Advanced Bug Bounty Reconnaissance Framework
⚡ Advanced Bug Bounty Reconnaissance Framework
Built for speed, automation, and real-world security workflows
---
## 🚀 Overview
**KAYSOCIETY Recon_Security ** is a powerful, multi-threaded reconnaissance tool designed for bug bounty hunters and penetration testers.
It automates the full recon pipeline — from subdomain discovery to vulnerability indicators — while maintaining a clean and professional CLI interface.
---
## 🎯 Features
* 🔍 Subdomain Enumeration (Subfinder + crt.sh + brute force + permutations)
* 🌐 Live Host Detection (httpx or pure-Python HTTP probing)
* 🔌 Port Scanning (28 common ports, pure Python)
* 🕸️ URL Discovery (Katana + Wayback CDX + spider)
* 📜 JavaScript Analysis & Secret Detection (30+ regex engines + entropy)
* 🔎 Endpoint Extraction from JS (absolute + relative paths)
* ⚔️ Parameter Discovery (fuzzing + reflection detection)
* 💉 XSS Reflection Detection (multi-payload)
* 🚨 Subdomain Takeover Detection (30+ fingerprints)
* 🪝 Open Redirect Detection
* 🌍 CORS Misconfiguration Check
* 🛡️ Security Headers Audit
* 🧬 Tech Stack & WAF Fingerprinting
* 🧠 Vulnerability Hint Engine (IDOR/LFI/redirect surfaces)
* 🎯 Target Prioritization (risk scoring)
* 💣 Nuclei Integration (optional --nuclei)
* 📊 HTML + JSON Report Generation
---
## ⚙️ Installation
### 1. Clone the Repository
git clone https://github.com/whoiskay404/Recon_Security
cd Recon_Security
---
### 2. Run Installer
chmod +x install.sh
./install.sh
---
## 🧪 Usage
### Basic Scan
python3 recon.py example.com
---
### Speed Mode (Threads)
python3 recon.py example.com --threads 20 --nuclei
⚠️ Recommended: 10–20 threads to avoid blocking
---
### 🚀 Options
* --threads N → Threads per module (default 15)
* --timeout N → HTTP request timeout (default 8s)
* --wordlist FILE → Extra subdomain wordlist
* --output DIR → Output directory (default output)
* --reports DIR → Reports directory (default reports)
* --nuclei → Run nuclei vulnerability scan
* --no-external → Pure Python only (no Go tools required)
* --quiet / --verbose → Output control
---
### External Tools (optional but recommended)
* subfinder → subdomain discovery
* httpx → fast HTTP probing
* katana → deep crawling
* nuclei → vulnerability scanning (with --nuclei)
* dnspython (pip) → fast DNS resolution
---
## 📂 Output Structure
### 📁 output/
| File | Description |
| -------------- | --------------------- |
| subdomains.txt | Discovered subdomains |
| live.txt | Active hosts |
| ports.txt | Open ports |
| urls.txt | Crawled URLs |
| js.txt | JavaScript files |
| endpoints.txt | Extracted endpoints |
| params.txt | Parameterized URLs |
| param_fuzz.txt | Parameter discovery |
| xss.txt | XSS reflection hints |
| redirects.txt | Open redirects |
| cors.txt | CORS misconfigurations|
| headers.txt | Security header audit |
| takeover.txt | Takeover candidates |
| secrets.txt | API keys / tokens |
| tech.txt | Tech fingerprints |
| waf.txt | WAF detection |
| interesting.txt| Sensitive paths |
| hints.txt | Vulnerability hints |
| priority.txt | High-value targets |
| risk.txt | Risk summary |
| nuclei.txt | Nuclei findings |
---
### 📁 reports/
* target_report.html → Visual recon report
* target_report.json → Structured machine-readable data
* target_report.txt → CLI risk summary
Run Command on Terminal to view html report<<
->firefox target_report.html
---
## 🖥️ CLI Preview
\[➤] Subdomains
✔ SUCCESS Completed in 2.1s
\[➤] Live Hosts
✔ SUCCESS Completed in 1.3s
==============================
  ✔ SCAN COMPLETED
==============================
Target: example.com
---
## 🧠 Workflow
ReconX follows a structured pipeline:
1. Recon → Subdomains + Live hosts
2. Discovery → URLs + JS files
3. Analysis → Params + Endpoints + Secrets
4. Detection → XSS + Takeover + Hints
5. Reporting → Risk + HTML output
---
##
This tool is for **educational and authorized security testing only**.
* ✅ Use on Penetration Testing programs
* ✅ Use on bug bounty programs
* ✅ Use on assets you own
* ✅ Use on your Homelab
* ❌ Do NOT scan unauthorized targets
---
## 👨💻 Author
**Karabo Kosi**
Penetration Tester| Ethical Hacker| Bug Bounty Hunter | Cybersecurity Eng |
---
## ⭐ Support
If you like this project:
* ⭐ Star the repo
* 🍴 Fork it
* 🧠 Contribute ideas
---
## 🔥 Future Improvements
* Nuclei integration
* Advanced vulnerability detection
* Dashboard UI (Web-based)
* Automated reporting (PDF)
---
## 💀 KAYSOCIETY
"Top 1% of the 1% underground hackers"
“Recon is where the real hacking begins.”
## ⭐ SCREENSHOTS OF A REAL-WORLD PENETRATION TEST RECONNAISSANCE
## ⭐ SCREENSHOTS OF THE CLEAN REPORT PRODUCED BY THE TOOL
