Back to OSINT guides

Recon-ng

An automated reconnaissance framework for modular, structured OSINT investigations

80+
OSINT modules
Python
Framework
SQLite
Database

🔍 What is Recon-ng?

Recon-ng is a reconnaissance framework written in Python that provides a modular environment for OSINT investigations. It simplifies and automates open source information gathering.

80+ Modules

Specialized modules for different sources

Database

Built-in SQLite storage

Framework

Extensible architecture

Key features

Discover Recon-ng's advanced capabilities for your OSINT investigations

Modular framework

Modular architecture with more than 80 specialized modules

Built-in database

Store and manage collected data in SQLite

API integrations

Connections to Shodan, Hunter.io, GitHub, Bing, etc.

Workspaces

Organize projects with dedicated workspaces

Automated reports

HTML, CSV and JSON report generation

Interface CLI

An intuitive, powerful command-line interface

Installation

Several ways to install Recon-ng on your system

🐧 Install from GitHub

git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng && pip install -r REQUIREMENTS
./recon-ng

📦 Install with a package manager

# Debian/Ubuntu
sudo apt update && sudo apt install recon-ng
recon-ng

📋 System requirements

Required

  • • Python 3.6 or later
  • • pip (Python package manager)
  • • git (to install from GitHub)

Recommended

  • • Python virtual environment
  • • API keys for the various services
  • • Stable internet connection

Available modules

Explore the module categories for your investigations

Recon

Collection modules, named source-destination (e.g. domains-hosts)

recon/domains-hosts/certificate_transparency

Subdomains from CT logs

recon/domains-hosts/hackertarget

Known hosts of a domain

recon/domains-contacts/whois_pocs

Contacts extracted from WHOIS

recon/hosts-hosts/resolve

DNS resolution of hosts

People & accounts

Contacts, profiles and exposed credentials

recon/domains-contacts/hunter_io

Email addresses via Hunter.io

recon/profiles-profiles/profiler

Looks up a username across many sites

recon/companies-multi/github_miner

GitHub organization and members

recon/contacts-credentials/hibp_breach

Emails found in breaches (HIBP)

Reporting

Export of workspace data

reporting/html

HTML report

reporting/csv

CSV export

reporting/json

JSON export

reporting/xlsx

Excel export

Discovery & Import

File discovery and import of existing data

discovery/info_disclosure/interesting_files

Exposed sensitive files (robots.txt, sitemap…)

import/nmap

Import Nmap results (XML)

import/list

Import a list into a table

import/csv_file

Import a CSV file

API configuration

Configure API keys to get the most out of your investigations

Shodan

Required

Search for internet-connected devices

keys add shodan_api YOUR_API_KEY

Bing

Required

Subdomain search via the Bing API

keys add bing_api YOUR_API_KEY

Twitter

Optionnel

Search mentions and profiles

keys add twitter_api YOUR_API_KEY && keys add twitter_secret YOUR_SECRET

GitHub

Optionnel

Code repository analysis

keys add github_api YOUR_API_KEY

Hunter.io

Optionnel

Email address search

keys add hunter_io YOUR_API_KEY

Typical workflow

Follow these steps for an effective investigation with Recon-ng

1

Create the workspace

Create a workspace dedicated to the project

[recon-ng] > workspaces create my_project
2

Configure API keys

Add the required API keys

[recon-ng] > keys add shodan_api YOUR_KEY
3

Select a module

Load the appropriate module

[recon-ng] > modules load discovery/info_disclosure/interesting_files
4

Set the options

Configure the module's parameters

[recon-ng] > options set SOURCE example.com
5

Run

Run the module

[recon-ng] > run
6

Review the results

Examine the collected data

[recon-ng] > show hosts

Best practices

Project organization

  • • Create a separate workspace for each project
  • • Use descriptive workspace names
  • • Document the objectives of each investigation
  • • Back up databases regularly

Optimal configuration

  • • Configure every relevant API key
  • • Check API rate limits
  • • Use proxies for discretion
  • • Test modules before important investigations

Analysis and reporting

  • • Analyze results before moving to the next module
  • • Use the built-in reporting modules
  • • Export data in several formats
  • • Keep a record of the commands you ran

⚠️ Legal and ethical considerations

  • • Respect the APIs' terms of use
  • • Get authorization before investigating people
  • • Check what is legal in your jurisdiction
  • • Protect the personal information you collect
  • • Use the data responsibly
  • • Respect services' rate limits

Useful resources

📚 Documentation and tutorials

  • • Official wiki - Full documentation
  • • Recon-ng Cookbook - Recipes and examples
  • • Module Development Guide - Build your own modules
  • • Video Tutorials - Video training

🌐 Community and support

  • • GitHub Repository - Source code and issues
  • • Discord OSINT - User community
  • • Twitter @LaNMaSteR53 - News from the creator
  • • OSINT Forums - Discussions and sharing

Ready to automate your investigations?

Install Recon-ng and start using its powerful modules for your OSINT investigations.

CyberXTEL
100% Free

Ready to put it into practice?

CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.

Discover CyberXTEL