Information Gathering

recon-ng

recon-ng is web recon built as a framework rather than a single tool. It gives you a console that feels a lot like Metasploit’s — workspaces, modules you load and configure, a database that accumulates results as you go — and a marketplace of modules for pulling from dozens of OSINT sources. Where theHarvester is a one-shot query, recon-ng is where you run a whole recon campaign and keep the findings organized across sessions.

Installed from the AUR; Security → Information Gathering → recon-ng. The package ships three entry points: recon-ng (the interactive console), recon-cli (scriptable one-shots), and recon-web (a Swagger/REST UI).

The help it prints

usage: recon-ng [-h] [-w workspace] [-r filename] [--no-version] [--analytics]
                [--no-marketplace] [--stealth] [--accessible] [--version]

recon-ng - Tim Tomes (@lanmaster53)

options:
  -h, --help        show this help message and exit
  -w workspace      load/create a workspace
  -r filename       load commands from a resource file
  --no-version      disable version check
  --analytics       enable analytics reporting
  --no-marketplace  disable remote module management
  --stealth         disable all passive requests (--no-*)
  --accessible      Use accessible outputs when available
  --version         displays the current version

Using it

Those flags just start recon-ng; the real work happens inside its console. A first session looks like this:

recon-ng
[recon-ng][default] > workspaces create target
[recon-ng][target] > marketplace search
[recon-ng][target] > marketplace install recon/domains-hosts/hackertarget
[recon-ng][target] > modules load recon/domains-hosts/hackertarget
[recon-ng][target][hackertarget] > options set SOURCE target.com
[recon-ng][target][hackertarget] > run

Results land in the workspace’s database, so the next module you run can build on what the last one found. marketplace search and modules search are how you find what’s available; some modules need API keys set with keys add.

For scripted use, recon-cli runs a single module non-interactively, and recon-web exposes the same framework over a local REST API.