> For the complete documentation index, see [llms.txt](https://hsaad.gitbook.io/x/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hsaad.gitbook.io/x/tools/recon-hunter.md).

# Recon Hunter

A tool to map the attack surface discovery of any target.

### Tool Architecture

![](/files/FRftDrHqeDAwEVtvQLjX)

### Tool Features

1. Sub-Domains Passive Scraping
2. Sub-Domains Brute Force
3. Sub-Domains Wildcard Removal
4. Sub-Domains Spidering
5. Sub-Domains Takeover
6. IPs Enumeration using Censys
7. Port Scanning
8. Websites' Screenshots
9. Directories & Files Brute Force
10. Internet Archive
11. AWS S3 Buckets
12. Github Leaked Secrets

### Tool Prerequisities

You need to insert the AWS key also the Censys Key to use all the tool features.

#### AWS Key

```shell
aws configure
```

#### Censys Key

```shell
censys config
```

### Tool Usage

```shell
# Installation
git clone https://github.com/hassan0x/ReconHunter
cd ReconHunter
./ReconHunter 0

# Help
./ReconHunter

# Run All the Commands
./ReconHunter 1 $domain_name $github_user
./ReconHunter 1 example.com user1
```

### Tool Demo

The tool has been tried and validated on kali linux.

#### Installation

![](/files/TmQ6JvuPQ1W39g89UPy3)

![](/files/NkcxaHH6cpRzoNdu1DCq)

#### Usage

![](/files/KHpuB1BvUjLfMkjfht9a)

![](/files/hInwF4pkjPUN8EvRb221)

#### Result

![](/files/3CDoRizxbtXny5mJLlgh)

### Tools Used

* Amass
* SubFinder
* MassDNS
* GoSpider
* HTTProbe
* SubOver
* Censys
* Masscan
* Nmap
* Aquatone
* DirSearch
* WayBackUrls
* Unfurl
* S3Scanner
* AWScli
* TruffleHog

### Tool Source Code

{% embed url="<https://github.com/hassan0x/ReconHunter>" %}