recon.sh — All-Around Automated Recon#

What It Is#

recon.sh is my all-around recon pipeline. One bash script. Eight phases. Max depth. You give it a target, it runs everything it can, and it auto-skips tools you do not have.

This is not a TryHackMe walkthrough. My Race Conditions post follows a public room. This one is a tool I actually run — against labs, bug bounty scope, and machines I am explicitly allowed to test.

CAUTION

Only run this against systems you own or are explicitly authorized to test (bug bounty scope, signed engagement, lab). Recon against random hosts is illegal. I will not take responsibility if you ignore that.

Output lands in a timestamped tree so you are not grepping a 4,000-line terminal dump at 2am:

1
recon_<target>_<timestamp>/
2
  nmap/   web/   dns/   smb/   msf/
3
  recon_summary.txt

Why I Wrote It#

I already knew the chain. Nmap first. Then whatever the ports tell you — gobuster if 80 is open, enum4linux if 445 is open, sslscan if 443 is open. The problem was not knowledge. The problem was doing it by hand every box, and having the whole night die because nikto crashed.

I wanted one entry point: -t. After that, open ports decide what runs next. A missing binary is a skip. A failed tool is a skip. The run continues.

IMPORTANT

Control. I do not want a single apt package or a single scanner to decide whether the rest of recon happens. That is the same reason the script uses set -uo pipefail and not set -e.

The Pipeline#

Eight phases. Domain targets get DNS and subdomains. An IP or CIDR skips name lookups — IS_DOMAIN is just “does the target contain a letter.”

NOTE

--fast is TCP top-1000 only — no -p-, no full UDP. --skip-udp, --skip-web, --skip-subs, --skip-vuln are escape hatches when you do not have all night.

Design Choices#

Three things that matter more than the ASCII banner.

1
set -uo pipefail   # NOTE: no -e; a single tool failing must not kill the run
2

3
have() { command -v "$1" &>/dev/null; }
4
warn_missing() { echo -e "${YELLOW}[~] $1 not installed — that step will be skipped${RESET}"; }

1
OPEN_TCP=$(grep -hoE "^[0-9]+/tcp[[:space:]]+open" "$OUTDIR"/nmap/tcp_*.txt \
2
           | awk '{print $1}' | cut -d/ -f1 | sort -un | paste -sd, -)
3

4
has_port() { echo ",$OPEN_TCP," | grep -q ",$1,"; }
5

6
# 80/8080/... → http://  |  443/8443/... → https://
7
# then SMB 139/445, FTP 21, LDAP 389 only if has_port says so

1
for p in "${APT_PKGS[@]}"; do
2
  $SUDO apt-get install -y "$p" 2>/dev/null \
3
    && echo -e "  ${GREEN}✔${RESET} $p" \
4
    || echo -e "  ${YELLOW}~ $p not in apt (will try another method or skip)${RESET}"
5
done

How I Actually Run It#

1
./recon.sh --install
2
./recon.sh -t 10.10.10.5
3
./recon.sh -t example.com
4
./recon.sh -t 10.10.10.5 --fast
5
./recon.sh -t 10.10.10.5 -m

That is the whole operator surface I care about. Wordlists default to SecLists / dirb if they exist. Extensions default to the usual junk (php,html,txt,bak,js,...). -m adds Metasploit auxiliary recon after the rest.

Close#

This script does not exploit. It does not “hack the box” for you. It dumps a findings tree — nmap, web, dns, smb — so you know where to look next.

IMPORTANT

Recon is evidence collection. The interesting part is not running four directory busting tools. The interesting part is nmap decides the rest, and one failure does not get to kill the night.