⠀⠀⠀⠀⡀⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⣷⠀⠀⢰⣷⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⣿⣧⠀⣼⣿⣇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⢸⣿⣿⡆⠘⣿⣿⣆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⣸⣿⣿⣿⡄⠙⠛⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⣿⣿⣿⣿⣷⡀⣿⣿⣿⣿⠿⠿⢿⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⢰⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣄⡀⢻⣿⣿⣿⠟⢿⣿⠛⣦⡀⢻⣿⡇⠀ ⠀⠀⢸⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠛⣶⡞⠻⣶⠛⢻⡄⠹⠀⠀ ⠀⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣿⣷⣾⣿⣶⣿⣿⠆⠀⠀ ⠀⢠⣿⣿⣿⡄⢹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣏⣉⣉⣉⣉⣉⣉⣉⣉⣉⡉⠀⠀⠀ ⠀⢸⣿⣿⣿⣷⡀⠻⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠿⠃⠀⠀⠀ ⠀⣿⣿⣿⣿⣿⣷⣶⣶⣶⣶⣶⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
Asynchronous • Modular • High-Concurrency • EPSS + CISA KEV Prioritization • Masscan & Nuclei Active Scanning • Shodan • Censys • crt.sh • OTX
For complete guides, installation, CLI usage, architecture, and threat intelligence scoring, please visit the ReconHound Official Documentation.
ReconHound is a high-performance External Attack Surface Management (EASM) and Threat Intelligence ecosystem. It maps exposed internet infrastructure, performs targeted vulnerability validation, and enriches findings with real-world exploitation risk data (FIRST EPSS + CISA KEV + Threat Actor Attribution).
The platform consists of two main components:
- ReconExec (
reconx): The high-speed, asynchronous command-line execution engine. - ReconHound Dashboard: The interactive, Cytoscape-powered graphical UI for attack surface visualization.
# 1. Download and install from PyPI
pip install reconhound
# 2. Run the automated setup routine
reconx config setup
# 3. Explore commands
reconx --helpFor prerequisites like Masscan and Nuclei, and advanced API keys configuration, check the Installation Guide.
# Recon a single IP or CIDR Subnet
reconx all 142.250.191.68
reconx all 142.250.191.0/24
# Recon a Domain (Subdomains + Reverse WHOIS + Infrastructure)
reconx all spacex.com
# Recon a Batch Target List from File
reconx all targets.txt
# Fetch Threat Intelligence for a specific CVE
reconx intel CVE-2021-44228
# Start the Interactive EASM Web Dashboard (ReconHound)
reconx hound startFor advanced queries, vulnerability filtering, and reporting, see the CLI Usage Guide.
ReconHound/
├── pyproject.toml # Modern Packaging & Dependency Definition
├── README.md # Project Overview
├── reconexec/ # Main CLI Engine Package (reconx)
│ ├── cli.py # Typer & Rich Command Line Interface entrypoint
│ ├── config.py # Pydantic Settings, .env & Environment Loader
│ ├── core/
│ │ ├── engine.py # Asynchronous Multi-Stage Pipeline & Correlation Engine
│ │ ├── models.py # Unified Pydantic v2 Finding, Host & Intel Data Models
│ │ └── database/
│ │ ├── schema.py # SQLite Relational Schema
│ │ └── storage.py # DatabaseManager Persistence & Query Layer
│ ├── data/ # Central Scan Data Directory
│ │ └── dbs/ # Persistent SQLite Attack Surface Databases (.sqlite)
│ ├── modules/ # Plug-and-Play Intelligence Collectors
│ │ ├── base.py # Abstract Base Class for Recon Modules
│ │ ├── crtsh.py # Certificate Transparency Subdomain Enumeration
│ │ ├── securitytrails.py# SecurityTrails Historical OSINT
│ │ ├── reverse_whois.py # Reverse WHOIS (Hybrid WhoisFreaks + Free Fallback)
│ │ ├── shodan.py # Shodan Host, DNS, Range & Query Scanner
│ │ ├── censys.py # Censys Platform API v3 Asset & Host Intelligence
│ │ ├── alienvault.py # OTX Threat Attribution & Passive DNS
│ │ ├── zone_transfer.py # DNS Zone Transfer (AXFR) Analyzer
│ │ ├── masscan.py # High-Speed Active Port Scanner
│ │ ├── nuclei.py # Asynchronous Nuclei Vulnerability Scanner Engine
│ │ ├── nvd.py # NVD 2.0 (CVSS/CWE) + EPSS Probability + CISA KEV
│ │ └── exploitdb.py # ExploitDB (searchsploit) & GitHub PoC Collector
│ ├── reporters/ # Report Generation Subsystem (CSV, HTML, JSON, Markdown)
│ ├── web/ # Interactive EASM Dashboard Subsystem (ReconHound)
│ │ ├── api/
│ │ │ ├── auth.py # JWT Authentication & Authorization
│ │ │ ├── graph_builder.py # Cytoscape Graph Topology Builder
│ │ │ └── routes.py # FastAPI Endpoints
│ │ ├── static/ # WebGUI Assets (CSS, JS, index.html)
│ │ ├── process_manager.py # Background Daemon Server Manager
│ │ └── server.py # Asynchronous FastAPI & Uvicorn Server
│ └── utils/ # HTTP client, Logger, Setup, and Updater utilities
└── tests/ # Pytest Unit & Integration Test Suite
Lucas S. (Ls4ss)
Developed by Lucas Souza
Feel free to open Issues or submit Pull Requests to contribute!