01 · Product name
Recon-ng
Modular reconnaissance console with workspaces and a marketplace.
Published by Tim Tomes.
In short
Recon-ng is a Python reconnaissance framework that feels like a console: workspaces, modules, and a local database of what you collected. It is free and open source. You install modules from its marketplace, add API keys, and run them against a target you are allowed to examine. It is a classic framework, not a hosted search engine.
Product pricing strategy
02
Free
Recon-ng is free. You do not buy a seat to use what the project publishes.
Yes. Recon-ng is free and open source. Modules that call commercial APIs need your own keys.
Utility and features
03
Tim Tomes built Recon-ng for people who wanted Metasploit’s shape without the exploitation. You create a workspace, set a source — a company or a domain — and run modules that fill tables of hosts, contacts, and credentials-shaped leaks the module is willing to store. The discipline of the workspace is the feature. Results stay attached to a case.
- Workspaces. Each investigation gets a workspace and a database. That keeps one client’s domains from mixing with another’s.
- Modules. Install what you need. Keys live in the framework, not in your shell history, if you add them through its keys command.
- Age of the project. Expect to debug a module. Check the source and the API it calls before you depend on it for a deadline.
The marketplace is uneven. Some modules rot when an API changes. Development is quieter than it was when the tool was new, and that belongs in the decision: it is still a clear way to teach or to run a structured passive recon, and it is not where you should expect a weekly stream of new sources. SpiderFoot covers similar ground with a web UI and more modules. Maltego covers it with a graph.
- 1
Install Recon-ng in a virtual environment and create a workspace named for the case.
- 2
Add keys only for modules you will run, against a domain that is in scope.
- 3
Run one module, look at the table it filled, and record the module name in your notes.
- 4
Export before you delete a workspace. The database is the work product.
Caveats
04
Recon-ng is a free framework. Modules wrap other people’s sources. Keys expire, modules bit-rot, and the marketplace is not a promise that a module still works.
The workspace feels authoritative because it is a database. It is still a pile of leads. Scope it. Do not store data you were not allowed to collect just because a module returned it. SpiderFoot and the single-purpose tools in this directory are the comparison, not a hierarchy.
Screenshots
05
Potential use cases
06
- You want a structured notebook for an authorized engagement instead of a folder of scripts. Create a workspace, set the domain in scope, and run one module you have a key for. The output is rows in that workspace, which you can export. Pivot hosts to Amass if you outgrow the module, or to SpiderFoot if you want a GUI correlation. A module with no API key often returns nothing. That is a configuration fact, not a clean domain.
- Show a student how keys, scope, and modules fit. Use a domain you control or a public example the module’s own docs use. The output is the workspace, which is the point of the lesson. Do not point a module at a person because the framework makes it easy. Recon-ng is a runner and a database. The sources have their own terms.
- Decide whether the same job is faster in SpiderFoot. Run one question in each, on the same authorized target, and compare the rows you can actually explain. Keep Recon-ng when you want the workspace and the keys in one place. Keep the specialist tool when you want its depth. Neither output is a finished report.
Hard cases
The case where the first result is easy to over-read.
The empty module is briefed as a negative
A module returns no rows. The report says the domain has no employees. Check the key, the module name, and whether that source even covers the question. Re-run one known-good module so you can tell a dead key from an empty result. Write ‘this module returned nothing on this date,’ and go to theHarvester or Hunter if the question was email.
Questions
Is Recon-ng free?
Yes. Recon-ng is free and open source. Modules that call commercial APIs need your own keys.
Is Recon-ng still maintained?
The project is mature and quieter than SpiderFoot or the ProjectDiscovery tools. Use it when the workspace model helps, and verify modules still run.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Recon-ng repository
https://github.com/lanmaster53/recon-ngDocumentation
Recon-ng README
https://github.com/lanmaster53/recon-ng/blob/master/README.md