_ ReconLab
Commands  / Information Gathering  / Recon-ng

Recon-ng

Modular OSINT reconnaissance framework.

KaliParrotpassive

pkg: recon-ng

Recon-ng provides a Metasploit-like console for web reconnaissance, with modules for subdomains, contacts, breaches and more, plus a workspace database.

Syntax

recon-ng (then: marketplace/modules workflow)

Example

recon-ng -w acme # then load and run modules

Opens a workspace named "acme"; you then install and run recon modules against your target.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

-w <acme>Open/create a named workspace.
marketplace installInstall modules (in-console).
modules loadLoad a module to run (in-console).
-r <commands.rc>Run a resource (script) file.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

recon-ng

Usage examples

recon-ng -w acme

Open a workspace, then load/run modules.

recon-ng -r recon.rc

Run an automation script.

Advantages
  • Powerful module ecosystem
  • Database-backed workspaces
  • Repeatable, scriptable workflows
Disadvantages
  • Steeper learning curve
  • Many modules need API keys
  • Console UX over CLI one-liners
Tags
#osint#framework

Official docs: recon-ng ↗

Related commands

OWASP Amass

In-depth attack-surface mapping & subdomain enumeration.

theHarvester

Gather emails, subdomains and hosts from public sources.

Frequently asked questions

What is Recon-ng used for?
Recon-ng provides a Metasploit-like console for web reconnaissance, with modules for subdomains, contacts, breaches and more, plus a workspace database.
What is an example Recon-ng command?
A common example is: recon-ng -w acme # then load and run modules — Opens a workspace named "acme"; you then install and run recon modules against your target.
Is Recon-ng part of Kali Linux?
Yes. Recon-ng ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install recon-ng.
What category of security tool is Recon-ng?
Recon-ng is a Information Gathering tool with a passive-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →