$ ./automate

Automate your recon

Two shortcuts: one line you can paste anywhere for a quick look, and one script that goes deep and gives you an HTML report.

⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.

your domain:

## 1 · the one-liner

No installs: only curl, grep and sort, which every Mac and Linux machine already has. It asks four public sources (crt.name, Cert Spotter, HackerTarget, Wayback Machine) for every hostname they know under your domain and saves them to subdomains.txt.

# passive - nothing is sent to your domain

$ D={{target}}; { curl -s "https://crt.name/v1/search?apex=$D"; curl -s "https://api.certspotter.com/v1/issuances?domain=$D&include_subdomains=true&expand=dns_names"; curl -s "https://api.hackertarget.com/hostsearch/?q=$D"; curl -s "https://web.archive.org/cdx/search/cdx?url=*.$D&fl=original&collapse=urlkey&limit=5000"; } | grep -oiE "([a-z0-9_-]+\.)*${D//./\\.}" | tr A-Z a-z | sort -u | tee subdomains.txt

Add a quick live check: each hostname is asked for its status and Server / X-Powered-By headers - version leaks show up immediately.

# + live check (your own domain only)

$ D={{target}}; { curl -s "https://crt.name/v1/search?apex=$D"; curl -s "https://api.certspotter.com/v1/issuances?domain=$D&include_subdomains=true&expand=dns_names"; curl -s "https://api.hackertarget.com/hostsearch/?q=$D"; curl -s "https://web.archive.org/cdx/search/cdx?url=*.$D&fl=original&collapse=urlkey&limit=5000"; printf '%s\nwww.%s\n' "$D" "$D"; } | grep -oiE "([a-z0-9_-]+\.)*${D//./\\.}" | tr A-Z a-z | sort -u | tee subdomains.txt | while read -r h; do printf '%-40s %s\n' "$h" "$({ curl -sI -m 5 "https://$h" || curl -sI -m 5 "http://$h"; } 2>/dev/null | tr -d '\r' | grep -iE '^(HTTP/|server:|x-powered-by:|x-aspnet-version:)' | paste -sd' ' -)"; done

Works in bash and zsh (macOS default). On Windows, run it in WSL or Git Bash. It can't be "everything in one line" - it's the most you get without installing anything.

## 2 · the script: `recon.sh`

For the full picture. It runs every step from the self-recon checklist, aggregates the results, and opens an HTML report on a local web server.

passive (default)

Subdomains from 4 public sources (+ subfinder if installed)
DNS: A, AAAA, MX, NS, TXT, CAA, DNSSEC
Email spoofing: SPF and DMARC policy
Registration dates and nameservers (RDAP)
Archived URLs, URLs with parameters, interesting paths

--active (asks you to confirm)

Which hosts answer, status, title, invalid certificates
Version leaks in headers
Security headers per host (HSTS, CSP, …)
19 exposed files, each verified by content: .git, .env, Swagger, actuator, phpinfo…
--ports: nmap top-100 ports (if installed)

download, read, then run

Don't pipe scripts from the internet into your shell - not even mine. Download it, read it (416 lines), check the hash, then run it.

# download

$ curl -fsSL https://shift-left-kit.pages.dev/recon.sh -o recon.sh

# read it first

$ less recon.sh

# check the SHA-256 (v1.0.0) - must match exactly

$ sha256sum recon.sh # macOS: shasum -a 256 recon.sh

sha256: 9a7a3c655aad58c3be9b8c8d2939b0a2723cb0c627982bb16109d73a1383357b

# passive scan + report

$ bash recon.sh {{target}}

needs:Python 3 - not installed? the command will fail with "command not found"

# active scan (your own domain) + report

$ bash recon.sh --active {{target}}

needs:Python 3 - not installed? the command will fail with "command not found"

# everything, incl. ports

$ bash recon.sh --active --ports {{target}}

needs:Python 3, Nmap install ↗ - not installed? the command will fail with "command not found"

When it finishes, open http://127.0.0.1:8000/. Press Ctrl+C to stop the server. Everything is saved in ./recon-<domain>-<time>/ - the report, summary.json, and all raw data.

Optional: install subfinder for more subdomains. Other options: --no-serve, -p PORT, -o DIR, --max-hosts N, --help.

built safely

Passive by default. Active mode asks you to type “yes” to confirm you're authorized.
The report server listens on 127.0.0.1 only - never on your network.
The report can't attack you. Page titles and headers come from the internet, so everything is HTML-escaped, and the report has a strict CSP and runs no JavaScript.
Input is validated. Only a real domain name gets through - nothing that could inject a shell command.
Polite. Timeouts on every request, 8 hosts at a time, capped at 150 hosts by default.

→ prefer clicking? attack surface lookup · → step by step: self-recon checklist