🚀 Learn how to use Recon-ng from scratch to expert level with real-world examples, commands, API tips, and professional automation workflows.

🧠 What is Recon-ng?

Recon-ng is an open-source OSINT (Open Source Intelligence) framework written in Python that helps security researchers, red teamers, and bug bounty hunters automate reconnaissance tasks.

It mimics the Metasploit interface, offering powerful modules to collect intel like domains, hosts, credentials, social profiles, leaked data, and more — all in an automated, database-backed workspace.

🎯 Key Features of Recon-ng

🔧 Feature 🧠 Description
🧩 Modular Design 100+ modules: domains, hosts, ports, emails, creds, companies, social, etc.
🗂️ Workspaces Isolated environments for different recon jobs
🔑 API Key Integration Supports Google, Shodan, Censys, GitHub, Hunter.io, etc.
📄 Reporting Export as CSV, JSON, HTML for documentation
🧠 Automatic DB Storage Stores all data inside a local SQLite DB
🤖 Automation Support Command-line scripting, chaining, and integration with other tools
📦 Built-in Commands Like use, run, set, show, search, export, keys, etc.

🧠 Mastering Recon-ng V5 – Complete OSINT Automation Framework Guide

🎥 Reference Playlist: HackerSploit Recon-ng V5 Full Series

⚙️ Installation

Kali Linux (Preinstalled)

recon-ng

Ubuntu/Debian

git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng
pip3 install -r REQUIREMENTS
./recon-ng

🚦 Getting Started: CLI Help Reference

Once inside the CLI, run:

[recon-ng][default] > help

🧭 Recon-ng Command List:

Command Description
back Exit current context/module
dashboard View a summary of your workspace and modules used
db Interface with the workspace database
exit Exit the framework
help Show help menu
index Developer-only module indexing
keys Add/view/delete API keys for third-party services
marketplace Install/search available modules
modules List, load, and manage modules
options Set and unset module-specific options
pdb Python Debugger (developer tool)
script Record and play scripted sessions
shell Run system shell commands
show Show internal objects (hosts, domains, etc.)
snapshots Manage workspace snapshots
spool Save output to a file
workspaces Create/switch/delete isolated project spaces

🗂️ Workspace & Snapshot Setup

Create a workspace

workspaces create acme_corp
workspaces list
workspaces load acme_corp

Take a snapshot before running scans

snapshots take pre-scan

🔐 API Key Configuration

Many modules require API keys (Shodan, BinaryEdge, Bing, etc.)

Add API Key

keys add shodan_api YOUR_SHODAN_KEY

List all keys

keys list

🧩 Module Marketplace

Search modules

marketplace search whois

Install a module

marketplace install recon/domains-hosts/whois_pocs

Load module

modules load recon/domains-hosts/whois_pocs

Set required options

options set SOURCE example.com

Run module

run

🧱 Database Commands

Recon-ng stores all output in a local SQLite database.

View status of tables

db status

Query a table

db query hosts

Insert manually

db insert hosts hostname=example.com ip_address=1.2.3.4 source=manual

Export table to CSV

db export hosts

📊 Real CLI Example Output

[recon-ng][acme_corp] > db query hosts

+----+-------------------+-------------+---------+
| id |     hostname      | ip_address  | source  |
+----+-------------------+-------------+---------+
| 1  | test.acme.com     | 104.26.10.3 | bing    |
| 2  | mail.acme.com     | 104.26.11.3 | bing    |
+----+-------------------+-------------+---------+

🏢 Real-World Use Case (Industrial Red Team)

🎯 Scenario:

A cybersecurity consultant is hired by a large enterprise to assess their external exposure (no internal access). They use Recon-ng as part of the initial recon phase.

🔄 Workflow:

  1. Create a workspace:

    workspaces create client_enterprise

  2. Run domain reconnaissance:

    modules load recon/domains-hosts/bing
options set SOURCE client.com
run

  3. Harvest emails:

    modules load recon/contacts-credentials/theharvester
options set SOURCE client.com
run

  4. Discover IPs and Ports using Shodan:

    modules load recon/hosts-hosts/shodan_hostname
keys add shodan_api API_KEY
options set SOURCE client.com
run

  5. Export results to CSV for reporting:

    db export hosts
db export contacts

  6. Record session for audit:

    script record session1.rec
# (run modules)
script stop

  7. Present findings to client in report format.

🛡️ Blue Team Use Case

  • SOC team uses Recon-ng to monitor brand exposure and typosquatted domains weekly.
  • Uses automated scripts to spool outputs and alerts when new external assets appear.
  • Integration with email alerting via cronjobs and recon-ng’s scripting mode.

📎 Pro Tips

Tip Details
🔁 Reuse scripts Record common recon workflows with script record and automate repeat assessments.
📂 Use workspaces Never mix multiple engagements. Keep targets isolated.
🔐 Add API keys Modules like Shodan, Censys, and Bing require keys.
📜 Spool outputs Log everything for compliance using spool start.
📡 Combine with Maltego Export CSV and visualize graphically.

🧪 Practice Lab Task

Try this on your own:

workspaces create testlab
marketplace install recon/domains-hosts/bing
modules load recon/domains-hosts/bing
options set SOURCE tesla.com
run
db export hosts

Expected Output:

  • A list of subdomains
  • Their IPs
  • Saved in hosts.csv

📆 Maintenance & Updates

# Weekly update routine
cd ~/recon-ng
git pull
pip3 install -r REQUIREMENTS --upgrade
python3 recon-cli -M  # Check module updates

🏁 Final Thoughts

Recon-ng is a must-learn tool for every OSINT analyst, red teamer, and bug bounty hunter. Once mastered, it saves hours of recon effort while giving deep insights into target infrastructure, emails, and vulnerabilities.

🔗 Resources

🙌 Share Your Feedback!

If this guide helped you, share it with your OSINT friends or drop a ❤️ on LinkedIn.