file in the scans folder for each target:

Discover li and hostnames within a range

Discover li within a range and then do a quick probe for services

This will scan all services within a target range to create a file structure of li as well as write recommendations for other commands to be executed based on the services discovered on these machines. Removing --quick will do a further probe but will greatly lengthen execution times.

Discover li within a range and then do probe all ports (UDP and TCP) for services

Requirements

This bare requirement for host and service scanning for this 工具 is to have both nbtscan and nmap installed. If you are not using host scanning and only wish to perform a ping sweep and service scan you can get away with only installing nmap. The outputted _findings.txt_ will often recommend additional tools which you may not ha in your distribution if not using Kali Linux. All requirements and recommendations are native to Kali Linux which is the recommended (although not required) distribution for using this 工具.

In addition to these requirements outputs will often refer to Wordlists that you may need to find. If you are undertaking OSCP these can be found in the "List of Recommended Tools" thread by g0tmilk. If not then you can find the majority of these online or already within a Kali Linux installation.

Dockerfile

First step is to install docker if you do not have it installed already. Docker Installation

Basic Usage:

If you want files to exist locally you can mount a directory to the Docker container

项目信息

开发语言：Python

Star 数：2195

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A security 工具 for multithreaded information gathering and service enumeration whilst building directory structures to store results, along with writing out recommendations for further testing.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。