zerorecon

KO | EN

gitlite — search

#ai #chatbot #monitoring #computer-vision #security #chatgpt #csharp #sql #react-native #deep-learning

(★ 9)

No description available.

File Explorer

ZIP Download

- banner.png
- - __init__.py
  - config.py
  - display.py
  - output.py
  - resume.py
  - runner.py
  - toolrunner.py
- - __init__.py
  - prioritizer.py
- - __init__.py
  - admin.py
  - asn.py
  - base.py
  - cloud.py
  - dns_intel.py
  - favicon.py
  - headers.py
  - historical.py
  - javascript.py
  - livehosts.py
  - params.py
  - ports.py
  - screenshots.py
  - secrets.py
  - subdomains.py
  - takeover.py
  - tech.py
  - urls.py
- __init__.py
- __main__.py
- cli.py
.gitignore
LICENSE
README.md
requirements.txt
setup.py

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

```text
███████╗███████╗██████╗  ██████╗ 
╚══███╔╝██╔════╝██╔══██╗██╔═══██╗
  ███╔╝ █████╗  ██████╔╝██║   ██║
 ███╔╝  ██╔══╝  ██╔══██╗██║   ██║
███████╗███████╗██║  ██║╚██████╔╝
╚══════╝╚══════╝╚═╝  ╚═╝ ╚═════╝
```

### *One Command. Complete Recon. Powered by 20+ Integrated Security Tools.*

[![Version](https://img.shields.io/badge/version-2.0.0-blueviolet.svg?style=for-the-badge&logo=git&logoColor=white)](https://github.com/devx07-tech/zerorecon)
[![Tools](https://img.shields.io/badge/tools%20integrated-20%20Tools-brightgreen.svg?style=for-the-badge&logo=linux&logoColor=white)]()
[![Python Version](https://img.shields.io/badge/python-3.10%2B-blue.svg?style=for-the-badge&logo=python&logoColor=white)](https://python.org)
[![Platform](https://img.shields.io/badge/platform-Kali%20Linux%20%7C%20Linux-dragon.svg?style=for-the-badge&logo=kalilinux&logoColor=white)](https://www.kali.org/)
[![License](https://img.shields.io/badge/license-MIT-green.svg?style=for-the-badge)](https://raw.githubusercontent.com/devx07-tech/zerorecon/main/LICENSE)

<br/>

![Zero Recon Banner](https://raw.githubusercontent.com/devx07-tech/zerorecon/main/assets/banner.png)

<br/>

**Zero Recon** is a high-performance, modular reconnaissance framework designed for security researchers, bug bounty hunters, and penetration testers.

Version 2.0 pipelines **20 industry-standard security tools** into a unified, high-speed CLI workflow. Every module employs a **Tool-First with Native Python Fallback** design pattern—if an external tool is missing, ZeroRecon seamlessly falls back to Python engines without interrupting the scan.

---

</div>

## ⚡ Architecture & Pipeline Flow

```text
                     ┌────────────────────────────────────────┐
                     │          TARGET DOMAIN / SCOPE         │
                     └───────────────────┬────────────────────┘
                                         │
 ┌───────────────────────────────────────┴───────────────────────────────────────┐
 │ 01. SUBDOMAIN DISCOVERY                                                      │
 │ subfinder ┼ amass ┼ assetfinder ┼ findomain ┼ crt.sh ┼ HackerTarget ┼ dnsx     │
 └───────────────────────────────────────┬───────────────────────────────────────┘
                                         │
 ┌───────────────────────────────────────┴───────────────────────────────────────┐
 │ 02. LIVE HOST PROBING                                                        │
 │ httpx (Status Codes, HTML Titles, Tech Detect, Content-Length)               │
 └───────────────────┬───────────────────┬───────────────────┬──────────────────┘
                     │                   │                   │
                     ▼                   ▼                   ▼
┌─────────────────────────┐ ┌─────────────────────────┐ ┌─────────────────────────┐
│ 05. PORTS & SERVICES    │ │ 06. TECH & WAF          │ │ 07. URL & CRAWLING      │
│ masscan → nmap -sV      │ │ whatweb ┼ wafw00f       │ │ katana ┼ gospider       │
│ (Service & Version)     │ │ ┼ httpx tech-detect     │ │ hakrawler ┼ gau ┼ wayback│
└─────────────────────────┘ └─────────────────────────┘ └────────────┬────────────┘
                                                                     │
                                                                     ▼
┌─────────────────────────┐ ┌─────────────────────────┐ ┌─────────────────────────┐
│ 10. SECRET EXPOSURE     │ │ 14. TAKEOVER CHECK      │ │ 09. JS INTELLIGENCE     │
│ nuclei (exposures)      │ │ subjack ┼ nuclei        │ │ katana -jc              │
│ ┼ Regex Entropy Suite   │ │ ┼ CNAME Fingerprints    │ │ ┼ Endpoint Extraction   │
└─────────────────────────┘ └─────────────────────────┘ └─────────────────────────┘
```

---

## 🌟 Key Features

- **🚀 20 Integrated Recon Tools:** Harnesses `subfinder`, `amass`, `assetfinder`, `findomain`, `dnsx`, `httpx`, `nmap`, `masscan`, `katana`, `gospider`, `hakrawler`, `gau`, `waybackurls`, `nuclei`, `whatweb`, `wafw00f`, `gobuster`, `ffuf`, `subjack`, and `gowitness`.
- **🛡️ Graceful Python Fallbacks:** 100% operational guarantee. If any binary is missing, ZeroRecon falls back to built-in Python routines.
- **🧱 100% Modular Design:** Simple, extensible `BaseModule` architecture allowing easy custom module creation.
- **🎨 Rich Terminal UI:** Dynamic tool discovery checklist, colorized status badges, progress bars, and formatted scan summaries.
- **🎯 Asset Prioritization Engine:** Automatically scores discovered assets into **CRITICAL**, **HIGH**, **MEDIUM**, and **LOW** risk tiers based on attack surface and exposure indicators.
- **🔄 Scan Resuming:** State persistence via `.zerorecon_state.json` allows seamless continuation of interrupted scans.
- **📜 Historical Tracking:** Built-in diff engine compares previous vs. current scan outputs to highlight newly exposed subdomains or services.

---

## 🛠️ Module & Tool Breakdown

Zero Recon features **17 modular reconnaissance phases**:

---

## 📥 Installation

### 1. Clone & Install Framework
```bash
git clone https://github.com/devx07-tech/zerorecon.git
cd zerorecon
python3 -m pip install -e . --break-system-packages
```

### 2. Install External Recon Tools (Recommended)
To unlock full multi-tool performance, install the recommended security tools on your system (pre-installed on Kali Linux or easily installed via `apt` & `go`):

```bash
# APT package installation
sudo apt update && sudo apt install -y \
  subfinder amass assetfinder findomain dnsx httpx nmap masscan \
  gospider hakrawler nuclei whatweb wafw00f gobuster ffuf subjack gowitness

# Go package installation (optional for latest versions)
go install github.com/lc/gau/v2/cmd/gau@latest
go install github.com/tomnomnom/waybackurls@latest
go install github.com/projectdiscovery/katana/cmd/katana@latest
```

---

## 🚀 Quick Start

### 1. Complete Recon Scan
Execute all 17 modules with full tool pipelines:
```bash
zerorecon -d target.com --full
```

### 2. Selective Recon
Execute targeted modules for fast asset mapping:
```bash
zerorecon -d target.com --modules subdomains,live_hosts,ports,tech,urls
```

### 3. Advanced Tuning
Adjust concurrent threads, custom timeouts, and rate limits:
```bash
zerorecon -d target.com --full -t 100 --timeout 15 --rate-limit 0.2
```

### 4. Resume Interrupted Scan
Skip previously completed modules and continue seamlessly:
```bash
zerorecon -d target.com --full --resume
```

---

## 📁 Output Directory Structure

Scans generate clean, organized artifact directories under `results/target.com/`:

```text
results/
└── target.com/
    ├── .scan_meta.json
    ├── .zerorecon_state.json
    ├── subdomains.txt          # All discovered & validated subdomains
    ├── live.txt                # Live hosts with HTTP status codes & titles
    ├── dns-info.txt            # Complete DNS record dump
    ├── asn.txt                 # ASN & IP CIDR range mapping
    ├── ports.txt               # Open ports & identified services
    ├── nmap-scan.txt           # Detailed raw nmap service scan report
    ├── technologies.txt        # Web servers, frameworks, CMS & WAF results
    ├── urls.txt                # All crawled & passive URLs (filtered)
    ├── params.txt              # Extracted parameters grouped by host
    ├── secrets.txt             # Identified exposed secrets & API tokens
    ├── nuclei-findings.txt     # Raw nuclei exposure scan findings
    ├── headers.txt             # Security header grades & missing headers
    ├── cloud-assets.txt        # Identified S3 buckets & cloud endpoints
    ├── favicon.txt             # Favicon MMH3 fingerprints
    ├── takeover.txt            # Subdomain takeover vulnerability report
    ├── admin-panels.txt        # Admin interfaces & brute-forced paths
    ├── priority-assets.txt     # Prioritized asset triage list
    ├── changes.txt             # Diff comparison vs. previous scan
    ├── javascript/
    │   ├── endpoints.txt       # Extracted API endpoints
    │   └── *.js                # Downloaded JavaScript files
    └── screenshots/
        ├── index.txt           # Screenshot inventory
        └── *.png               # Captured web interface screenshots
```

---

## 🎯 Asset Prioritization Engine

At the conclusion of every scan, the **Prioritization Engine** ranks discovered assets into risk tiers to maximize triage efficiency:

- 🔴 **CRITICAL (Score ≥ 80):** High-risk exposures (Confirmed subdomain takeover, exposed credentials, public admin interfaces with APIs).
- 🟠 **HIGH (Score ≥ 50):** High-value tech stacks (Jenkins, Grafana, Spring, Laravel, Tomcat), multiple exposed ports, public cloud buckets.
- 🟡 **MEDIUM (Score ≥ 25):** Responsive web services with large attack surface (50+ URLs) or missing security headers.
- 🟢 **LOW (Score < 25):** Baseline responsive hosts.

Results are compiled into `priority-assets.txt` for immediate action.

---

## 📜 License

Distributed under the MIT License. See [LICENSE](LICENSE) for details.

<div align="center">
  <sub>Built with ❤️ for Security Researchers, Bug Bounty Hunters & Security Engineers</sub>
</div>

zerorecon

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README