Recon Frameworks

Recon frameworks combine multiple data sources, command-line tools, APIs, scans, screenshots, and reports into repeatable workflows. Many support both passive and active techniques, so match modules to the engagement scope before running them.

For purely passive OSINT investigation, use Cyber Intelligence.

OSINT

Primary Frameworks

SpiderFoot

SpiderFoot is an OSINT automation platform with a web UI, templates, and many modules for collecting target data from public sources and APIs.

• Documentation

• SpiderFoot tutorials

• iRed Team: SpiderFoot 101 with Kali and Docker

Recon-ng

Recon-ng is a modular Python reconnaissance framework. It is useful when you want repeatable modules, API-backed lookups, and structured output.

• Recon-ng Wiki

• lanmaster53

• Pluralsight: Technical Information Gathering with Recon-ng

• Black Hills: What's Changed in Recon-ng 5.x

• Black Hills Recon-ng Cheat Sheet

Maltego

Maltego is a graphical link-analysis and OSINT platform for connecting people, domains, infrastructure, social accounts, and other entities.

• Maltego Support and Docs

• Maltego Handbook for Social Media Investigations

Offensive Recon and ASM Frameworks

• BBOT - Recursive modular OSINT and recon framework with subdomain enumeration, port scanning, screenshots, and nuclei support.

• ReconFTW - Automated recon workflow for domains, bug bounty, and pentest targets.

• Sn1per - Automated recon and penetration testing framework with OSINT, scanning, and reporting.

• reNgine - Web application reconnaissance suite with engines, screenshots, correlation, reports, and continuous monitoring.

• OWASP Amass - External attack surface mapping and asset discovery.

• runZero - Network discovery and asset inventory platform.

• ReconNess - Recon management platform for organizing targets and findings.

• Axiom - Dynamic infrastructure framework for distributed recon and offensive workflows.

• JupyterPen - Jupyter-based OSINT and penetration testing toolkit.

Other Frameworks and Toolkits

• sn0int - Semi-automatic OSINT framework and package manager.

• Raccoon - Offensive recon framework with OSINT and active scanning.

• ReconSpider - Information-gathering tool with visual output.

• OWASP Maryam - Modular OSINT and data-gathering framework.

• Discover Scripts - Early-stage penetration test discovery scripts.

• DMitry - Finds subdomains, email addresses, uptime, WHOIS data, and TCP ports.

• finalrecon - Modular web reconnaissance script.

• gasmask - Information-gathering toolkit.

• machinae - Collects public intelligence about IPs, domains, URLs, emails, file hashes, and SSL fingerprints.

Low Signal or Validate Before Use

These are preserved for resource completeness, but validate maintenance and quality before adding them to a workflow.

• DarkSide - Older information-gathering and social engineering toolkit.

• Z4nzu/hackingtool - Large all-in-one hacking tool menu; review modules carefully before use.

• eReKon - Web recon tool that appears incomplete or under active development.