My recon bash script for bug hunting automation.
Currently work in progress, baseline is set just have to iron it out to be robust.
Comprehensive reconnaissance for bug bounty and penetration testing.
Includes the following:
- subdomain enumeration (amass, subfinder, sublist3r)
- fingerprinting and crawling (httpx, katana)
- URL parameter collecting (GAU, waybackurls)
- Screenshot live URLs (gowitness)
- Fuzzing live URLs and API endpoints (ffuf)
- Attempt 403 forbidden bypasses (ungate)
- Parsing HTML and JS for Info (secretfinder, linkfinder, custom parsers)
- amass, subfinder, sublist3r, httpx, gau, waybackurls, katana, gowitness, ungate, ffuf, secretfinder, linkfinder
git clone <url> clone this repository.
cd reabcon && chmod +x reabcon.sh && chmod +x setup.sh add execution rights to the scripts.
./setup.sh check if you have tools necessary/optional for the main script.
Update the scripts custom User-Agent and arbitrary HTTP header to your specs (global variables at the start).
This tool logs and outputs a lot, recommended an empty working directory.
reabcon -s scope.txt -r 5 -v
-s scope.txt scope list, entries can be *.domain.com or https://domain.com or domain.com.
-r 5 rate limit 5 requests/second - default value.
-v verbose mode.
-b run 403 bypass script ungate, only on logged 403s.
Following option args are still in development:
-w wordlist.txt supply a wordlist for FFUF, work in progress atm.
-H 'Header: val' specify arbitrary http header.