Recon Quick — Fast OSINT Presets#

One-command recon using bbot and nmap. Preset workflows for common bug bounty recon tasks.

Prerequisites#

bash

pipx install bbot
# nmap: apt install nmap / brew install nmap

Quick Start#

bash

# Full subdomain enumeration + web probe
python3 {baseDir}/scripts/recon.py target.com --preset full

# Just subdomains
python3 {baseDir}/scripts/recon.py target.com --preset subdomains

# Quick port scan top 100
python3 {baseDir}/scripts/recon.py target.com --preset ports

Presets#

PresetWhat it doesTimesubdomainsSubdomain enum via bbot2-10 minportsTop 100 ports + service detection1-5 minwebHTTP probe + tech fingerprint2-5 minfullSubdomains + ports + web + nuclei10-30 minpassivePassive recon only (DNS, certs, APIs)1-3 min

Options#

• --preset PRESET — Recon preset (default: subdomains)
• --output DIR — Output directory (default: ./recon-output)
• --json — Output as JSON
• --threads N — Thread count (default: 10)
• --wordlist FILE — Custom wordlist for subdomain brute
• --proxy URL — Proxy for web requests

Output Structure#

text

recon-output/
├── target.com/
│   ├── subdomains.txt      # Discovered subdomains
│   ├── live-hosts.txt       # Alive HTTP services
│   ├── ports.txt            # Open ports
│   ├── tech-fingerprints.txt # Detected technologies
│   ├── nuclei-findings.txt  # Vulnerability scan results
│   └── full-report.json     # Everything combined

Integration with Bug Bounty#

bash

# Run recon, generate report
python3 recon.py target.com --preset full --output ./bounties/target
bb-report-template --type recon --target target.com -o report.md

Notes#

• bbot handles rate limiting and scope validation automatically
• Nuclei findings are informational — manual verification required
• Always check program scope before scanning
• Use --proxy socks5://127.0.0.1:9050 for Tor