FinalRecon is an automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. Instead of executing several tools one after another it can provide similar results keeping dependencies small and simple.

Features

FinalRecon provides detailed information such as :

• Header Information
• Whois
• SSL Certificate Information
• Crawler
  • html
    • CSS
    • Javascripts
    • Internal Links
    • External Links
    • Images
  • robots
  • sitemaps
  • Links inside Javascripts
  • Links from Wayback Machine from Last 1 Year
• DNS Enumeration
  • A, AAAA, ANY, CNAME, MX, NS, SOA, TXT Records
  • DMARC Records
• Subdomain Enumeration
  • Data Sources
    • BuffOver
    • crt.sh
    • ThreatCrowd
    • AnubisDB
    • ThreatMiner
    • Facebook Certificate Transparency API
      • Auth Token is Required for this source, read Configuration below
• Traceroute
  • Protocols
    • UDP
    • TCP
    • ICMP
• Directory Searching
  • Support for File Extensions
  • Directories from Wayback Machine from Last 1 Year
• Port Scan
  • Fast
  • Top 1000 Ports
  • Open Ports with Standard Services
• Export
  • Formats
    • txt
    • xml
    • csv

Some Modules Use API Keys to fetch data from different resources, these are optional, if you are not using an API key, they will be simply skipped. If you are interested in using these resources you can store your API key in keys.json file.

Path --> finalrecon/conf/keys.json

If you dont want to use a key for a certain data source just set its value to null, by default values of all available data sources are null.

This data source is used to fetch Certificate Transparency data which is used in Sub Domain Enumeration

Key Format : APP-ID|APP-SECRET

Example :

{  "facebook": "9go1kx9icpua5cm|20yhraldrxt6fi6z43r3a6ci2vckkst3"}

Read More : https://developers.facebook.com/docs/facebook-login/access-tokens

• Kali Linux
• BlackArch Linux

FinalRecon is a tool for Pentesters and it's designed for Linux based Operating Systems, other platforms like Windows and Termux are NOT supported.

pacman -S finalrecon

doas pkg_add finalrecon

git clone https://github.com/thewhiteh4t/FinalRecon.gitcd FinalReconpip3 install -r requirements.txt

docker pull thewhiteh4t/finalrecondocker run -it --entrypoint /bin/sh thewhiteh4t/finalrecon

python3 finalrecon.py -husage: finalrecon.py [-h] [--headers] [--sslinfo] [--whois] [--crawl] [--dns] [--sub]                     [--trace] [--dir] [--ps] [--full] [-t T] [-T T] [-w W] [-r] [-s]                     [-sp SP] [-d D] [-e E] [-m M] [-p P] [-tt TT] [-o O]                     urlFinalRecon - The Last Web Recon Tool You Will Need | v1.1.0positional arguments:  url         Target URLoptional arguments:  -h, --help  show this help message and exit  --headers   Header Information  --sslinfo   SSL Certificate Information  --whois     Whois Lookup  --crawl     Crawl Target  --dns       DNS Enumeration  --sub       Sub-Domain Enumeration  --trace     Traceroute  --dir       Directory Search  --ps        Fast Port Scan  --full      Full ReconExtra Options:  -t T        Number of Threads [ Default : 30 ]  -T T        Request Timeout    [ Default : 30.0 ]  -w W        Path to Wordlist [ Default : wordlists/dirb_common.txt ]  -r          Allow Redirect [ Default : False ]  -s          Toggle SSL Verification [ Default : True ]  -sp SP      Specify SSL Port [ Default : 443 ]  -d D        Custom DNS Servers [ Default : 1.1.1.1 ]  -e E        File Extensions [ Example : txt, xml, php ]  -m M        Traceroute Mode [ Default : UDP ] [ Available : TCP, ICMP ]  -p P        Port for Traceroute [ Default : 80 / 33434 ]  -tt TT      Traceroute Timeout [ Default : 1.0 ]  -o O        Export Output [ Default : txt ] [ Available : xml, csv ]

# Check headerspython3 finalrecon.py --headers <url># Check ssl Certificatepython3 finalrecon.py --sslinfo <url># Check whois Informationpython3 finalrecon.py --whois <url># Crawl Targetpython3 finalrecon.py --crawl <url># Directory Searchingpython3 finalrecon.py --dir <url> -e txt,php -w /path/to/wordlist# full scanpython3 finalrecon.py --full <url>