Skip to main content

Technical Architecture & Overview

reconFTW orchestrates dozens of recon tools into a single run against a target domain: subdomain enumeration, DNS and certificate analysis, web probing, directory fuzzing, port scanning, and vulnerability checks, with resumable sessions and notification hooks. Configuration files let operators enable or disable stages. It is widely used in bug bounty recon pipelines.

Targeted Technical Use Cases

One-command external attack surface collection for authorized assessments of a domain.

Evaluation & Trade-offs

Core Strengths

  • +Chains the best-regarded individual tools automatically.
  • +Resumable and modular through its config.
  • +Active maintenance with frequent updates.

Trade-Offs & Limitations

  • -Resource-hungry on large scopes.
  • -Automation still needs human review of results.

Defensive Security Application

External attack surface reviews that mirror what attackers enumerate first.

Frequently Asked Questions

What is reconFTW?

reconFTW orchestrates dozens of recon tools into a single run against a target domain: subdomain enumeration, DNS and certificate analysis, web probing, directory fuzzing, port scanning, and vulnerability checks, with resumable sessions and notification hooks. Configuration files let operators enable or disable stages. It is widely used in bug bounty recon pipelines.

What is reconFTW used for?

One-command external attack surface collection for authorized assessments of a domain.

What are the strengths of reconFTW?
  • +Chains the best-regarded individual tools automatically.
  • +Resumable and modular through its config.
  • +Active maintenance with frequent updates.
What are the limitations of reconFTW?
  • +Resource-hungry on large scopes.
  • +Automation still needs human review of results.
How is reconFTW used defensively?

External attack surface reviews that mirror what attackers enumerate first.