AutoRecon: A Multi-Threaded Network Reconnaissance Tool

[Alexa09]

What is AutoRecon?​

AutoRecon is an open-source project built to perform network reconnaissance with automated service enumeration.


The advantage that AutoRecon provides over other information gathering and internet scanning tools is that it allows one to further process—and further act upon—information gathered directly within AutoRecon. This includes performing actions like Nmap as well as running the gathered data through other scanning tools, such as feroxbuster, sslscan, nbtscan, Nikto and more

Installing AutoRecon​

Note: As its dependencies are easily available on KaliLinux, we suggest using AutoRecon on that distribution.


To begin with, ensure you have python3 and pip available.


Next, use Python pip to grab the latest version of AutoRecon and install it:

sudo python3 -m pip install git+https://github.com/Tib3rius/AutoRecon.git


Next, you'll need to install certain dependencies:

sudo apt install seclists curl enum4linux feroxbuster impacket-scripts nbtscan nikto nmap onesixtyone oscanner redis-tools smbclient smbmap snmp sslscan sipvicious tnscmd10g whatweb wkhtmltopdf


Run the command autorecon --help to determine whether it's been successfully installed:

autorecon --help


Which should then give you the following output containing various options available in AutoRecon:

Usage​

Getting started with AutoRecon is super simple—one can even run AutoRecon without any flags or options:

autorecon domain.com


Replace domain.com with a domain name that you wish to scan.


Once the command has finished executing, it should then return the following output:

Analyzing the results​

After a scan completes, AutoRecon saves the scan results in the "results" directory, inside of which a new subdirectory is created for every target being scanned by AutoRecon.


The results structure created by AutoRecon is as shown below:

results

└── domain-name.here

├── exploit

├── loot

├── report

│ ├── local.txt

│ ├── notes.txt

│ ├── proof.txt

│ ├── report.md

│ │ └── domain-name.here

│ │ ├── Commands.md

│ │ ├── Errors.md

│ │ ├── Manual Commands.md

│ │ ├── Patterns.md

│ │ ├── Port Scans

│ │ │ ├── PortScan - All TCP Ports.md

│ │ │ ├── PortScan - Top 100 UDP Ports.md

│ │ │ └── PortScan - Top TCP Ports.md

│ │ └── Services

│ │ ├── Service - tcp-22-ssh

│ │ │ └── Nmap SSH.md

│ │ ├── Service - tcp-443-http

│ │ │ ├── Curl.md

│ │ │ ├── Curl Robots.md

│ │ │ ├── Directory Buster.md

│ │ │ ├── Nmap HTTP.md

│ │ │ ├── SSL Scan.md

│ │ │ ├── whatweb.md

│ │ │ └── wkhtmltoimage.md

│ │ └── Service - tcp-80-http

│ │ ├── Curl.md

│ │ ├── Curl Robots.md

│ │ ├── Directory Buster.md

│ │ ├── Nmap HTTP.md

│ │ ├── whatweb.md

│ │ └── wkhtmltoimage.md

│ └── screenshots

└── scans

├── _commands.log

├── _errors.log

├── _full_tcp_nmap.txt

├── _manual_commands.txt

├── _patterns.log

├── _quick_tcp_nmap.txt

├── tcp22

│ ├── tcp_22_ssh_nmap.txt

│ └── xml

│ └── tcp_22_ssh_nmap.xml

├── tcp443

│ ├── tcp_443_https_curl.html

│ ├── tcp_443_https_feroxbuster_big.txt

│ ├── tcp_443_https_feroxbuster_common.txt

│ ├── tcp_443_https_feroxbuster_raft-large-words.txt

│ ├── tcp_443_https_nmap.txt

│ ├── tcp_443_https_screenshot.png

│ ├── tcp_443_https_whatweb.txt

│ ├── tcp_443_sslscan.html

│ └── xml

│ └── tcp_443_https_nmap.xml

├── tcp80

│ ├── tcp_80_http_curl.html

│ ├── tcp_80_http_curl-robots.txt

│ ├── tcp_80_http_feroxbuster_big.txt

│ ├── tcp_80_http_feroxbuster_common.txt

│ ├── tcp_80_http_feroxbuster_raft-large-words.txt

│ ├── tcp_80_http_nmap.txt

│ ├── tcp_80_http_screenshot.png

│ ├── tcp_80_http_whatweb.txt

│ └── xml

│ └── tcp_80_http_nmap.xml

├── _top_100_udp_nmap.txt

└── xml

├── _full_tcp_nmap.xml

├── _quick_tcp_nmap.xml

└── _top_100_udp_nmap.xml

Click to read more...