ReconNinja - ⚡ ReconNinja v10.6.0— 38-phase recon framework for

项目说明

<di="center">

Autonomous multi-phase security reconnaissance framework.

![]()
![Python]()
![Author]()
![Docs]()

> ⚠️ Use only against targets you own or ha written permission to test.

</div>

---

What it does

ReconNinja turns a single command into a full recon engagement. Point it at a domain or IP and it drives the complete pipeline — passi, port scanning, web discovery, scanning, cloud intelligence, Acti enumeration, AI surface discovery, and agentic threat analysis — then generates HTML, JSON, Markdown, SARIF, and interactive D3 reports.

v10.0.0 is a major reliability release — every v9 signature-mismatch TypeError that crashed real scans has been fixed via a uniform PhaseContext adapter layer; save/load resume now round-trips ALL fields (with schema_=3 for forward migration); the monitor mode and GUI are actually wired up; the AUR pkgver() reads info/ directly; the MCP ser to 127.0.0.1 by default with optional bearer-token auth; and the plugin SDK has a path-tra guard + SHA-256 + atomic write.

v9.0.0 introduced autonomous agent mode, parallel phase scheduling, a directed finding graph, 6 new recon modules, agentic AI correlation, and MCP ser for Claude Code / Cursor.

---

Install

> Arch Linux: if paru is found it's used exclusively. Optionally add BlackArch when prompted.

---

Quick start

---

Scan profiles

| Profile | What it runs |
|---|---|
| fast | Top 100 ports, no scripts, no subdomains |
| standard | Top 1000 ports, scripts, detection *(default)* |
| thorough | All ports, subdomains, httpx, nuclei, C, correlation, interacti |
| stealth | SYN scan, T2 timing, low-noise rate profile |
| custom | Your flags only |
| web_only | httpx, whatweb, nuclei, feroxbuster, CORS, JS extract |
| port_only | RustScan pre-scan only |
| full_suite | E enabled |

---

What's New in v9.0.0

Autonomous Agent Mode

New Modules

AI Correlation Pipeline

MCP Server — Claude Code / Cursor Integration

Add to Claude Code (~/.claude/settings.json):

Claude Code can then: start scans, check status, query findings by se, explore the attack graph, and read attack chains — all natively.

Interactive HTML Report

Scope Enforcement

Continuous Monitoring

New Integrations

---

All flags

---

Output

Every scan creates a timestamped folder under reports/<target>/<timestamp>/:

| File | Description |
|---|---|
| report.html | Full HTML report with all findings |
| report.json | Machine-readable JSON |
| report.md | Markdown for wikis and tickets |
| report.sarif | SARIF 2.1.0 for GitHub Code Scanning |
| report_interactive_*.html | Interactive D3 report (--interacti) |
| recon_graph.graphml | GraphML attack graph (--graph-export graphml) |
| recon_graph.jsonld | JSON-LD graph (--graph-export json-ld) |
| e/ | HTTP captures + screenshots (--e) |
| e.json | SHA-256 hashes of all e files |
| ad_data/ | BloodHound JSON (--ad-recon) |
| monitor_diffs/ | Finding diff reports (--monitor) |
| reconninja_state.json | Resume checkpoint |
| scan.log | Full scan log |

---

Scan diff

Produces: new findings, resol, new subdomains, port changes.

---

Notifications

---

Resume interrupted scans

All completed phases are skipped; the scan continues from where it left off.

---

Plugin system

v9 — Plugin SDK v2

v8 plugins (still supported)

---

Tool dependencies

| Tool | Required for | Install |
|---|---|---|
| nmap | Port scanning | sudo pacman -S nmap |
| rustscan | Fast port pre-scan | cargo install rustscan |
| masscan | High-speed sweep | sudo pacman -S masscan |
| nuclei | Vuln templates | go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei |
| httpx | Web probing | go install github.com/projectdiscovery/httpx/cmd/httpx |
| feroxbuster | Dir brute-force | cargo install feroxbuster |
| subfinder | Subdomain enum | go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder |
| nikto | Web scanner | sudo pacman -S nikto |
| whatweb | Tech fingerprint | sudo pacman -S whatweb |
| aquatone | Screenshots | go install github.com/michenriksen/aquatone |
| gowitness | E screenshots | go install github.com/sensepost/gowitness |
| bloodhound-python | AD collection | pip install bloodhound |
| impacket | Kerberoast/AS-REP | pip install impacket |

All Go/Rust tools are installed automatically by install.sh.

---

De

---

Changelog highlights

v9.0.0

v8.4.0

v8.3.0

v8.0.0

v7.0.0

v6.0.0

> Full history in CHANGELOG.md

---

Part of the ExploitCraft Ecosystem

| Tool | Description |
|---|---|
| en | Codebase & git history secret scanner |
| gitdork | Google / Shodan dork generator |
| wifi-passview | Cross-platform WiFi credential dumper |
| | Secret & credential scanner |
| ReconNinja | Autonomous recon framework ← you are here |

---

License

MIT — see LICENSE

项目信息

开发语言：Python

Star 数：43

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕⚡ ReconNinja v10.6.0— 38-phase recon framework for pentesters & bug bounty hunters. Subdomain enum → port scan → web recon → WAF/CORS/JS/cloud bucket detection → GitHub OSINT → CVE lookup → AI threat analysis → HTML report. Domains, IPs, CIDRs, target lists. Plugin system. 598 tests.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。