All In One Web Recon
Alternatives To Finalrecon
Project NameStarsDownloadsRepos Using ThisPackages Using ThisMost Recent CommitTotal ReleasesLatest ReleaseOpen IssuesLicenseLanguage
2 days ago7mitPython
All In One Web Recon
Censys Subdomain Finder589
4 months ago1Python
⚡ Perform subdomain enumeration using the certificate transparency logs from Censys.
4 months ago4December 03, 20212mitGo
Scrape domain names from SSL certificates of arbitrary hosts
2 months ago8January 01, 20211mitGo
Golang-based subdomain miner leveraging certificate transparency logs
4 years ago1apache-2.0Python
Just a silly recon tool that uses data from SSL Certificates to find potential host names
Censys Certif Crawl10
7 years agoPython
Crawl certificate information from censys
a year agoPython
A Python script to extract the serial number of a remote Fortinet device.
2 months agomitPython
HuntersEye is designed for Bug Bounty Hunters, and Security Researchers to monitor new subdomains and certificates for specified domains. The primary goal is to streamline and expedite the process of monitoring newly registered subdomains and SSL certificates related to specified target domains.
Alternatives To Finalrecon
Select To Compare

Alternative Project Comparisons

Twitter - Telegram - thewhiteh4t's Blog

FinalRecon is an all in one automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. Instead of executing several tools one after another it can provide similar results keeping dependencies small and simple.

Available In

kali linux finalrecon blackarch finalrecon secbsd finalrecon


Python For OSINT




FinalRecon provides detailed information such as :

  • Header Information

  • Whois

  • SSL Certificate Information

  • Crawler

    • html
      • CSS
      • Javascripts
      • Internal Links
      • External Links
      • Images
    • robots
    • sitemaps
    • Links inside Javascripts
    • Links from Wayback Machine from Last 1 Year
  • DNS Enumeration

    • A, AAAA, ANY, CNAME, MX, NS, SOA, TXT Records
    • DMARC Records
  • Subdomain Enumeration

    • Data Sources
      • BuffOver
      • ThreatCrowd
      • AnubisDB
      • ThreatMiner
      • Facebook Certificate Transparency API
        • Auth Token is Required for this source, read Configuration below
      • VirusTotal
        • API Key is Required
      • Shodan
        • API Key is Required
      • CertSpotter
  • Directory Searching

    • Support for File Extensions
  • Wayback Machine

    • URLs from Last 5 Years
  • Port Scan

    • Fast
    • Top 1000 Ports
  • Export

    • Formats
      • txt
      • json [Coming Soon]


API Keys

Some Modules Use API Keys to fetch data from different resources, these are optional, if you are not using an API key, they will be simply skipped. If you are interested in using these resources you can store your API key in keys.json file.

Path --> $HOME/.config/finalrecon/keys.json

If you don't want to use a key for a certain data source just set its value to null, by default values of all available data sources are null.

Facebook Developers API

This data source is used to fetch Certificate Transparency data which is used in Sub Domain Enumeration


Example :

  "facebook": "9go1kx9icpua5cm|20yhraldrxt6fi6z43r3a6ci2vckkst3"

Read More :

VirusTotal API

This data source is used to fetch Sub Domains which are used in Sub Domain Enumeration

Key Format : KEY

Example :

	"virustotal": "eu4zc5f0skv15fnw54nkhj4m26zbteh9409aklpxhfpp68s8d4l63pn13rsojt9y"

Shodan API

This data source is used to fetch Sub Domains which are used in Sub Domain Enumeration

Key Format : KEY

Example :

	"shodan": "eu4zc5f0skv15fnw54nkhj"

BeVigil API

This data source is used to fetch Sub Domains which are used in Sub Domain Enumeration

Key Format : KEY

Example :

	"bevigil": "bteh9409aklpxhfpp68s8d"

Tested on

  • Kali Linux
  • BlackArch Linux

FinalRecon is a tool for Pentesters and it's designed for Linux based Operating Systems, other platforms like Windows and Termux are NOT supported.


Kali Linux

sudo apt install finalrecon

BlackArch Linux

sudo pacman -S finalrecon


doas pkg_add finalrecon

Other Linux

git clone
cd FinalRecon
pip3 install -r requirements.txt


docker pull thewhiteh4t/finalrecon
docker run -it --entrypoint /bin/sh thewhiteh4t/finalrecon

Also docker user can use this alias to run the finalrecon as the normal CLI user.

alias finalrecon="docker run -it --rm --name finalrecon  --entrypoint 'python3' thewhiteh4t/finalrecon"

And then use finalrecon to start your scan.


If you have any api keys you can easily commit that image in your local machine.

This docker usage needs root to run docker command.


usage: [-h] [--headers] [--sslinfo] [--whois] [--crawl]
                     [--dns] [--sub] [--dir] [--wayback] [--ps]
                     [--full] [-dt DT] [-pt PT] [-T T] [-w W] [-r]
                     [-s] [-sp SP] [-d D] [-e E] [-o O]

FinalRecon - The Last Web Recon Tool You Will Need | v1.1.5

positional arguments:
  url         Target URL

  -h, --help  show this help message and exit
  --headers   Header Information
  --sslinfo   SSL Certificate Information
  --whois     Whois Lookup
  --crawl     Crawl Target
  --dns       DNS Enumeration
  --sub       Sub-Domain Enumeration
  --dir       Directory Search
  --wayback   Wayback URLs
  --ps        Fast Port Scan
  --full      Full Recon

Extra Options:
  -dt DT      Number of threads for directory enum [ Default : 30 ]
  -pt PT      Number of threads for port scan [ Default : 50 ]
  -T T        Request Timeout [ Default : 30.0 ]
  -w W        Path to Wordlist [ Default : wordlists/dirb_common.txt
  -r          Allow Redirect [ Default : False ]
  -s          Toggle SSL Verification [ Default : True ]
  -sp SP      Specify SSL Port [ Default : 443 ]
  -d D        Custom DNS Servers [ Default : ]
  -e E        File Extensions [ Example : txt, xml, php ]
  -o O        Export Format [ Default : txt ]
# Check headers

python3 --headers <url>

# Check ssl Certificate

python3 --sslinfo <url>

# Check whois Information

python3 --whois <url>

# Crawl Target

python3 --crawl <url>

# Directory Searching

python3 --dir <url> -e txt,php -w /path/to/wordlist

# full scan

python3 --full <url>



Popular Recon Projects
Popular Certificate Projects
Popular Security Categories
Related Searches

Get A Weekly Email With Trending Projects For These Categories
No Spam. Unsubscribe easily at any time.
Ssl Certificates
Pentest Tool
Port Scanning