by thewhiteh4t

thewhiteh4t /FinalRecon

The Last Web Recon Tool You'll Need

548 Stars 173 Forks Last release: Not found MIT License 44 Commits 0 Releases

Available items

No Items, yet!

The developer of this repository has not created any items for sale yet. Need a bug fixed? Help with integration? A different license? Create a request here:

Twitter - Telegram - thewhiteh4t's Blog

| Available | in | | |-|-|-| | BlackArch Linux | SecBSD | Tsurugi Linux | | BlackArch Linux | SecBSD | Tsurugi Linux | | Ninjutsu OS | | | | Ninjutsu OS | | |

FinalRecon is a fast and simple python script for web reconnaissance. It follows a modular structure so in future new modules can be added with ease.


Python For OSINT

  • Hakin9 April 2020






FinalRecon provides detailed information such as :

  • Header Information

  • Whois

  • SSL Certificate Information

  • Crawler

    • html
    • CSS
    • Javascripts
    • Internal Links
    • External Links
    • Images
    • robots
    • sitemaps
    • Links inside Javascripts
    • Links from Wayback Machine from Last 1 Year
  • DNS Enumeration

    • A, AAAA, ANY, CNAME, MX, NS, SOA, TXT Records
    • DMARC Records
  • Subdomain Enumeration

    • Data Sources
    • BuffOver
    • ThreatCrowd
    • AnubisDB
    • ThreatMiner
    • Facebook Certificate Transparency API
      • Auth Token is Required for this source, read Configuration below
  • Traceroute

    • Protocols
    • UDP
    • TCP
    • ICMP
  • Directory Searching

    • Support for File Extensions
    • Directories from Wayback Machine from Last 1 Year
  • Port Scan

    • Fast
    • Top 1000 Ports
    • Open Ports with Standard Services
  • Export

    • Formats
    • txt
    • xml
    • csv


API Keys

Some Modules Use API Keys to fetch data from different resources, these are optional, if you are not using an API key, they will be simply skipped. If you are interested in using these resources you can store your API key in keys.json file.

Path --> finalrecon/conf/keys.json

If you dont want to use a key for a certain data source just set its value to

, by default values of all available data sources are null.

Facebook Developers API

This data source is used to fetch Certificate Transparency data which is used in Subdomain Enumeration

Key Format :


Read More :

Tested on

  • Kali Linux
  • BlackArch Linux

FinalRecon is a tool for Pentesters and it's designed for Linux based Operating Systems, other platforms like Windows and Termux are NOT supported.


BlackArch Linux

pacman -S finalrecon


doas pkg_add finalrecon

Kali Linux

git clone
cd FinalRecon
pip3 install -r requirements.txt


docker pull thewhiteh4t/finalrecon
docker run -it --entrypoint /bin/sh thewhiteh4t/finalrecon


python3 -h

usage: [-h] [--headers] [--sslinfo] [--whois] [--crawl] [--dns] [--sub] [--trace] [--dir] [--ps] [--full] [-t T] [-T T] [-w W] [-r] [-s] [-d D] [-e E] [-m M] [-p P] [-tt TT] [-o O] url

FinalRecon - The Last Recon Tool You Will Need | v1.0.7

positional arguments: url Target URL

optional arguments: -h, --help show this help message and exit --headers Header Information --sslinfo SSL Certificate Information --whois Whois Lookup --crawl Crawl Target --dns DNS Enumeration --sub Sub-Domain Enumeration --trace Traceroute --dir Directory Search --ps Fast Port Scan --full Full Recon

Extra Options: -t T Number of Threads [ Default : 30 ] -T T Request Timeout [ Default : 30.0 ] -w W Path to Wordlist [ Default : wordlists/dirb_common.txt ] -r Allow Redirect [ Default : False ] -s Toggle SSL Verification [ Default : True ] -d D Custom DNS Servers [ Default : ] -e E File Extensions [ Example : txt, xml, php ] -m M Traceroute Mode [ Default : UDP ] [ Available : TCP, ICMP ] -p P Port for Traceroute [ Default : 80 / 33434 ] -tt TT Traceroute Timeout [ Default : 1.0 ] -o O Export Output [ Default : txt ] [ Available : xml, csv ]

# Check headers

python3 --headers

Check ssl Certificate

python3 --sslinfo

Check whois Information

python3 --whois

Crawl Target

python3 --crawl

Directory Searching

python3 --dir -e txt,php -w /path/to/wordlist

full scan

python3 --full



We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.