RECON-MASTER

Automated Reconnaissance Toolkit for Security Researchers & Bug Bounty Hunters
Fast • Organized • Lightweight • Bash Powered • Ethical Security Testing

---

Overview

Recon-Master is an automated reconnaissance toolkit written in Bash that streamlines the information gathering phase of penetration testing and bug bounty hunting.

It integrates multiple well-known open-source tools into a single workflow, allowing researchers to enumerate subdomains, identify live hosts, collect URLs, analyze technologies, hunt JavaScript secrets, discover directories, identify SQL parameters, perform authorized SQL injection testing, detect reverse tabnabbing issues, and generate organized reports.

Designed with simplicity and efficiency in mind, Recon-Master keeps all scan results neatly organized for easy review.

Only use this tool on systems you own or are explicitly authorized to test.

---

Features

Automated Recon Modules

• Subdomain Enumeration
• Live Host Detection
• URL Collection
• Directory Discovery
• JavaScript Credentials Hunter
• Technology Analyzer
• SQL Parameter Finder
• Blind SQL Scanner (Authorization Required)
• Reverse Tabnabbing Detector
• Final Report Generation
• Organized Output Structure
• Built-in Tool Checker
• Dependency Installer

---

Modules

Subdomain Enumeration

Collects subdomains using multiple enumeration engines.

Tools:

• Amass
• Subfinder
• Assetfinder

---

Live Host Detection

Identifies active hosts and categorizes them by HTTP status codes.

Tool:

• httpx

Outputs include:

• Live Hosts
• HTTP 200
• HTTP 301
• HTTP 302
• HTTP 403
• Other Status Codes

---

URL Collection

Collects archived and historical URLs from multiple sources.

Tools:

• gau
• waybackurls

---

Directory Discovery

Performs directory and content discovery against live targets.

Tool:

• dirsearch

---

JavaScript Credentials Hunter

Downloads JavaScript files and searches for potentially exposed sensitive information.

Detects patterns including:

• API Keys
• AWS Keys
• Client Secrets
• Secret Keys
• Tokens
• Bearer Tokens
• Passwords
• Usernames
• Private Keys
• Slack Tokens
• Stripe Keys
• GitHub Tokens
• Google API Keys

Downloads:

• Clean JavaScript Files
• Flagged JavaScript Files
• Highlighted Findings
• Combined Findings Report

---

Technology Analyzer

Detects technologies running on discovered hosts.

Tool:

• WhatWeb

Fallback:

• HTTP Header Fingerprinting

---

SQL Parameter Finder

Extracts URLs containing query parameters for further analysis.

Examples:

example.com/index.php?id=1

example.com/search?q=test

---

Blind SQL Scanner

Performs authorized blind SQL injection testing using SQLMap.

Features:

• Batch Mode
• Random User-Agent
• Time Limited Execution
• Explicit Authorization Confirmation

Recon-Master requires user confirmation before running active SQL injection tests.

---

Reverse Tabnabbing Detector

Scans pages for:

• target="_blank"

without:

• rel="noopener"
• rel="noreferrer"

to identify potential reverse tabnabbing vulnerabilities.

---

Built-in Safety

Recon-Master includes multiple safeguards:

• Missing tool detection
• Graceful error handling
• Timeout protection
• Organized logging
• Authorization confirmation before active testing
• Automatic output creation

---

Output Structure

Every scan generates a clean workspace.

recon_results/

└── target_timestamp/

    ├── subdomains/
    │   ├── amass_raw.txt
    │   ├── subfinder_raw.txt
    │   ├── assetfinder_raw.txt
    │   └── subdomains.txt
    │
    ├── live/
    │   ├── live_hosts.txt
    │   ├── live_200.txt
    │   ├── live_403.txt
    │   └── ...
    │
    ├── urls/
    │   ├── urls.txt
    │   ├── gau_raw.txt
    │   └── waybackurls_raw.txt
    │
    ├── dirsearch/
    │
    ├── js/
    │   ├── all/
    │   ├── clean/
    │   ├── with_secrets/
    │   └── js_credentials_findings.txt
    │
    ├── tech/
    │
    ├── sqli/
    │
    ├── tabnabbing/
    │
    ├── reports/
    │
    └── logs/

---

Included Tools

Recon-Master integrates with:

• amass
• subfinder
• assetfinder
• httpx
• gau
• waybackurls
• dirsearch
• whatweb
• sqlmap
• curl
• jq
• python3
• git
• golang

---

Installation

Clone the repository

git clone https://github.com/sana6086/Recon-Master.git

Move into the project directory

cd Recon-Master

Make the script executable

chmod +x recon-master

Launch Recon-Master

./recon-master

---

Menu

1. Check Installed Tools

2. Install Tools

3. Start Scanning

4. Exit

---

Usage

Start the toolkit

./recon-master

Choose:

3

Enter your target

Example

example.com

Recon-Master will automatically execute:

• Subdomain Enumeration
• Live Host Detection
• URL Collection
• Directory Discovery
• JavaScript Secret Hunting
• Technology Detection
• SQL Parameter Discovery
• Blind SQL Testing (Requires Confirmation)
• Reverse Tabnabbing Detection
• Final Report Generation

---

Requirements

Recommended Environment

• Kali Linux
• Ubuntu
• Debian

Recommended Hardware

• 4GB RAM Minimum
• 8GB+ Recommended
• Multi-Core CPU
• Stable Internet Connection

---

Disclaimer

Recon-Master is intended only for authorized security assessments, penetration testing, and educational purposes.

The developer assumes no responsibility for misuse or illegal activities performed using this software.

Always obtain proper written authorization before scanning any target.

---

Developer

Sana A. Rehman

Security Researcher • Bug Bounty Hunter • Bash Developer

GitHub

https://github.com/YOUR_USERNAME

---

Support

If you find Recon-Master useful, consider giving the repository a ⭐ on GitHub.

It helps the project grow and motivates future development.

---

License

This project is licensed under the MIT License.

© 2026 Sana A. Rehman. All Rights Reserved.