Recon-ng Information gathering tool in Kali Linux

Recon-ng is a Python-based OSINT framework designed to automate information gathering during the reconnaissance phase of cybersecurity assessments. It combines multiple reconnaissance modules into a single interactive command-line environment, enabling users to collect publicly available intelligence from various online sources.

Recon-ng Architecture

Recon-ng follows a modular architecture where each component performs a dedicated function.

• Framework: The framework provides the command-line interface, loads modules, validates configurations and manages reconnaissance workflows.
• Modules: Modules perform individual reconnaissance tasks such as DNS enumeration, WHOIS lookups or contact discovery.
• Workspaces: A workspace stores reconnaissance data for a specific project, keeping different engagements isolated.
• Database: Recon-ng stores discovered domains, hosts, contacts, companies and other intelligence in a SQLite database.
• API Manager: Some modules require API keys to communicate with external intelligence providers. Recon-ng securely stores and manages these credentials.

Installing Recon-ng

Recon-ng is pre-installed in most Kali Linux distributions. Verify the installation:

recon-ng

If it is unavailable, install it using:

sudo apt update
sudo apt install recon-ng

Verify the installed version:

recon-ng --version

Launch the framework:

recon-ng

Here, default represents the active workspace. The interactive shell appears as:

[recon-ng][default] >

Understanding Workspaces

A workspace acts as a separate project environment where Recon-ng stores reconnaissance data. Each workspace maintains its own SQLite database, preventing data from different engagements from mixing. Create a workspace:

workspaces create company_recon

List available workspaces:

workspaces list

Switch to another workspace:

workspaces select company_recon

Delete a workspace:

workspaces remove company_recon

Recon-ng Module System

Recon-ng performs reconnaissance through modules. Each module focuses on a specific information-gathering task and can be loaded independently. Search available modules:

modules search

Search DNS modules:

modules search dns

Load a module:

modules load recon/domains-hosts/bing_domain_web

Display module information:

info

View configurable options:

options list

Configure the target:

options set SOURCE example.com

Run the module:

run

Return to the main menu:

back

Common Recon-ng Module Categories

Each category contains multiple modules designed for specific OSINT tasks.

• Domains: Collect domain-related information.
• Hosts: Discover hosts associated with a domain.
• DNS: Retrieve DNS records and related information.
• WHOIS: Obtain domain registration details.
• Contacts: Identify publicly available contacts.
• Companies: Gather organization-related information.
• Locations: Collect geographical intelligence.
• Reporting: Export reconnaissance results.

Basic Recon-ng Commands

• help: Displays available commands.
• modules search: Searches available modules.
• modules load: Loads a module.
• options list: Displays configurable options.
• options set: Sets module parameters.
• run: Executes the loaded module.

API Key Management

Several Recon-ng modules rely on third-party intelligence services that require API authentication. Proper API configuration enables modules to access additional intelligence sources and improves reconnaissance results. Display configured API keys:

keys list

Add a new API key:

keys add

Remove an API key:

keys remove

Reporting

Recon-ng can export collected intelligence using reporting modules. Load the HTML reporting module:

modules load reporting/html

Generate the report:

run

Limitations of Recon-ng

• Some modules require API keys.
• Results depend on publicly available information.
• Module functionality may change if external services modify their APIs.
• Internet connectivity is required for most reconnaissance modules.
• It focuses on information gathering and does not perform vulnerability exploitation.