Bug Bounty Recon Automation Tool
- Take Screenshots from subdomains via @sensepost/gowitness
- Get title and headers from subdomains via @sensepost/gowitness
- General info about company and CIDRs
- Network scan via @nmap/nmap
- HTTP scan via @nmap/nmap
- Collecting and separating archives urls via @tomnomnom/unfurl, @tomnomnom/gf, @lc/gau, @tomnomnom/waybackurls
- Templated-based vulnerability scan with @projectdiscovery/nuclei
- Directory fuzzing with @maurosoria/dirsearch
- SSL scan with @rbsec/sslscan
- Get all host IPs from subdomains
- Clone the repository with
git clone https://github.com/muhammd/domainrec
- Run installation file
./install.sh
- Edit the script
CONFIG
section and enter yourdirsearch_wordlist_path
.
For single domains use :
./domainrec.sh -single apple.com
# or (default mode is single)
./domainrec.sh apple.com
And for wildcard domains use :
./domainrec.sh -wild apple.com