Recon-ng is an open-source intelligence (OSINT) gathering tool and a full-featured web reconnaissance framework written in Python. It is designed to streamline the process of harvesting information from open sources during reconnaissance phases in cyber security, ethical hacking, bug bounty hunting, and penetration testing. The tool provides an interactive command-line interface similar to Metasploit, making it familiar for users experienced with that framework.

It focuses exclusively on web-based reconnaissance and is not intended for exploitation or social engineering tasks.

Recon-ng emphasises modules, allowing users to install, load, and run specific modules for targeted data collection, with built-in database interaction for storing and managing reconnaissance results. Developed by Tim Tomes (lanmaster53), it is maintained as free software with community contributions encouraged, particularly from Python developers.

Features

Recon-ng offers a list of features tailored for efficient OSINT and reconnaissance:

1. Analytics and Version Control: Optional analytics reporting and version checks (disabled by default in some distributions like Debian/Kali).

2. Command-Line and Web Interfaces: Primary CLI usage, with additional tools like recon-cli for non-interactive runs and recon-web for a web-based UI and API.

3. Convenience Functions: Interactive help, command completion, and options for stealth mode (disabling passive requests) or accessible outputs.

4. Reporting and Export: Modules for generating reports in formats like CSV, JSON, XML, and HTML. Includes spooling output to files for logging.

5. Marketplace for Modules: A built-in marketplace to search, install, and manage modules from remote repositories.

6. API Key Management: Secure storage and use of third-party API keys (e.g., for Shodan, Bing) to enhance module capabilities.

7. Workspace Management: Supports creating isolated work-spaces for different projects to organise data without overlap.

8. Database Integration: Built-in database for storing reconnaissance data, with commands to insert, query, export, and manage records (e.g., hosts, domains, contacts).

9. Modular Architecture: A completely modular framework with independent modules that can be easily added, updated, or removed. This allows for customisation and extension by developers.

The framework includes around 76 recon modules, 8 reporting modules, 2 import modules, 2 exploitation modules, and 2 discovery modules, totalling over 90 modules for tasks like domain enumeration, vulnerability scanning, and social media profiling.

Installation

Installation varies by operating system. Use this as a guide but please note these might be outdated depending on when you are reading this. Installation as of 2025:

Windows: Use Python and pip, or install via Windows Subsystem for Linux (WSL) following Linux steps.

Ubuntu/Linux Distributions: Clone from GitHub and install dependencies:

git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng
pip install -r REQUIREMENTS

Run with ./recon-ng or add to PATH.

Kali Linux: Pre-installed in many versions, but update with:

sudo apt update && sudo apt install recon-ng

This installs version 5.1.2 or later, with dependencies like Python 3 and related libraries.

Configuration files are stored in ~/.recon-ng/, including keys.db for APIs and modules/ for code.

Usage Guide

Recon-ng is launched via the command line with recon-ng or ./recon-ng from the cloned directory. It opens a shell with a prompt like [recon-ng][default] >. Use -w workspace to load/create a workspace on startup, or -r filename to run commands from a resource file.

Workflow typically involves:

1. Creating/loading a workspace.
2. Installing/searching modules via the marketplace.
3. Loading a module.
4. Setting options (e.g., target domain).
5. Running the module.
6. Viewing/exporting results.

The web interface is started with recon-web, providing API access at /api/.

Domain Reconnaissance Using Recon-ng

This workflow demonstrates a step-by-step process for performing domain reconnaissance on a target like example.com. It covers workspace setup, module installation and usage, API key management, data collection, and reporting/export.

Step 1

Launch Recon-ng and Create a Workspace. Workspace's isolate projects to prevent data overlap.

Launch Recon-ng:

./recon-ng  # Or just 'recon-ng' if in PATH

You'll see the prompt [recon-ng][default] >.

Select the workspace:

workspaces select <example_recon>

Now the prompt changes to [recon-ng][example_recon] >.

Create a new workspace:

workspaces create example_recon

Step 2

Install and Explore Modules via Marketplace. Modules extend Recon-ng's capabilities for specific tasks.

Search for modules (related to domains):

marketplace search domains

This lists modules like recon/domains-hosts/hackertarget, recon/domains-contacts/whois_pocs, etc.

Install an IP geolocation module:

marketplace install recon/hosts-hosts/ipinfodb

Install a WHOIS contacts module:

marketplace install recon/domains-contacts/whois_pocs

Install a subdomain enumeration module:

marketplace install recon/domains-hosts/hackertarget

Reload modules if needed:

modules reload

Step 3

Some modules need API keys for third-party services like Shodan or IPinfoDB. You can set up some API keys as an optional step.

Obtain the keys from each service you require (some keys require payment). This example is from shodan.io.

Sign up and get the key: https://developer.shodan.io/api/requirements

Add the key:

keys add shodan_api YOUR_SHODAN_API_KEY

List keys to verify:

keys list

Keys are stored securely in ~/.recon-ng/keys.db.

Step 4

Load, Configure, and Run Modules for Reconnaissance. Perform targeted data gathering such as:

IP Geolocation:

Load:

modules load recon/hosts-hosts/ipinfodb

Set an IP from previous results (e.g., from subdomains):

options set SOURCE 192.0.2.1

Run:

run

This provides location details like country, latitude/longitude.

WHOIS Contacts Gathering:

Load:

modules load recon/domains-contacts/whois_pocs

Set source:

options set SOURCE example.com

Run:

run

This pulls point-of-contact info like emails and names from WHOIS data.

Subdomain Enumeration:

Load the module:

modules load recon/domains-hosts/hackertarget

Set the target:

options set SOURCE example.com

Run it:

run

This queries HackerTarget for subdomains (e.g., discovers api.example.com, vpn.example.com with IPs).

Step 5:

View and Manage Collected Data. Data is stored in the workspace's database.

List notes:

notes list

Add notes for context:

notes add subdomain_note "Found potential vuln on api.example.com"

View schema for database structure:

db schema

View contacts:

show contacts

View hosts (subdomains/IPs):

show hosts

Step 6

Generate reports, export data and summarise findings for analysis.

Spool output to a file for logging:

spool on example_log.txt
run  # Run a module
spool off

Export database to CSV:

db export csv example_data.csv

Load and run:

modules load reporting/csv
run

This exports data to a CSV file.

Install a reporting module:

marketplace install reporting/csv

Step 7

Exit and Cleanup.

Remove workspace if done:

workspaces remove example_recon

Exit the module context:

back

Exit Recon-ng:

exit

This workflow can be automated with resource files (e.g. save commands in a .rc file and run recon-ng -r file.rc). For real-world use chain modules (e.g. use subdomains from one as input for geolocation in another) on targets like bug bounty domains.

Always check for module updates with marketplace refresh.

workspaces create example_recon
marketplace install recon/domains-hosts/hackertarget
modules load recon/domains-hosts/hackertarget
options set SOURCE example.com
run
show hosts
db export csv subdomains.csv
        

keys add shodan_api YOUR_SHODAN_API_KEY
marketplace install recon/domains-hosts/shodan_hostname
modules load recon/domains-hosts/shodan_hostname
options set SOURCE example.com
run
show hosts