retour aux outils back to tools Ducklings

recon-ng

Framework OSINT complet avec une interface façon Metasploit. Modules pour DNS, moisson d'emails, découverte de contacts, réseaux sociaux et géolocalisation. Full-featured OSINT reconnaissance framework with a Metasploit-like interface. Modules for DNS, email harvesting, contact discovery, social media, and geolocation.

↗ https://github.com/lanmaster53/recon-ng

Overview

recon-ng is a modular OSINT framework with a Metasploit-style console. It automates OSINT collection from hundreds of sources, stores results in a relational database, and generates reports. Each module targets a specific intelligence source (Shodan, HaveIBeenPwned, whois, etc.).

Getting Started

Launch

recon-ng

Create a new workspace

[recon-ng] > workspaces create target_corp

Switch workspace

[recon-ng] > workspaces load target_corp

List workspaces

[recon-ng] > workspaces list

Module Management

Search for modules

[recon-ng] > marketplace search
# Search by keyword
[recon-ng] > marketplace search whois
[recon-ng] > marketplace search subdomain
[recon-ng] > marketplace search email

# Install a module
[recon-ng] > marketplace install recon/domains-hosts/brute_hosts
[recon-ng] > marketplace install all   # Install all

List installed modules

[recon-ng] > modules list
# Load and use a module
[recon-ng] > modules load recon/domains-hosts/brute_hosts
[recon-ng][brute_hosts] > info          # Show options
[recon-ng][brute_hosts] > options set SOURCE target.com
[recon-ng][brute_hosts] > run

Adding Seeds

Add a domain to the database

[recon-ng] > db insert domains

Add a company name

[recon-ng] > db insert companies

Add a contact name

[recon-ng] > db insert contacts
# Show current data
[recon-ng] > show domains
[recon-ng] > show hosts
[recon-ng] > show contacts
[recon-ng] > show emails

Common Module Workflows

# Domain → Subdomains
[recon-ng] > modules load recon/domains-hosts/hackertarget
[recon-ng][hackertarget] > options set SOURCE target.com
[recon-ng][hackertarget] > run

# Domains → Email addresses
[recon-ng] > modules load recon/domains-contacts/whois_pocs
[recon-ng][whois_pocs] > options set SOURCE target.com
[recon-ng][whois_pocs] > run

# Hosts → Ports (via Shodan)
[recon-ng] > modules load recon/hosts-ports/shodan_ip
[recon-ng][shodan_ip] > keys add shodan_api YOUR_KEY
[recon-ng][shodan_ip] > run

# Contacts → Social networks
[recon-ng] > modules load recon/contacts-profiles/fullcontact
[recon-ng][fullcontact] > keys add fullcontact_api YOUR_KEY
[recon-ng][fullcontact] > run

# Hosts → Geolocation
[recon-ng] > modules load recon/hosts-locations/freegeoip
[recon-ng][freegeoip] > run

API Keys

List required API keys for a module

[recon-ng] > keys list
# Add API key
[recon-ng] > keys add shodan_api YOUR_KEY
[recon-ng] > keys add virustotal_api YOUR_KEY
[recon-ng] > keys add github_api YOUR_TOKEN

Reporting

# Generate HTML report
[recon-ng] > modules load reporting/html
[recon-ng][html] > options set FILENAME report.html
[recon-ng][html] > run

# CSV report
[recon-ng] > modules load reporting/csv
[recon-ng][csv] > run

Tips

  • The database persists between sessions — your workspace accumulates data over time
  • Chain modules: discover subdomains, then resolve IPs, then look up ports on Shodan
  • show schema reveals all database tables and their columns
  • Many modules can use * as SOURCE to process all existing records in a table
Module categories 
recon/        Core recon modules
  domains-hosts/     Domain → host enumeration
  domains-contacts/  Domain → contact info
  hosts-hosts/       Host → host relationships
  hosts-ports/       Host → port discovery
  contacts-contacts/ Contact enrichment
  contacts-profiles/ Social media profiles
  profiles-contacts/ Profile → contact
  locations-*        Geolocation

discovery/    Service/protocol discovery
exploitation/ Active exploitation helpers
import/       Data import
reporting/    Report generation

Vue d’ensemble

recon-ng est un framework OSINT modulaire avec une console de style Metasploit. Il automatise la collecte OSINT depuis des centaines de sources, stocke les résultats dans une base de données relationnelle et génère des rapports. Chaque module cible une source de renseignement spécifique (Shodan, HaveIBeenPwned, whois, etc.).

Démarrage

# Lancer
recon-ng

# Créer un nouvel espace de travail
[recon-ng] > workspaces create target_corp

# Changer d'espace de travail
[recon-ng] > workspaces load target_corp

# Lister les espaces de travail
[recon-ng] > workspaces list

Gestion des modules

# Rechercher des modules
[recon-ng] > marketplace search
# Rechercher par mot-clé
[recon-ng] > marketplace search whois
[recon-ng] > marketplace search subdomain
[recon-ng] > marketplace search email

# Installer un module
[recon-ng] > marketplace install recon/domains-hosts/brute_hosts
[recon-ng] > marketplace install all   # Tout installer
# Lister les modules installés
[recon-ng] > modules list
# Charger et utiliser un module
[recon-ng] > modules load recon/domains-hosts/brute_hosts
[recon-ng][brute_hosts] > info          # Afficher les options
[recon-ng][brute_hosts] > options set SOURCE target.com
[recon-ng][brute_hosts] > run

Ajout des seeds

# Ajouter un domaine à la base de données
[recon-ng] > db insert domains

# Ajouter un nom d'entreprise
[recon-ng] > db insert companies

# Ajouter un nom de contact
[recon-ng] > db insert contacts
# Afficher les données actuelles
[recon-ng] > show domains
[recon-ng] > show hosts
[recon-ng] > show contacts
[recon-ng] > show emails

Workflows de modules courants

# Domaine → Sous-domaines
[recon-ng] > modules load recon/domains-hosts/hackertarget
[recon-ng][hackertarget] > options set SOURCE target.com
[recon-ng][hackertarget] > run

# Domaines → Adresses email
[recon-ng] > modules load recon/domains-contacts/whois_pocs
[recon-ng][whois_pocs] > options set SOURCE target.com
[recon-ng][whois_pocs] > run

# Hôtes → Ports (via Shodan)
[recon-ng] > modules load recon/hosts-ports/shodan_ip
[recon-ng][shodan_ip] > keys add shodan_api YOUR_KEY
[recon-ng][shodan_ip] > run

# Contacts → Réseaux sociaux
[recon-ng] > modules load recon/contacts-profiles/fullcontact
[recon-ng][fullcontact] > keys add fullcontact_api YOUR_KEY
[recon-ng][fullcontact] > run

# Hôtes → Géolocalisation
[recon-ng] > modules load recon/hosts-locations/freegeoip
[recon-ng][freegeoip] > run

Clés API

# Lister les clés API requises pour un module
[recon-ng] > keys list
# Ajouter une clé API
[recon-ng] > keys add shodan_api YOUR_KEY
[recon-ng] > keys add virustotal_api YOUR_KEY
[recon-ng] > keys add github_api YOUR_TOKEN

Rapports

# Générer un rapport HTML
[recon-ng] > modules load reporting/html
[recon-ng][html] > options set FILENAME report.html
[recon-ng][html] > run

# Rapport CSV
[recon-ng] > modules load reporting/csv
[recon-ng][csv] > run

Conseils

  • La base de données persiste entre les sessions : votre espace de travail accumule des données au fil du temps
  • Chaîner les modules : découvrir des sous-domaines, puis résoudre les IP, puis chercher les ports sur Shodan
  • show schema révèle toutes les tables de la base de données et leurs colonnes
  • De nombreux modules peuvent utiliser * comme SOURCE pour traiter tous les enregistrements existants d’une table
Catégories de modules 
recon/        Core recon modules
  domains-hosts/     Domain → host enumeration
  domains-contacts/  Domain → contact info
  hosts-hosts/       Host → host relationships
  hosts-ports/       Host → port discovery
  contacts-contacts/ Contact enrichment
  contacts-profiles/ Social media profiles
  profiles-contacts/ Profile → contact
  locations-*        Geolocation

discovery/    Service/protocol discovery
exploitation/ Active exploitation helpers
import/       Data import
reporting/    Report generation