A 9-stage reconnaissance pipeline that takes a domain from zero to a fully-mapped,
vulnerability-scanned attack surface — and outputs a single HTML dashboard to triage it all.
WebReconX automates the reconnaissance phase of a web application penetration test end-to-end. It chains nine industry-standard tools — subdomain enumeration through to automated vulnerability scanning — and compiles every result into one self-contained HTML report, so the first thing you see after a scan is a prioritised dashboard, not a folder of forty text files.
Built to remove repetitive manual recon work from real engagements: one command replaces the first several hours of any web assessment.
Root Domain
│
▼
① Subdomain Enumeration ──────── assetfinder + amass
│
▼
② Live Host Probing ───────────── httprobe
│
▼
③ Subdomain Takeover Detection ── subjack
│
▼
④ Technology Fingerprinting ───── whatweb
│
▼
⑤ Port Scanning ───────────────── nmap
│
▼
⑥ Content Discovery ───────────── feroxbuster
│
▼
⑦ Historical URL Mining ───────── waybackurls
│
▼
⑧ Vulnerability Scanning ──────── nuclei
│
▼
⑨ Visual Screenshot Auditing ──── EyeWitness (optional)
│
▼
📊 Consolidated HTML Report
| # | Stage | Tool | What it finds |
|---|---|---|---|
| 1 | Subdomain Discovery | assetfinder + amass | Passive scraping + active OSINT to map the target's full subdomain footprint |
| 2 | Live Host Verification | httprobe | Which discovered hosts are actually reachable over HTTP/HTTPS |
| 3 | Takeover Detection | subjack | Dangling DNS records pointing to unclaimed cloud services |
| 4 | Technology Fingerprinting | whatweb | CMS, framework, server, and library versions per host |
| 5 | Port Scanning | nmap | Open ports, running services, service versions |
| 6 | Content Discovery | feroxbuster | Hidden directories, backup files, forgotten endpoints |
| 7 | URL Harvesting | waybackurls | Historical URLs and parameters from the Wayback Machine |
| 8 | Vulnerability Scanning | nuclei | CVEs, misconfigurations, exposed panels — 8,000+ community templates |
| 9 | Visual Auditing (optional) | EyeWitness | Screenshots of every live host for fast visual triage |
WebReconX is split into three files, each with a single responsibility:
| File | Role | When it runs |
|---|---|---|
install.sh |
One-time setup — installs all 9 dependencies (assetfinder, amass, nmap, whatweb, feroxbuster, nuclei, etc.) and downloads wordlists | Once, when setting up a new machine |
webreconx.sh |
The orchestrator — a Bash script that runs each tool in sequence, piping the output of one stage into the input of the next | Every time you scan a target |
report_generator.py |
The report builder — a Python script that reads all the raw .txt/.json output files and compiles them into a single styled HTML dashboard |
Automatically, called by webreconx.sh at the end of every scan |
Why Bash and Python, not just one language? Bash is the natural choice for chaining command-line tools and piping output between them — that's what webreconx.sh does for all 9 stages. But generating a formatted HTML report with styled tables and colour-coded severity badges is much cleaner in Python, so that one task is handed off to report_generator.py. You never call it directly — webreconx.sh does that automatically once scanning finishes.
./webreconx.sh example.com
│
├─ Stage 1-9: assetfinder → httprobe → subjack → whatweb →
│ nmap → feroxbuster → waybackurls → nuclei → eyewitness
│
└─ Calls: python3 report_generator.py example.com
│
└─ Reads output files → writes report.html
Every scan ends with a single report.html — dark-themed, self-contained, no server required. Open it in any browser:
- Summary cards — subdomains, live hosts, takeovers, historical URLs, vulnerabilities at a glance
- Vulnerability table — severity-colour-coded findings from nuclei, sorted by risk
- Takeover candidates — flagged in red if any dangling DNS records are found
- Open ports table — parsed directly from nmap output
- Parameter chips — every unique URL parameter found in historical data, ready for fuzzing
python3 report_generator.py example.com --theme dark
Can also be run standalone against any existing recon/ output directory — doesn't require a fresh scan.
git clone https://github.com/THEVIKKISTER/WebReconX.git
cd WebReconX
chmod +x install.sh webreconx.sh
./install.sh./webreconx.sh example.comecho -e "example.com\ntarget2.com\ntarget3.com" > targets.txt
./webreconx.sh -f targets.txtEdit config.conf to change thread counts, wordlists, nuclei severity thresholds, or add a Slack/Discord webhook for scan-complete notifications — no need to touch the script.
# Passive-only, no active scanning (safer for tight scope)
./webreconx.sh example.com --skip-amass --skip-portscan --skip-content --skip-nuclei
# Full aggressive scan with screenshots
./webreconx.sh example.com --with-eyewitness
# See all options
./webreconx.sh --helpAll tunables live in config.conf — no script editing required:
NUCLEI_SEVERITY="critical,high,medium" # what severity findings to report
FEROXBUSTER_WORDLIST="/usr/share/seclists/..."
WEBHOOK_URL="" # Slack/Discord webhook, optional
NOTIFY_ON_CRITICAL_FINDING=true # separate alert for critical/high vulns
REPORT_THEME="dark" # dark | lightexample.com/
└── recon/
├── final.txt Deduplicated subdomain list
├── httprobe/alive.txt Live, HTTP(S)-responding hosts
├── potential_takeovers/ Subdomain takeover candidates
├── fingerprint/fingerprint.json Technology stack per host
├── scans/scanned.{nmap,xml,gnmap} Port scan results
├── content/ Discovered directories per host
├── wayback/
│ ├── wayback_output.txt All historical URLs
│ ├── params/wayback_params.txt Unique parameters (for fuzzing)
│ └── extensions/{js,html,json,php,aspx}.txt
├── vulnerabilities/findings.txt Nuclei findings (JSONL)
├── eyewitness/ Screenshot report (if enabled)
└── report.html ★ Consolidated dashboard
- Linux (developed/tested on Kali Linux)
- Go 1.19+ (assetfinder, httprobe, waybackurls, subjack, nuclei)
- Python 3.8+ (report generator, EyeWitness)
- nmap, whatweb, feroxbuster
All installed automatically by install.sh.
- Docker container for zero-dependency-install usage
- JSON API output mode for CI/CD pipeline integration
- Parallel multi-domain execution (currently sequential)
- Historical scan comparison — diff two reports to show what changed
- GitHub Actions scheduled scanning template
Authorised use only. This tool is intended for security professionals conducting reconnaissance and vulnerability scanning against domains they own or have explicit written authorisation to test. Running WebReconX against systems without permission may violate the Computer Fraud and Abuse Act (CFAA) or equivalent legislation in your jurisdiction. The author accepts no liability for misuse.
Built on the excellent work of tomnomnom (assetfinder, httprobe, waybackurls), OWASP Amass, haccer (subjack), urbanadventurer (WhatWeb), epi052 (feroxbuster), ProjectDiscovery (nuclei), and FortyNorth Security (EyeWitness).