recon0 - All-in-one bug bounty recon pipeline — 9-stage orc

项目说明

<p align="center">
<br>
<picture>
<source media="(prefers-color-scheme: dark)" srcset="
<source media="(prefers-color-scheme: light)" srcset="
<img alt="recon0" src=" width="700">
</picture>
</p>

<p align="center">
<img src=" alt="Go">
<img src=" alt="Docker">
<img src=" alt="License">
<img src=" alt="CDP">
</p>

<p align="center">
<a href="#quick-start">Quick Start</a> &bull;
<a href="#pipeline">Pipeline</a> &bull;
<a href="#pro">Pro</a> &bull;
<a href="#dsl-engine">DSL Engine</a> &bull;
<a href="#api">API</a> &bull;
<a href="#configuration">Configuration</a> &bull;
<a href="#docker">Docker</a>
</p>

---

recon0 is a modular reconnaissance framework written in Go that orchestrates a 9-stage pipeline — subdomain enumeration, DNS resolution, HTTP probing, headless browser crawling, port scanning, endpoint discovery, secret analysis, intelligence aggregation, and scanning — into a single command.

Why recon0?

---

Pipeline

Stage Data Flow

| Stage | Input | Output | Gate? |
|-------|-------|--------|-------|
| enum | domains.txt | subdomains.txt | |
| resolve | subdomains.txt | alive.txt | Yes — stops pipeline if 0 alive |
| probe | alive.txt | li.txt | |
| crawl | li.txt | urls.txt + har/ + js/ | |
| portscan | alive.txt | ports.txt | |
| discover | har/ | endpoints.json | |
| analyze | har/ + js/ | findings.json | |
| collect | output/* | intel.json | |
| vuln | li.txt | findings.txt | |

---

Installation

One-liner (recommended)

Detects OS/architecture, downloads the latest release, SHA256 checksum, installs to /usr/local/bin/.

Go Install

Manual Download

Grab the binary for your platform from Releases:

---

Quick Start

From Source

Docker (batteries included)

The Docker image includes all ProjectDiscovery tools, Chromium, and nuclei templates pre-installed.

Pro

---

CLI Reference

run flags

| Flag | Short | Default | Description |
|------|-------|---------|-------------|
| --list FILE | -l | | Read domains from a file (one per line) |
| --program NAME | -p | domain | Group scans under a program name |
| --config PATH | -c | recon0.yaml | Path to config file |
| --from-stage STAGE | -f | | Resume from a specific stage |

serve flags

| Flag | Short | Default | Description |
|------|-------|---------|-------------|
| --config PATH | -c | recon0.yaml | Path to config file |
| --port PORT | | 8484 | API listen port |

scan flags

| Flag | Short | Default | Description |
|------|-------|---------|-------------|
| --list FILE | -l | | Read domains from a file (one per line) |
| --program NAME | -p | domain | Program name |
| --remote HOST:PORT | -r | localhost:8484 | Remote ser |

update flags

| Flag | Default | Description |
|------|---------|-------------|
| --check | false | Only check for updates, don't install |

uninstall flags

| Flag | Default | Description |
|------|---------|-------------|
| --purge | false | Also remove all scan data (runs/) and config files |

Examples

---

Pro

External Tools (CLI binaries)

| Provider | Stage | Tool | Purpose |
|----------|-------|------|---------|
| subfinder | enum | subfinder | Passi enumeration from 100+ sources |
| amass | enum | amass | OWASP subdomain enumeration — DNS, scraping, certificates, APIs |
| dnsx | resolve | dnsx | DNS resolution, A/AAAA/CNAME records, takeo |
| httpx | probe | httpx | HTTP probing, status codes, tech fingerprinting, CDN detection |
| tlsx | probe | tlsx | TLS certificate extraction, SAN enumeration, expiry checks |
| naabu | portscan | naabu | SYN/CONNECT port scanning, top-N ports |
| nuclei | vuln | nuclei | Template-based scanning |

Built-in Pro (no external binary)

| Provider | Stage | Purpose |
|----------|-------|---------|
| cdpcrawl | crawl | Headless Chromium crawling De Protocol (CDP). Captures full HAR archives, extracts JS files, performs multi-round click-and-na interaction. Cookie isolation contexts. |
| discover | discover | Parses HAR request logs and Ja files to extract API endpoints, HTTP methods, query parameters, and request bodies. Deduplicates by method+URL. |
| analyzer | analyze | Runs the DSL rule engine against JS files, HAR bodies, HTTP headers, and discovered endpoints. Detects secrets, tokens, cloud assets, misconfigurations, and interesting paths. |
| collector | collect | Aggregates all stage outputs into a structured intelligence report (intel.json). Optionally enriches with LLM analysis or Ollama. |
| smartfuzz | vuln | Smart fuzzer: uni probes (every host), runtime tech discovery, prefix expansion (/manage/actuator/env), disco fuzzing from endpoints.json, CDN-aware filtering. |

Provider Architecture

Pro register via init(). The pipeline queries the registry for each stage, runs enabled pro (sequential or parallel per stage config), merges outputs, applies deduplication, and feeds results to the next stage.

---

DSL Engine

The built-in DSL engine scans JS files, HAR response bodies, HTTP headers, and discovered endpoints using 60+ regex-based rules with false-positi.

Rule Categories

| Category | Rules | Se | Examples |
|----------|-------|----------|---------|
| Secrets & Tokens | 20 | Critical/High | AWS keys, GitHub PATs, Slack tokens, Stripe keys, JWTs, private keys |
| Cloud Assets | 22 | Medium/Info | S3 buckets, Azure Blob, GCP Storage, Firebase, Cloudflare R2, Supabase |
| HTTP Headers | 8 | Low-High | CORS misconfig, missing CSP, ser disclosure, debug headers |
| Interesting Paths | 12 | Info-Critical | Admin panels, .en, .git exposure, Spring Actuator, Go pprof, source maps |
| Response Content | 4 | Medium-High | Stack traces, SQL errors, internal IPs |

Rule Format

Rules are defined in YAML (internal/dsl/rules/default.yaml):

Custom Rules

Add your own rules :

---

Smart Fuzzing

The smartfuzz provider replaces traditional blind fuzzing with an intelligent, multi-phase approach. It combines uni probes (sent to every host), runtime tech discovery, prefix expansion, and disco fuzzing from pipeline data.

| Tech Stack | Probes | Examples |
|------------|--------|---------|
| Generic (all hosts) | .env, .git/HEAD, ser, robots.txt, .well-known | Config leak, source code exposure |
| Spring Boot | /actuator/env, /actuator/heapdump, /actuator/configprops | Env dump, heap memory, config |
| WordPress | wp-config.php.bak, xmlrpc.php, wp-json/wp/v2/users | Backup leak, user enum |
| Node.js | package.json, /graphql introspection | Dependency leak, schema exposure |
| Laravel/PHP | telescope, _debugbar, phpinfo() | Debug panels, info disclosure |
| Django | /admin/, __debug__/ | Admin panel, debug toolbar |
| .NET | elmah.axd, trace.axd, web.config | Error logs, config leak |
| Go | /debug/pprof/, /debug/vars | Profiler, runtime vars |
| CORS | Origin reflection test | Misconfigured CORS policies |

---

LLM Intelligence

The collector stage aggregates all pipeline data, cross-correlates findings, and generates structured in files for AI agent :

1. IDOR Candidates — parameterized endpoints with numeric/UUID IDs
2. SSRF Candidates — URL-like query parameters (url, redirect, callback, etc.)
3. Exposed Secrets — critical secrets correlated with same-file/host findings
4. Access Control Gaps — admin/debug paths accessible without auth
5. Tech-Specific Vulns — framework-specific findings (Spring Actuator, etc.)
6. Misconfigurations — CORS reflection, missing security headers
7. Information Disclosure — SQL errors, stack traces, internal IPs
8. Subdomain Takeover — dangling CNAME records matching known fingerprints

Output: in.json (for AI agent) + intel.json (summary report)

---

API

Start the API server with recon0 serve. All endpoints return JSON.

| Method | Endpoint | Description |
|--------|----------|-------------|
| GET | /api/health | Health check |
| GET | /api/status | Current scan status (or most recent) |
| GET | /api/status/:run_id | Status by run ID |
| GET | /api/runs | List all runs with summary |
| GET | /api/logs/:run_id?lines=N | Tail log file (default: 100 lines) |
| POST | /api/scan | Queue a new scan |
| GET | /api/queue | List queued jobs |
| DELETE | /api/queue/:id | Remove a queued job |

Queue a Scan

Check Status

---

Configuration

recon0 loads config from (in order): recon0.yaml in CWD, --config flag, en .

<details>
<summary><strong>Full config reference (click to expand)</strong></summary>

</details>

En

| | Description |
|----------|-------------|
| RECON0_CONFIG | Config file path |
| RECON0_OUTPUT | Output directory o |
| RECON0_LOG_LEVEL | Log level (debug, info, warn, error) |
| RECON0_RESUME | Resume mode (true/false) |
| CHROME_PATH | Chromium binary path o |

---

Docker

Build

The multi-stage Dockerfile produces a self-contained image (~1.5 GB) with:

Run as Daemon

Port Scanning with SYN

---

Architecture

---

Intelligence Report

The collect stage produces intel.json — a structured intelligence report:

---

Resuming Scans

recon0 supports resuming at any stage. This is useful for:

The --from-stage flag reuses the existing run directory, preserving all pre collected data.

---

Resource Management

recon0 auto-detects system resources and adjusts concurrency:

| Pool | Calculation | Used By |
|------|-------------|---------|
| Full | All CPU cores | httpx, subfinder |
| Heavy | cores / 2 (min 1) | cdpcrawl, naabu |
| Light | cores / 4 (min 1) | nuclei (rate-limited) |

cgroup v1/v2 aware — works correctly inside Docker and Kubernetes.

---

Updating

Self-update downloads the correct binary for your OS/architecture from GitHub Releases, the SHA256 checksum, and replaces the current binary atomically.

Supported platforms: linux/amd64, linux/arm64, darwin/amd64, darwin/arm64.

> recon0 automatically checks for new releases in the background on every run. If a newer is a, a one-line notice is printed to stderr — no delay, no blocking.

> Container en are detected automatically — use docker build to update instead.

---

Uninstalling

---

Releasing

Releases are automated via GoReleaser and GitHub Actions:

---

Build

---

License

MIT

---

<p align="center">
<sub>Built by <a href="
</p>

项目信息

开发语言：Go

Star 数：9

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕All-in-one bug bounty recon pipeline — 9-stage orchestration from subdomain enumeration to vulnerability scanning. Single binary, headless browser crawling, 60+ DSL rules, LLM intelligence, self-updating.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。