-Name: reconFTW
-Version: v2.7.1.1
-Homepage: https://github.com/six2dez/reconftw
-Licence: MIT

-Description:
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

-Features:

Osint

• Domain information (whois and amass)
• Emails addresses and users (emailfinder)
• Metadata finder (MetaFinder)
• Google Dorks (dorks_hunter)
• Github Dorks (gitdorks_go)
• GitHub org analysis (enumerepo, trufflehog and gitleaks)

Subdomains

• Passive (amass, subfinder and github-subdomains)
• Certificate transparency (crt)
• NOERROR subdomain discovery (dnsx, more info here)
• Bruteforce (puredns)
• Permutations (Gotator, ripgen and regulator)
• JS files & Source Code Scraping (katana)
• DNS Records (dnsx)
• Google Analytics ID (AnalyticsRelationships)
• TLS handshake (tlsx)
• Recursive search (dsieve).
• Subdomains takeover (nuclei)
• DNS takeover (dnstake)
• DNS Zone Transfer (dig)
• Cloud checkers (S3Scanner and cloud_enum)

Hosts

• IP info (whoisxmlapi API)
• CDN checker (ipcdn)
• WAF checker (wafw00f)
• Port Scanner (Active with nmap and passive with smap)
• Port services vulnerability checks (vulners)
• Password spraying (brutespray)

Webs

• Web Prober (httpx)
• Web screenshoting (webscreenshot or gowitness)
• Web templates scanner (nuclei and nuclei geeknik)
• CMS Scanner (CMSeeK)
• Url extraction (gau,waymore, katana, github-endpoints and JSA)
• URL patterns Search and filtering (urless, gf and gf-patterns)
• Favicon Real IP (fav-up)
• Javascript analysis (subjs, JSA, xnLinkFinder, getjswords, Mantra)
• Fuzzing (ffuf)
• URL sorting by extension
• Wordlist generation
• Passwords dictionary creation (pydictor)

Vulnerability checks

• XSS (dalfox)
• Open redirect (Oralyzer)
• SSRF (headers interactsh and param values with ffuf)
• CRLF (crlfuzz)
• Cors (Corsy)
• LFI Checks (ffuf)
• SQLi Check (SQLMap and ghauri)
• SSTI (ffuf)
• SSL tests (testssl)
• Broken Links Checker (katana)
• Prototype Pollution (ppfuzz)
• Web Cache Vulnerabilities (Web-Cache-Vulnerability-Scanner)
• 4XX Bypasser (byp4xx)

Extras

• Multithreading (Interlace)
• Custom resolvers generated list (dnsvalidator)
• Docker container included and DockerHub integration
• Ansible + Terraform deployment over AWS
• Allows IP/CIDR as target
• Resume the scan from last performed step
• Custom output folder option
• All in one installer/updater script compatible with most distros
• Diff support for continuous running (cron mode)
• Support for targets with multiple domains
• Raspberry Pi/ARM support
• 6 modes (recon, passive, subdomains, web, osint and all)
• Out of Scope Support + optional inscope support
• Notification system with Slack, Discord and Telegram (notify) and sending zipped results support

On development now:

v3 with standalone scripts