Auto Recon

A custom-built OSINT framework, which is designed to streamline and automate various reconnaissance tasks and more. Work in progress...

This tool requires significant setup and configuration.

Tested on Kali Linux v2026.1 (64-bit).

The following information is collected:

• TXT files
• JSON files

The list of tools used can be found here.

Table of Contents

• How to Install
  • Build and Install From the Source
  • Build and Install From the Dockerfile
• How to Run
  • Standalone Run
  • Docker Run
• Usage
• Images

How to Install

Build and Install From the Source

git clone https://github.com/ivan-sincek/auto-recon && cd auto-recon

python3 -m pip install --upgrade build

python3 -m build

python3 -m pip install dist/auto_recon-1.1.0-py3-none-any.whl

Check the Dockerfile on how to install all the required tools.

Build and Install From the Dockerfile

git clone https://github.com/ivan-sincek/auto-recon && cd auto-recon

docker build --no-cache -t auto-recon:1.1.0 .

DNSRecon might not properly load the provided wordlist when it is passed from outside the container environment.

How to Run

Standalone Run

auto-recon -d example.com -o results

auto-recon -d example.com -o results -s subdomains.txt -r resolvers.txt -w wordlist.txt

Docker Run

mkdir workdir # move all your wordlists here

docker run --rm -it -v "./workdir:/home/auto-recon" auto-recon:1.1.0 -d example.com -o results

docker run --rm -it -v "./workdir:/home/auto-recon" auto-recon:1.1.0 -d example.com -o results -s subdomains.txt -r resolvers.txt -w wordlist.txt

DNSRecon might not properly load the provided wordlist when it is passed from outside the container environment.

To debug or add API keys for individual tools, open the shell by running:

docker run --rm -it --entrypoint bash auto-recon:1.1.0

Usage

Auto Recon v1.1.0 ( github.com/ivan-sincek/auto-recon )

Usage:   auto-recon -d domain      -o out     [-s subdomains    ] [-r resolvers    ] [-w wordlist    ]
Example: auto-recon -d example.com -o results [-s subdomains.txt] [-r resolvers.txt] [-w wordlist.txt]

DESCRIPTION
	Not another auto-reconnaissance framework
DOMAIN
	Fully qualified domain name to search
	-d, --domain = example.com | etc.
EXCLUSIONS
	File containing [wildcard] domains, subdomains, and IPs to exclude from the scope
	If restoring a session, the exclusions file from the output directory has priority over the specified file
	-e, --exclusions = exclusions.txt | etc.
NO FILTERING
	Do not limit the scope to the FQDN
	Exclusions are still being respected
	-nf, --no-filtering
SUBDOMAINS
	File containing subdomains to brute force DNS records
	-s, --subdomains = subdomains.txt | etc.
RESOLVERS
	File containing trusted DNS resolvers to resolve DNS records
	-r, --resolvers = resolvers.txt | etc.
WORDLIST
	Wordlist to brute force URL paths
	-w, --wordlist = wordlist.txt | etc.
COLLABORATOR
	Collaborator URL
	-c, --collaborator = https://xyz.interact.sh | https://xyz.burpcollaborator.net | etc.
THREADS
	Number of parallel tools to run per stage
	Default: 5
	-th, --threads = 10 | etc.
OUT
	Output directory
	-o, --out = results | etc.
RESTORE SESSION
	Restore the session from the last breakpoint
	-rs, --restore-session

Images

Figure 1 - Runtime

Figure 2 - Collected Results

Figure 3 - Specific Results Example