Reconner - Self-hosted bug-bounty platform — verification-fir

项目说明

<p align="center">
<img src="assets/reconner-hero-v3.4.png" alt="Reconner — Attack Surface Intelligence" width="100%">
</p>

<p align="center">
<strong>Self-hosted attack-surface intelligence and DAST for authorized bug-bounty and security teams.</strong>
</p>

<p align="center">
<a href=" src=" alt="Build and scan"></a>
<a href=" src=" alt="Latest release"></a>
<a href=" src=" alt="GHCR multi-architecture image"></a>
<img src=" alt="Go 1.26">
<img src=" alt="React and TypeScript">
<a href="LICENSE"><img src=" alt="MIT license"></a>
</p>

<p align="center">
<a href="#quick-start">Quick start</a> ·
<a href="#product-tour">Product tour</a> ·
<a href="#how-"> model</a> ·
<a href="docs/SCANNING_GUIDE.md">Scanning guide</a> ·
<a href="docs/OPERATOR_GUIDE.md">Operator guide</a> ·
<a href="docs/README.md">Documentation</a>
</p>

> [!IMPORTANT]
> Reconner performs acti testing. Run it only against assets you own
> or ha permission to test. The operator is responsible for scope,
> request limits, program rules, stop conditions, and collected e.

What Reconner is

Reconner turns a declared scope into a durable map of assets, routes, parameters,
browser states, services, candidates, e, and findings. It keeps
discovery separate from proof, records work that could not be attempted, and
gi scans real operational controls instead of treating tool
stdout as the finished product.

| Capability | What it provides |
|---|---|
| Web attack surface | DNS and HTTP discovery, crawling, Ja/API analysis, parameters, historical URLs, content and exposure checks |
| DAST | Context-aware XSS, SQLi, access control, ser classes, upload , Nuclei intake, and class-specific proof |
| Explicit network pipeline | Opt-in IP/CIDR/range scanning with port discovery, service/banner e, bounded OS detection, ser Nuclei, and optional auth checks |
| Continuous operations | Persistent tasks, phase ledger, pause/resume/skip/cancel, resource-aware scheduling, monitoring diffs, live logs, and
| E and reporting | Candidate lifecycle, reproducibility e, screenshots, reports, and portable target research bundles |
| One self-hosted deployment | Go service, responsi dashboard, SQLite, Chromium, Nmap, and the pinned external toolchain in one multi-architecture image |

Quick start

The recommended deployment needs only Docker and Docker Compose v2.

Open . If ADMIN_PASSWORD was left blank, retrieve
the generated first-run password with:

the deployment:

For a source build, replace the pull/start commands with:

See the operator guide for safe upgrades, backups,
resource sizing, ownership recovery, and troubleshooting. The shorter
Docker reference documents the image and Compose layout.

Product tour

<p align="center">
<img src="assets/screenshot-dashboard.png" alt="Reconner dashboard o" width="100%">
</p>

1. Model the real scope

Create Projects manually or import public program scope from HackerOne,
Bugcrowd, Intigriti, or YesWeHack. Reconner preserves the asset type instead of
flattening e into a hostname: domains, wildcards, exact pages,
Ja files, APIs, single IPs, CIDRs, and inclusive IP ranges each enter an
appropriate pipeline.

Scope changes remain operator-controlled. New upstream assets become pending
events, removed or submission-ineligible assets are suspended, and exact-page
or Ja seeds keep their path-le.

2. Choose a deliberate scan plan

Web scans expose safe, standard, and custom module selection plus slow, normal,
and fast request profiles. Network scans appear only for compatible assets and
offer Fast, Normal, and Deep profiles. Web and network phases cannot be mixed
accidentally in one task.

Whole-target scans default to prioritized, asset-first execution: every
request-hea runs its full pipeline against the highest-priority
asset (main domain, admin/API/staging-shaped hosts, high tech-signal
hosts) before moving to the next, with a lighter module tier for
low-score or duplicate/wildcard-catch-all tail assets. The classic
module-by-module sweep remains a as an explicit opt-out.

3. Watch co—not just progress

Every phase records discovered, eligible, attempted, candidate, confirmed,
rejected, blocked, and errored work. Missing credentials, tools, browser
capability, identities, callbacks, or eligible inputs do not become a false
“clean” result.

4. Triage e

Findings carry detector-specific e while uncertain signals remain
candidates. A systemic issue confirmed across many URLs of the same host
(a missing header, a host-wide misconfiguration) collapses into one
finding with its affected URLs listed underneath, instead of one row per
URL. Admin and high-sensiti are content-grouped, redirect-aware,
and deduplicated across hosts. Confirmed admin panels and confirmed XSS
with li execution proof carry a captured screenshot alongside
their e. The orange target count is reserved for actionable
medium-or-higher findings instead of low-value in noise.

<p align="center">
<img src="assets/screenshot-findings-collapsed.png" alt="Collapsed host-wide finding with affected URLs expanded" width="49%">
<img src="assets/screenshot-admin-panel.png" alt="Admin panel finding with a captured screenshot" width="49%">
</p>

5. Keep the operation moving

Use pause, resume, cancel, or Skip phase from the dashboard or
Browser-backed phases recei cleanup and task-owned Chromium process
termination, so a stuck cannot hold a scheduler slot forever.

Pipeline

Independent phases can run in parallel, but expensi families share
per-target and per-host gates. This keeps throughput across targets without
silently multiplying pressure against one application.

How works

Reconner does not promote a finding merely because a URL returned 200, a
string was reflected, a timer moved once, or a third-party tool emitted a line.

| State | Meaning |
|---|---|
| Obser | Discovery data tied to an asset, request, response, script, route, browser state, or service |
| Candidate | A signal worth review or independent , but not yet proven |
| Confirmed | The detector's class-specific replay or proof contract succeeded |
| Rejected | A negati, encoding, soft-404 family, unstable timing, or replay disproved the signal |
| Blocked / unsupported | The phase could not make a valid attempt and records why |

Examples include a fresh nonce executing in Chromium for XSS, multi-signal
boolean/error/timing e for SQLi, token-attributed callbacks for blind
classes, stable denied controls plus successful replays for access-control
bypasses, and independent retrieval or processing proof for dangerous uploads.

The deterministic local corpus is expected to remain clean for its named
positive and negati. That is a regression contract, not a promise of
zero false positives or false negatives on arbitrary applications. See the
capability matrix and
quality e.

Web co

subdomain, DNS, CNAME, wildcard, vhost, HTTP, archi, and rendered

browser discovery;

recursi dependencies, source maps, endpoints, API schemas,

GraphQL, forms, query/path/header/cookie/JSON/XML insertion points;

cross-asset API data-exposure workflows that correlate high-signal Ja

parameters, negotiate ad read methods/content types, and retain only
replay-stable redacted schema e;

directory, backup/config exposure, takeover, broken-link, origin, and admin

panel intelligence;

reflected and DOM XSS with context selection and browser execution proof;

error, boolean, timing, and second-order SQLi with optional sqlmap confirmation;

SSRF/OAST, LFI, SSTI, CSTI, command injection, XXE, NoSQLi, and open redirects;

IDOR/authz, CSRF, CORS, JWT, account takeover, cache, request-smuggling, and

race-condition workflows;

structured file-upload and proof-gated Nuclei intake.

Reconner's general XSS pipeline covers reflected and DOM XSS. Stored upload or
processing behaviors are handled by their dedicated module rather than by
blindly spraying the general XSS corpus.

Network co

Network scanning is opt-in for a single IP, CIDR, or inclusive IP range such as
192.168.1.1-192.168.1.10.

| Profile | Discovery | Optional |
|---|---|---|
| Fast | Curated high-signal ports | Port, banner, service, and bounded OS e |
| Normal | Top 1,000 TCP ports | Ser network Nuclei and proof-gated 401/403 checks |
| Deep | All TCP ports | Normal checks plus an explicit, paced HTTP Basic credential audit |

Naabu uses TCP connect discovery; ICMP is informational and never a li
gate. Nmap fingerprints open ports. Recognized CDN/WAF edges and
configured exclusions are remo probing. Credential checks require a
real Basic challenge, stop on lockout/rate-limit responses, and promote only
stable replay e.

Read the scanning guide before running broad scopes.

Operator controls

Custom corpora

System & updates → Wordlists & payloads manages additions for subdomains,
hosts, directories, backups, exposures, extensions, parameters, JWT,
XSS, SQLi, LFI, SSRF, SSTI, CSTI, NoSQLi, command injection, redirects, and
network auth. Imports normalize category syntax, deduplicate compiled and custom
entries, and report input, added, duplicate, and invalid counts. Restore removes
only the custom layer and returns that category to compiled defaults.

Custom payloads extend co but cannot bypass a detector's proof contract.

Target research bundles

From a target page, use Report → Download scan bundle — ZIP. The bundle
contains a manifest, structured discovery/finding/e data,
phase and task state, stored screenshots, browser-state co, and bounded
in-scope Ja/chunk snapshots. Redirects are scope-checked and indi
fetch failures remain in the manifest.

Connect a BotFather bot under System → Integrations → . One bot can
allowlist multiple chats with , operator, or admin roles. It supports scan
and finding alerts plus target and task controls, including Skip phase. Delivery
uses a durable, per-chat outbox with retry and deduplication; no public webhook
is required.

Commands include /status, /targets, /target, /scans, /findings,
/scan, /pause, /resume, /skip, /cancel, /addtarget, /edittarget,
and /deletetarget.

v4.0.0 highlights

prioritized, asset-first scanning is now the default execution order for

whole-target scans, with li progress and a tiered depth for
low-score/duplicate tail assets;

root-caused (not just tuned) SQLi slowness on WAF/rate-limited targets and

an XSS co bug, plus a new WAF-bypass encoding layer for XSS;

fixed a shared false-negative in the WAF/block-page gate nearly every

differential detector relies on (SQLi, XSS, SSRF, LFI, XXE, SSTI, CSTI,
IDOR, NoSQLi, cache poisoning);

two concrete subdomain-takeo fixes: wildcard/catch-all

DNS detection and generic-signature confidence gating;

a branded, site-aware backup/secret-file wordlist plus CMS

automated-backup-plugin paths;

findings collapse by root cause (type + host + parameter) instead of one

row per affected URL, with screenshot capture for confirmed admin panels
and confirmed XSS execution proof;

Nuclei low/info-se templates remo — no configurable

opt-in remains.

The full technical change record is in the
v4.0.0 release notes.

Toolchain

The official image pins and executes every required command during its build.

| Area | Bundled tools |
|---|---|
| Discovery | subfinder, assetfinder, findomain, alterx, asnmap, scilla, naabu |
| DNS | dnsx, massdns, puredns, shuffledns |
| HTTP and crawling | httpx, katana, hakrawler, gau, waybackurls, waymore, uro |
| Content | dirsearch, feroxbuster |
| | nuclei, subzy, sqlmap, nmap, Chromium |
| Runtime | Go service, SQLite, Python 3, git, tini |

The application runs as uid/gid 10001. Compose keeps NET_RAW and
NET_ADMIN only so the file-capability-scoped Nmap binary can perform bounded
OS fingerprinting. Removing those capabilities disables OS detection while
retaining TCP-connect port and service discovery.

Configuration

Bootstrap live in .env:

| | Purpose | Default |
|---|---|---|
| HOST_PORT | Dashboard port on the Docker host | 8080 |
| ADMIN_USER | Initial administrator username | admin |
| ADMIN_PASSWORD | Initial password; blank generates a random value | blank |
| RECON_MEMORY_LIMIT | Whole-container memory limit | 3g |
| RECON_PIDS_LIMIT | Whole-container process limit | 512 |

Persistent settings live in /data/config.json and are managed primarily from
the dashboard. Targets, findings, users, screenshots, corpora, templates, and
configuration live in the reconner-data .

Ne .env or a populated configuration file. Deployment- or
project-le headers can be configured for programs that require
them; project o global defaults and are sent only to admitted
project hosts.

Documentation

| Start here | Purpose |
|---|---|
| Documentation hub | All operator, scanning, architecture, e, and release documents |
| Operator guide | Install, update, back up, size, recover, and troubleshoot a deployment |
| Scanning guide | Scope types, web/network plans, proof states, controls, corpora, and exports |
| Capability matrix | Module prerequisites, positi contracts, and supported boundaries |
| Docker reference | Image contents, Compose layout, capabilities, and persistence |
| v4.0.0 release notes | Current release details and local regression commands |
| Contributing | De workflow and contribution expectations |
| Security policy | Private reporting for Reconner itself |

De

Direct de requires Go, Node.js/npm, a C compiler for SQLite, and the
external tools needed by the modules you run locally.

Frontend-only workflow:

Release tags must match . CI formatting, dependencies, unit
and race tests, deterministic detector fixtures, migrations, frontend and
browser workflows, release smoke tests, secret/source/dependency scans, and
native linux/amd64 plus linux/arm64 container builds before publication.

Data safety

Normal image and source updates keep the named . This command does not:

The -v flag deletes the persistent and therefore the database,
configuration, users, targets, findings, corpora, templates, and stored
artifacts. Do not use it for a normal upgrade.

Responsible use

Reconner is intended for authorized security research, bug-bounty programs,
and defensi. Respect official scope, exclusions, rate limits,
privacy requirements, and rules of engagement. Public program catalogs are a
con cache—not legal authorization. The maintainers are not responsible
for unauthorized use or resulting damage.

Support

For a false positi fixture, operational bug, or UI issue, open a
GitHub issue with a minimal
reproduction and sanitized logs. Private in Reconner itself
belong in the process described by SECURITY.md.

Community contact:

If Reconner saves you time:

Iranian gateway: daramet.com/RootDR

Solana: BBdEFMnnMFX8ZqeoXbnmYYLE49gNEygdUDy4ctuB9EiT

Bitcoin: bc1qefw4534l8ap7ly

EVM: 0x58e7c01913D6eA354DEaB1f83AD9A95B4D9EAfCa

Tron: TYE2DKJZ7nNkBNEJ7uSr374Z

---

<p align="center">
Built by <strong>RootDR</strong> for the bug-bounty community.
</p>

项目信息

开发语言：Go

Star 数：130

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Self-hosted bug-bounty platform — verification-first recon & DAST, continuous monitoring. Your data stays on your machine.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。