Listen to this Post
Introduction:
In the reconnaissance phase of any security assessment, the speed and accuracy of subdomain enumeration directly determine the attack surface you can uncover. Manual enumeration is no longer viable against modern, sprawling cloud infrastructures. ReconForge addresses this challenge by providing a modular, Bash-based automation framework that orchestrates industry-standard tools like Subfinder, Assetfinder, and Httpx to deliver comprehensive, report-ready intelligence with minimal overhead.
Learning Objectives:
- Master the implementation of passive subdomain enumeration workflows using ProjectDiscovery’s toolchain within a modular Bash architecture.
- Understand how to automate duplicate removal, live host detection, and Markdown report generation for streamlined VAPT reporting.
- Learn to extend and customize reconnaissance frameworks by integrating additional tools such as Amass, DNS resolution, and port scanning modules.
You Should Know:
1. Understanding the ReconForge Architecture and Toolchain
ReconForge is not merely a script; it is a structured framework designed for extensibility. At its core, it automates the sequential execution of multiple reconnaissance tools, handling data pipelining and output formatting behind the scenes. The project employs a clean, modular architecture that separates configuration, core functions, and execution logic into distinct files, making it easy for security professionals to modify or extend specific components without breaking the entire workflow.
The framework leverages three primary tools:
- Subfinder: A fast, passive subdomain enumeration tool that gathers information from a wide array of sources including search engines, DNS services, and certificate transparency logs.
- Assetfinder: Developed by Tomnomnom, this tool finds domains and subdomains potentially related to a given domain, providing an additional layer of coverage.
- Httpx: A fast and multi-purpose HTTP toolkit that allows for probing live hosts, checking for HTTP/HTTPS support, and retrieving server headers.
Step‑by‑step guide to understanding the workflow:
- Target Input: The user provides a target domain (e.g.,
example.com) as a command-line argument. - Passive Enumeration: The framework executes `subfinder` and `assetfinder` concurrently against the target domain.
- Data Aggregation: The results from both tools are merged into a single file.
- Deduplication: The merged list is processed to remove any duplicate subdomain entries, ensuring a clean dataset.
- Live Host Probing: The deduplicated list is fed into
httpx, which checks each subdomain for live web servers and saves the responsive hosts. - Reporting: The framework generates a Markdown report, a scan summary, and logs the entire session for future reference.
2. Installation and Environment Setup
Deploying ReconForge requires a Linux environment or Windows Subsystem for Linux (WSL) with Go installed, as the primary tools are distributed as Go binaries. The setup process is streamlined to get you operational within minutes.
Step‑by‑step installation guide:
1. Clone the Repository:
git clone https://github.com/c00k3r/Subdomain-Automation.git cd Subdomain-Automation
- Install Go Dependencies: Ensure Go is installed on your system. Then, install the required tools:
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install github.com/projectdiscovery/httpx/cmd/httpx@latest go install github.com/tomnomnom/assetfinder@latest
Note: Ensure your `$PATH` includes the Go binary directory (typically
~/go/bin).
3. Make Scripts Executable:
chmod +x recon.sh functions.sh config.sh
- Verify Installation: Run
subfinder -h,assetfinder -h, and `httpx -h` to confirm each tool is correctly installed and accessible.
3. Executing a Reconnaissance Scan
Once the environment is configured, running a scan is straightforward. The framework handles the complexity, allowing you to focus on analyzing the results.
Step‑by‑step usage guide:
- Basic Scan: To initiate a scan against a target domain, use the following command:
./recon.sh -d target.com
Replace `target.com` with your intended domain.
- Monitoring Progress: The script will output progress messages to the console, indicating which phase of the reconnaissance is currently executing (e.g., “Running Subfinder…”, “Probing live hosts…”).
-
Reviewing Output: Upon completion, the framework organizes results into a structured directory:
– output/target.com/subdomains.txt: Contains the complete, deduplicated list of discovered subdomains.
– output/target.com/alive.txt: Lists only the subdomains that responded to HTTP/HTTPS probes.
– output/target.com/summary.txt: Provides a quick statistical summary of the scan.
- Generating Reports: A detailed Markdown report is automatically generated and stored in the `reports/target.com/` directory. This report is ideal for inclusion in VAPT documentation or bug bounty reports.
4. Logging and Troubleshooting
Effective reconnaissance requires not only results but also a clear audit trail. ReconForge incorporates comprehensive logging to aid in troubleshooting and forensic analysis.
Step‑by‑step logging and debugging guide:
- Accessing Logs: All scan activities, including errors and tool outputs, are written to a log file located at
logs/recon.log. - Reviewing Errors: If a scan fails or produces unexpected results, the log file is the first place to check. Common issues include missing tool binaries or network connectivity problems.
- Verbose Output: For more detailed debugging, you can modify the `config.sh` file to enable verbose mode for the underlying tools, though the default settings are optimized for standard use.
- Manual Tool Execution: If a specific tool fails, you can run it manually to diagnose the issue. For example:
subfinder -d target.com -o manual_subdomains.txt
5. Extending ReconForge: The Roadmap and Customization
One of ReconForge’s core strengths is its modular design, which facilitates easy extension. The project roadmap includes several advanced features that users can begin integrating immediately.
Step‑by‑step guide to extending the framework:
- Adding Amass: To integrate OWASP Amass for deeper enumeration, you would add a new function in `functions.sh` that executes `amass enum -passive -d $TARGET` and appends the output to the subdomain list.
- Implementing DNS Resolution: You can add a module that uses `dnsx` (another ProjectDiscovery tool) to resolve IP addresses for each subdomain, providing network-level intelligence.
- Technology Detection: Integrate `whatweb` or `wappalyzer` to fingerprint technologies running on live hosts, which is invaluable for identifying potential vulnerabilities.
- Automated Screenshots: Using tools like
gowitness, you can capture screenshots of each live host and include them in the final report. - Parallel Execution: To improve speed, you can modify the script to run Subfinder and Assetfinder in parallel using background processes (
&) and `wait` commands. -
Practical Application: Integrating ReconForge into Your VAPT Workflow
ReconForge is designed to be a foundational component of a larger VAPT pipeline. Its output can be seamlessly integrated with other tools for vulnerability scanning and exploitation.
Step‑by‑step integration guide:
- Feed into Vulnerability Scanners: Use the `alive.txt` file as input for tools like Nuclei or Nikto to automate vulnerability scanning.
nuclei -l output/target.com/alive.txt -t cves/
- Port Scanning: Pass the list of resolved IPs (from a DNS resolution module) to Nmap for port scanning.
nmap -iL resolved_ips.txt -p- -oN nmap_scan.txt
- Directory Bruteforcing: Use the `alive.txt` list with tools like Feroxbuster or Dirb to discover hidden directories and files.
- CI/CD Integration: The script can be triggered automatically in a CI/CD pipeline to perform daily reconnaissance on monitored domains, with reports emailed to the security team.
- Custom Reporting: The Markdown report can be parsed and converted into other formats (e.g., PDF, HTML) for client delivery using tools like Pandoc.
What Undercode Say:
- Key Takeaway 1: ReconForge exemplifies how simple, clean Bash scripting can transform a tedious manual process into a repeatable, efficient, and professional-grade automation framework. Its modularity is its strongest feature, allowing even novice security analysts to understand and modify the workflow.
- Key Takeaway 2: The project underscores the importance of leveraging existing, battle-tested tools (Subfinder, Httpx) rather than reinventing the wheel. By focusing on orchestration and data processing, ReconForge provides immediate value while maintaining a low barrier to entry for customization.
Analysis: ReconForge is not just a tool; it is a blueprint for how cybersecurity professionals should approach automation. The developer’s emphasis on clean code, structured repositories, and comprehensive documentation reflects a maturity that is often lacking in open-source security projects. This approach ensures that the tool is not only useful today but can also evolve with the user’s needs. The inclusion of a roadmap shows a forward-thinking mindset, positioning ReconForge as a potential cornerstone tool for reconnaissance. However, its current reliance on external binaries means that users must manage their own toolchains, which could be a friction point for less technical users. Overall, ReconForge is a significant contribution to the open-source security community, particularly for those in bug bounty and VAPT roles.
Expected Output:
Introduction:
ReconForge delivers a production-ready solution for automating passive subdomain enumeration, addressing the critical need for speed and accuracy in the reconnaissance phase of security assessments. By orchestrating Subfinder, Assetfinder, and Httpx within a modular Bash framework, it provides security professionals with a reliable, extensible, and report-ready intelligence-gathering platform.
What Undercode Say:
- ReconForge’s modular Bash architecture sets a benchmark for clean, maintainable automation in cybersecurity, making it accessible for both beginners and seasoned professionals.
- The strategic use of ProjectDiscovery’s toolchain demonstrates a practical understanding of the modern security landscape, leveraging best-in-class tools for maximum efficiency and coverage.
Expected Output:
Prediction:
- +1 ReconForge is poised to become a foundational tool in the bug bounty and VAPT communities, driving a trend towards modular, scriptable automation over monolithic, GUI-based solutions.
- +1 The project’s emphasis on clean code and extensive documentation will likely attract a community of contributors, accelerating the addition of features like DNS resolution, port scanning, and technology detection.
- +1 As the framework matures, it could evolve into a comprehensive reconnaissance suite, potentially reducing the reliance on multiple disparate tools and streamlining the entire pre-engagement phase.
- -1 The dependency on external tools and manual Go installations may limit adoption among less technically inclined security analysts, potentially creating a barrier to entry for those new to the field.
- -1 Without proper maintenance and updates to keep pace with changes in the underlying tools (Subfinder, Httpx), ReconForge risks becoming outdated, highlighting the challenges of maintaining open-source automation frameworks.
- -1 The current lack of parallel execution and Docker support may lead to performance bottlenecks on large-scale targets, limiting its effectiveness in enterprise-level engagements until those features are implemented.
▶️ Related Video (88% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Mrityunjay Guleria – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
