← retour aux outils back to tools

# recon-ng

Framework OSINT complet avec une interface façon Metasploit. Modules pour DNS, moisson d'emails, découverte de contacts, réseaux sociaux et géolocalisation. Full-featured OSINT reconnaissance framework with a Metasploit-like interface. Modules for DNS, email harvesting, contact discovery, social media, and geolocation.

↗ https://github.com/lanmaster53/recon-ng

## Overview

recon-ng is a modular OSINT framework with a Metasploit-style console. It automates OSINT collection from hundreds of sources, stores results in a relational database, and generates reports. Each module targets a specific intelligence source (Shodan, HaveIBeenPwned, whois, etc.).

## Getting Started

Launch

    recon-ng

Create a new workspace

    [recon-ng] > workspaces create target_corp

Switch workspace

    [recon-ng] > workspaces load target_corp

List workspaces

    [recon-ng] > workspaces list

## Module Management

Search for modules

    [recon-ng] > marketplace search

    # Search by keyword
    [recon-ng] > marketplace search whois
    [recon-ng] > marketplace search subdomain
    [recon-ng] > marketplace search email

    # Install a module
    [recon-ng] > marketplace install recon/domains-hosts/brute_hosts
    [recon-ng] > marketplace install all   # Install all

List installed modules

    [recon-ng] > modules list

    # Load and use a module
    [recon-ng] > modules load recon/domains-hosts/brute_hosts
    [recon-ng][brute_hosts] > info          # Show options
    [recon-ng][brute_hosts] > options set SOURCE target.com
    [recon-ng][brute_hosts] > run

## Adding Seeds

Add a domain to the database

    [recon-ng] > db insert domains

Add a company name

    [recon-ng] > db insert companies

Add a contact name

    [recon-ng] > db insert contacts

    # Show current data
    [recon-ng] > show domains
    [recon-ng] > show hosts
    [recon-ng] > show contacts
    [recon-ng] > show emails

## Common Module Workflows

    # Domain → Subdomains
    [recon-ng] > modules load recon/domains-hosts/hackertarget
    [recon-ng][hackertarget] > options set SOURCE target.com
    [recon-ng][hackertarget] > run

    # Domains → Email addresses
    [recon-ng] > modules load recon/domains-contacts/whois_pocs
    [recon-ng][whois_pocs] > options set SOURCE target.com
    [recon-ng][whois_pocs] > run

    # Hosts → Ports (via Shodan)
    [recon-ng] > modules load recon/hosts-ports/shodan_ip
    [recon-ng][shodan_ip] > keys add shodan_api YOUR_KEY
    [recon-ng][shodan_ip] > run

    # Contacts → Social networks
    [recon-ng] > modules load recon/contacts-profiles/fullcontact
    [recon-ng][fullcontact] > keys add fullcontact_api YOUR_KEY
    [recon-ng][fullcontact] > run

    # Hosts → Geolocation
    [recon-ng] > modules load recon/hosts-locations/freegeoip
    [recon-ng][freegeoip] > run

## API Keys

List required API keys for a module

    [recon-ng] > keys list

    # Add API key
    [recon-ng] > keys add shodan_api YOUR_KEY
    [recon-ng] > keys add virustotal_api YOUR_KEY
    [recon-ng] > keys add github_api YOUR_TOKEN

## Reporting

    # Generate HTML report
    [recon-ng] > modules load reporting/html
    [recon-ng][html] > options set FILENAME report.html
    [recon-ng][html] > run

    # CSV report
    [recon-ng] > modules load reporting/csv
    [recon-ng][csv] > run

## Tips

- The database persists between sessions — your workspace accumulates data over time
- Chain modules: discover subdomains, then resolve IPs, then look up ports on Shodan
- `show schema` reveals all database tables and their columns
- Many modules can use `*` as SOURCE to process all existing records in a table

Module categories

    recon/        Core recon modules
      domains-hosts/     Domain → host enumeration
      domains-contacts/  Domain → contact info
      hosts-hosts/       Host → host relationships
      hosts-ports/       Host → port discovery
      contacts-contacts/ Contact enrichment
      contacts-profiles/ Social media profiles
      profiles-contacts/ Profile → contact
      locations-*        Geolocation

    discovery/    Service/protocol discovery
    exploitation/ Active exploitation helpers
    import/       Data import
    reporting/    Report generation

## Vue d’ensemble

recon-ng est un framework OSINT modulaire avec une console de style Metasploit. Il automatise la collecte OSINT depuis des centaines de sources, stocke les résultats dans une base de données relationnelle et génère des rapports. Chaque module cible une source de renseignement spécifique (Shodan, HaveIBeenPwned, whois, etc.).

## Démarrage

    # Lancer
    recon-ng

    # Créer un nouvel espace de travail
    [recon-ng] > workspaces create target_corp

    # Changer d'espace de travail
    [recon-ng] > workspaces load target_corp

    # Lister les espaces de travail
    [recon-ng] > workspaces list

## Gestion des modules

    # Rechercher des modules
    [recon-ng] > marketplace search

    # Rechercher par mot-clé
    [recon-ng] > marketplace search whois
    [recon-ng] > marketplace search subdomain
    [recon-ng] > marketplace search email

    # Installer un module
    [recon-ng] > marketplace install recon/domains-hosts/brute_hosts
    [recon-ng] > marketplace install all   # Tout installer

    # Lister les modules installés
    [recon-ng] > modules list

    # Charger et utiliser un module
    [recon-ng] > modules load recon/domains-hosts/brute_hosts
    [recon-ng][brute_hosts] > info          # Afficher les options
    [recon-ng][brute_hosts] > options set SOURCE target.com
    [recon-ng][brute_hosts] > run

## Ajout des seeds

    # Ajouter un domaine à la base de données
    [recon-ng] > db insert domains

    # Ajouter un nom d'entreprise
    [recon-ng] > db insert companies

    # Ajouter un nom de contact
    [recon-ng] > db insert contacts

    # Afficher les données actuelles
    [recon-ng] > show domains
    [recon-ng] > show hosts
    [recon-ng] > show contacts
    [recon-ng] > show emails

## Workflows de modules courants

    # Domaine → Sous-domaines
    [recon-ng] > modules load recon/domains-hosts/hackertarget
    [recon-ng][hackertarget] > options set SOURCE target.com
    [recon-ng][hackertarget] > run

    # Domaines → Adresses email
    [recon-ng] > modules load recon/domains-contacts/whois_pocs
    [recon-ng][whois_pocs] > options set SOURCE target.com
    [recon-ng][whois_pocs] > run

    # Hôtes → Ports (via Shodan)
    [recon-ng] > modules load recon/hosts-ports/shodan_ip
    [recon-ng][shodan_ip] > keys add shodan_api YOUR_KEY
    [recon-ng][shodan_ip] > run

    # Contacts → Réseaux sociaux
    [recon-ng] > modules load recon/contacts-profiles/fullcontact
    [recon-ng][fullcontact] > keys add fullcontact_api YOUR_KEY
    [recon-ng][fullcontact] > run

    # Hôtes → Géolocalisation
    [recon-ng] > modules load recon/hosts-locations/freegeoip
    [recon-ng][freegeoip] > run

## Clés API

    # Lister les clés API requises pour un module
    [recon-ng] > keys list

    # Ajouter une clé API
    [recon-ng] > keys add shodan_api YOUR_KEY
    [recon-ng] > keys add virustotal_api YOUR_KEY
    [recon-ng] > keys add github_api YOUR_TOKEN

## Rapports

    # Générer un rapport HTML
    [recon-ng] > modules load reporting/html
    [recon-ng][html] > options set FILENAME report.html
    [recon-ng][html] > run

    # Rapport CSV
    [recon-ng] > modules load reporting/csv
    [recon-ng][csv] > run

## Conseils

- La base de données persiste entre les sessions : votre espace de travail accumule des données au fil du temps
- Chaîner les modules : découvrir des sous-domaines, puis résoudre les IP, puis chercher les ports sur Shodan
- `show schema` révèle toutes les tables de la base de données et leurs colonnes
- De nombreux modules peuvent utiliser `*` comme SOURCE pour traiter tous les enregistrements existants d’une table

Catégories de modules

    recon/        Core recon modules
      domains-hosts/     Domain → host enumeration
      domains-contacts/  Domain → contact info
      hosts-hosts/       Host → host relationships
      hosts-ports/       Host → port discovery
      contacts-contacts/ Contact enrichment
      contacts-profiles/ Social media profiles
      profiles-contacts/ Profile → contact
      locations-*        Geolocation

    discovery/    Service/protocol discovery
    exploitation/ Active exploitation helpers
    import/       Data import
    reporting/    Report generation