reconFTW
Automated full-spectrum recon framework chaining subdomain enumeration, probing, and vulnerability checks.
Technical Architecture & Overview
reconFTW orchestrates dozens of recon tools into a single run against a target domain: subdomain enumeration, DNS and certificate analysis, web probing, directory fuzzing, port scanning, and vulnerability checks, with resumable sessions and notification hooks. Configuration files let operators enable or disable stages. It is widely used in bug bounty recon pipelines.
Targeted Technical Use Cases
One-command external attack surface collection for authorized assessments of a domain.
Evaluation & Trade-offs
Core Strengths
- +Chains the best-regarded individual tools automatically.
- +Resumable and modular through its config.
- +Active maintenance with frequent updates.
Trade-Offs & Limitations
- -Resource-hungry on large scopes.
- -Automation still needs human review of results.
Defensive Security Application
External attack surface reviews that mirror what attackers enumerate first.
Frequently Asked Questions
What is reconFTW?→
reconFTW orchestrates dozens of recon tools into a single run against a target domain: subdomain enumeration, DNS and certificate analysis, web probing, directory fuzzing, port scanning, and vulnerability checks, with resumable sessions and notification hooks. Configuration files let operators enable or disable stages. It is widely used in bug bounty recon pipelines.
What is reconFTW used for?→
One-command external attack surface collection for authorized assessments of a domain.
What are the strengths of reconFTW?→
- +Chains the best-regarded individual tools automatically.
- +Resumable and modular through its config.
- +Active maintenance with frequent updates.
What are the limitations of reconFTW?→
- +Resource-hungry on large scopes.
- +Automation still needs human review of results.
How is reconFTW used defensively?→
External attack surface reviews that mirror what attackers enumerate first.