FinalRecon is a fast and simple python script for web reconnaissance.
It follows a modular structure so in future new modules can be added with ease.
Features
It provides detailed information such as :
Header Information
Whois
SSL Certificate Information
Crawler
html
- CSS
- Javascripts
- Internal Links
- External Links
- Images
robots
sitemaps
Links inside Javascripts
Links from Wayback Machine from Last 1 Year
DNS Enumeration
- A, AAAA, ANY, CNAME, MX, NS, SOA, TXT Records
- DMARC Records
Subdomain Enumeration
Data Sources
- BuffOver
- crt.sh
ThreatCrowd - AnubisDB
- ThreatMiner
- Facebook Certificate Transparency API
- Auth Token is Required for this source, read Configuration below
Traceroute
Protocols
- UDP
- TCP
- ICMP
Directory Searching
- Support for File Extensions
- Directories from Wayback Machine from Last 1 Year
Port Scan
- Fast
- Top 1000 Ports
- Open Ports with Standard Services
Export
Formats
- txt
- xml
- csv
Configuration
API Keys
Some Modules Use API Keys to fetch data from different resources, these are optional, if you are not using an API key, they will be simply skipped. If you are interested in using these resources you can store your API key in keys.json file.
Path --> finalrecon/conf/keys.json
If you dont want to use a key for a certain data source just set its value to null, by default values of all available data sources are null.
Facebook Developers API
This data source is used to fetch Certificate Transparency data which is used in Subdomain Enumeration
Key Format : APP-ID|APP-SECRET
Read More : https://developers.facebook.com/docs/facebook-login/access-tokens
Tested on
- Kali Linux
- BlackArch Linux
FinalRecon is a suite for Pentesters and it’s designed for Linux based Operating Systems, other platforms like Windows and Termux are NOT supported.
Installation
BlackArch Linux
pacman -S finalrecon
SecBSD
doas pkg_add finalrecon
Kali Linux
git clone https://github.com/thewhiteh4t/FinalRecon.git cd FinalRecon pip3 install -r requirements.txt
Docker
docker pull thewhiteh4t/finalrecon
docker run -it –entrypoint /bin/sh thewhiteh4t/finalrecon
Usage
python3 finalrecon.py -h usage: finalrecon.py [-h] [--headers] [--sslinfo] [--whois] [--crawl] [--dns] [--sub] [--trace] [--dir] [--ps] [--full] [-t T] [-T T] [-w W] [-r] [-s] [-d D] [-e E] [-m M] [-p P] [-tt TT] [-o O] url FinalRecon - The Last Recon Software You Will Need | v1.0.7 positional arguments: url Target URL optional arguments: -h, --help show this help message and exit --headers Header Information --sslinfo SSL Certificate Information --whois Whois Lookup --crawl Crawl Target --dns DNS Enumeration --sub Sub-Domain Enumeration --trace Traceroute --dir Directory Search --ps Fast Port Scan --full Full Recon Extra Options: -t T Number of Threads [ Default : 30 ] -T T Request Timeout [ Default : 30.0 ] -w W Path to Wordlist [ Default : wordlists/dirb_common.txt ] -r Allow Redirect [ Default : False ] -s Toggle SSL Verification [ Default : True ] -d D Custom DNS Servers [ Default : 1.1.1.1 ] -e E File Extensions [ Example : txt, xml, php ] -m M Traceroute Mode [ Default : UDP ] [ Available : TCP, ICMP ] -p P Port for Traceroute [ Default : 80 / 33434 ] -tt TT Traceroute Timeout [ Default : 1.0 ] -o O Export Output [ Default : txt ] [ Available : xml, csv ]
# Check headers
python3 finalrecon.py –headers <url>
# Check ssl Certificate
python3 finalrecon.py –sslinfo <url>
# Check whois Information
python3 finalrecon.py –whois <url>
# Crawl Target
python3 finalrecon.py –crawl <url>
# Directory Searching
python3 finalrecon.py –dir <url> -e txt,php -w /path/to/wordlist
# full scan
python3 finalrecon.py –full <url>
Demo