Automated Recon Framework

A Bash-based reconnaissance automation tool that streamlines the process of subdomain enumeration, live host detection, screenshot collection, and port scanning.

Features

• Multi-source subdomain enumeration using:

  • Subfinder
  • Assetfinder
  • Amass

• Live host identification using:

  • httprobe

• Screenshot collection using:

  • GoWitness

• Automated Nmap scanning of alive targets

• Organized output structure:

  • Subdomains
  • Screenshots
  • Scan Results

• Reduces manual recon effort and speeds up target discovery.

---

Workflow

Target Domain
      │
      ▼
Subfinder + Assetfinder + Amass
      │
      ▼
Merge & Deduplicate Results
      │
      ▼
httprobe
      │
      ▼
Alive Subdomains
      │
      ├──► GoWitness Screenshots
      │
      └──► Nmap Scan
                  │
                  ▼
           Scan Results

---

Requirements

Install the following tools before running the script:

• Subfinder
• Assetfinder
• Amass
• httprobe
• GoWitness
• Nmap

Installation

Subfinder

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Assetfinder

go install github.com/tomnomnom/assetfinder@latest

Amass

go install github.com/owasp-amass/amass/v4/...@master

httprobe

go install github.com/tomnomnom/httprobe@latest

GoWitness

go install github.com/sensepost/gowitness@latest

Nmap

sudo apt install nmap

---

Usage

chmod +x recon.sh

./recon.sh example.com

---

Output Structure

output/
└── example.com/
    ├── subdomains/
    │   ├── subfinder.txt
    │   ├── assetfinder.txt
    │   ├── amass.txt
    │   └── all_subdomains.txt
    │
    ├── alive/
    │   └── alive.txt
    │
    ├── screenshots/
    │   └── *.png
    │
    └── scans/
        └── nmap_scan.txt

---

Example

./recon.sh hackerone.com

The tool will:

1. Enumerate subdomains.
2. Remove duplicate entries.
3. Identify live hosts.
4. Capture screenshots of live assets.
5. Perform Nmap scans.
6. Store all outputs in organized directories.

---

Disclaimer

This tool is intended for educational purposes and authorized security assessments only. Always obtain proper authorization before scanning or testing any systems.

---

Author

Aniruddh Kumar Yadav

Cybersecurity Enthusiast | Bug Hunter | Automation Developer

GitHub: https://github.com/annithehunter LinkedIn: https://linkedin.com/in/annithehunter