Recon

Profile-based Nmap reconnaissance with clean, structured TXT + JSON output.

Recon is a lightweight CLI tool designed to simplify Nmap usage through profile-driven scanning. It abstracts complex Nmap scripts, improves output readability, and provides built-in service references to support practical penetration testing workflows.

It supports interactive shell and CLI shortcut mode, custom port overrides, and multi-target execution.

Recon focuses on structured output, reproducible scans, and practical operator workflows.

⚠️ Use responsibly. Only scan systems you own or have explicit permission to test.

---

🚀 Latest Update – 27 Feb 2026

• Removed IP/Host limit restriction
• Added custom port support for port scanning

➡️ View all updates

---

📚 Port Scanning Profiles

For a complete and detailed list of available port profiles and their Nmap mappings:

➡️ View Port Scanning Profile Lists

---

Interactive Mode

---

CLI Help

---

Features

• Two modes

  • Interactive shell: run commands inside recon >
  • CLI shortcut: run directly from terminal

• Port profiles

  • Default / common / deep + service-specific profiles

• Custom port scanning

  • Define specific ports manually for targeted scans

• Flexible multi-target scanning

  • Scan multiple targets via -f <file> (one IP per line)
  • No built-in IP/Host scanning limit

• Structured output

  • --txt pretty human-readable format
  • --json machine-readable results
  • Auto-saves to ~/recon_result/ with timestamped filenames

• Service reference (info <service>)

  • Built-in enumeration checklist & tool examples
  • Example: info smb, info ssh

• Progress & warnings

  • Context-aware warnings (e.g., deep profile in file mode)

---

Requirements

• Go (for install/build)
• nmap installed and accessible in PATH
• Standard utilities like ping (for host check)

Some scan types (e.g., OS detection -O, traceroute) may require elevated privileges depending on your OS/environment.

---

Installation

Using go install

go install github.com/nartodono/recon/cmd/recon@latest

If module resolution issues occur:

GOPROXY=direct GOSUMDB=off go install github.com/nartodono/recon/cmd/recon@main

Using git clone

git clone https://github.com/nartodono/recon.git
cd recon
go build ./cmd/recon

---

Quick Start

recon host 192.168.1.1 --txt
recon port ssh-deep 192.168.1.1 --json
recon info smb

---

Tools Usage

Interactive Mode

Start Recon without arguments:

  recon

Inside the shell:

  recon > host 192.168.1.1 --txt --json
  recon > port 192.168.1.1 -p 3306
  recon > port vuln 192.168.1.1 --txt
  recon > port ssh-deep -f list.txt
  recon > info smb
  recon > profile
  recon > exit

CLI Shortcut Mode

Run directly from terminal:

  recon host 192.168.1.1 --txt --json
  recon port 192.168.1.1 -p 3306
  recon port web-deep 192.168.1.20 --txt --json
  recon port ssh-deep -f list.txt
  recon info smb
  recon list

If no profile is specified:

  recon port 192.168.1.1

The 'default' profile will be used automatically.

Custom Port Usage

By default, each service profile uses its standard port. You can override it using -p <port>.

Example:

recon port ftp 192.168.1.10 -p 9109

This allows scanning a service profile on a non-standard port.

File Mode

Scan multiple targets from file (one IP per line):

  recon host -f targets.txt --txt --json
  recon port -f targets.txt --txt
  recon port deep -f targets.txt --txt --json

🧭 Service Reference (info <service>)

Recon provides quick service cheat-sheets to guide what to check, common misconfigurations, and example enumeration commands.

Examples:

recon info smb
recon info ssh

---

Output Options

--txt Print formatted text output --json Print structured JSON output

Both flags can be used together.

---

Notes

• Results are automatically saved to: ~/recon_result/

• Output filenames follow: recon-host-YYYYMMDD-HHMMSS.txt recon-host-YYYYMMDD-HHMMSS.json recon-port-YYYYMMDD-HHMMSS.txt recon-port-YYYYMMDD-HHMMSS.json

• Recon validates required dependencies on startup (nmap, ping)

---

Example

Vulnerability Scan

Host Scan

Port Scan

Saved TXT Output

Saved JSON Output