โโโโโโโ โโโโโโโโ โโโโโโโ โโโโโโโ โโโโ โโโ โโโโโโโ โโโ โโโ โโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโโโ โโโโโโโโโโโโโโโ โโโโโโโโโโโ
โโโโโโโโโโโโโโ โโโ โโโ โโโโโโโโโโโโโโโ โโโโโโ โโโโโโ โโโโโโโโโโโ
โโโโโโโโโโโโโโ โโโ โโโ โโโโโโโโโโโโโโโโโโโโโโ โโโโโโโ โโโโโโโโโโโโ
โโโ โโโโโโโโโโโโโโโโโโโโโโโโโโโโ โโโ โโโโโโโโโโโโโโโ โโโโโโโ โโโ โโโ
โโโ โโโโโโโโโโโ โโโโโโโ โโโโโโโ โโโ โโโโโ โโโโโโโ โโโโโ โโโ โโโ
This project is currently in version 1.1 and is considered a prototype.
There may be bugs, errors, or incomplete features present in this version. Please make sure to verify and test everything carefully before using it in any production environment.
๐ง Note: Development is in progress for version v1.2
Sample_Video.mp4
A powerful Linux-based command-line reconnaissance tool designed to automate key phases of bug bounty and penetration testing reconnaissance. Professional Edition with enhanced UI and automatic dependency management.
- ๐ Wayback URL Collection: Gather historical URLs from archive services
- ๐ Parameter Extraction: Extract HTTP query parameters from URLs
- ๐ Subdomain Enumeration: Discover subdomains using multiple tools
- ๐ก Live Host Detection: Identify active web hosts
- โก JavaScript Analysis: Extract endpoints from JavaScript files
- ๐ Sensitive File Detection: Scan for exposed sensitive files
- ๐ธ Screenshot Capture: Capture screenshots of web assets
- ๐จ Professional CLI Interface: Beautiful, colorful, and interactive
- ๐ Automatic Dependency Management: Auto-install and update dependencies
- ๐ก๏ธ Python 3.12+ Compatible: Latest Python version support
- ๐ฆ Modular Architecture: Easy to extend and customize
- Python 3.12+ (required)
- Linux operating system (Kali, Ubuntu, Debian recommended)
No manual installation needed! Reco-Nova automatically checks and installs dependencies:
# Clone the repository
git clone https://github.com/SkillDevloper/Reco-Nova.git
cd reco-nova
# Run any command - dependencies auto-install!
python reco-nova.py --helpIf you prefer manual setup:
# Install Python dependencies
pip install -r requirements.txt
# Check dependencies
python reco-nova.py --check-depsEnhanced functionality with these tools:
# Install Go tools
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/tomnomnom/assetfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/sensepost/gowitness@latest
# Add Go tools to PATH
export PATH=$PATH:~/go/bin
echo 'export PATH=$PATH:~/go/bin' >> ~/.bashrcExperience the beautiful professional interface:
python reco-nova.py -iFeatures:
- ๐จ Colorful menu system
- ๐ Real-time progress feedback
- ๐ Interactive domain input
- โจ Professional animations
- ๐ก๏ธ Error handling with prompts
python reco-nova.py -d example.compython reco-nova.py -d example.com --full# Collect Wayback URLs
python reco-nova.py -d example.com --wayback
# Extract Parameters
python reco-nova.py -d example.com --params
# Discover Subdomains
python reco-nova.py -d example.com --subs
# Detect Live Hosts
python reco-nova.py -d example.com --live
# Analyze JavaScript
python reco-nova.py -d example.com --js
# Scan Sensitive Files
python reco-nova.py -d example.com --sensitive
# Capture Screenshots
python reco-nova.py -d example.com --shots# Run without saving files (memory only) - Individual modules show results on screen
python reco-nova.py -d example.com --wayback --no-save
python reco-nova.py -d example.com --params --no-save
# Full reconnaissance always saves output (comprehensive reporting)
python reco-nova.py -d example.com --full --no-save # Note: Will still save output
# Generate reports only (no individual files)
python reco-nova.py -d example.com --full --reports-only
# Basic usage (no specific module) - shows results on screen if --no-save used
python reco-nova.py -d example.com --no-save# Show help
python reco-nova.py -h
python reco-nova.py --help
# Check dependencies
python reco-nova.py --check-depsThe tool generates organized output in the output/ directory:
output/
โโโ urls.txt # Collected URLs
โโโ parameters.txt # Extracted parameters
โโโ subdomains.txt # Discovered subdomains
โโโ live_hosts.txt # Active hosts
โโโ javascript_files.txt # JavaScript files found
โโโ js_endpoints.txt # Endpoints from JS
โโโ sensitive_files.txt # Sensitive files found
โโโ api_endpoints.txt # API endpoints
โโโ screenshots/ # Captured screenshots
โโโ reports/ # Professional reports
โโโ report_domain.com.json # JSON report
โโโ report_domain.com.html # HTML report (with CSS)
Reco-Nova automatically generates both JSON and HTML reports with comprehensive scan results:
- ๐ Beautiful Design: Modern, responsive interface with gradients
- ๐ฑ Mobile Friendly: Works on all devices and screen sizes
- ๐ Interactive Elements: Hover effects and animations
- ๐ Visual Summary: Color-coded statistics and metrics
โ ๏ธ Risk Highlighting: Sensitive files marked in red- ๐ฏ Professional Layout: Enterprise-ready presentation
- Scan Summary: Count of each data type discovered
- Detailed Results: Complete lists of all findings
- Timestamp: When the scan was performed
- Domain Information: Target domain details
- Risk Assessment: Highlighted sensitive findings
# Reports are automatically generated in:
output/reports/report_<domain>.html
output/reports/report_<domain>.json
# Open HTML report in browser:
# Double-click the .html file or use:
firefox output/reports/report_<domain>.htmlReco-Nova provides intelligent output management based on the type of reconnaissance:
When using --no-save with individual modules, results are displayed on screen:
$ python reco-nova.py -d example.com --wayback --no-save
[*] Output saving: DISABLED
[*] Starting Wayback URL Collection...
[!] Output saving is disabled. Results will not be saved to files.
============================================================
[*] URLs Results (25 found)
============================================================
[ 1] https://example.com/login
[ 2] https://example.com/admin
[ 3] https://example.com/api/user
...
Total urls: 25
============================================================Full reconnaissance always saves output for comprehensive reporting:
$ python reco-nova.py -d example.com --full --no-save
[!] Note: Full reconnaissance always saves output for comprehensive reporting
[*] Output saving: ENABLED
[+] Saved 25 URLs to output/urls.txt
[+] Saved 8 parameters to output/parameters.txt
...
[+] Generated HTML report: output/reports/report_example.com.htmlBasic usage (no specific module) shows results on screen when --no-save is used:
$ python reco-nova.py -d example.com --no-save
[*] Output saving: DISABLED
[*] Starting Basic Reconnaissance...
[+] Collected 25 URLs (displayed on screen)
[+] Extracted 8 parameters (displayed on screen)
...Interactive mode asks users about saving output per operation:
> Save output to files? (Y/n): n
[*] Output saving: DISABLED
# Results displayed on screen- ๐ Formatted Results: Numbered lists with clear formatting
- ๐ฏ First 20 Items: Shows initial results, then summary
- ๐ Total Count: Clear summary of findings
- ๐ Color-Coded: Professional visual presentation
โ ๏ธ Empty Results: Clear message when no items found
- ๐ Color-Coded Output: Different colors for different message types
- ๐ Professional ASCII Art: Beautiful banners and headers
- ๐ฏ Interactive Menus: User-friendly selection system
- โจ Progress Indicators: Real-time operation feedback
- ๐ Auto-Dependency Management: No manual setup required
- ๐ก๏ธ Error Handling: Graceful error recovery with helpful messages
- ๐ Clear Logging: Structured logs with timestamps
- ๐ฎ Intuitive Navigation: Easy-to-use interactive mode
- ๐ป Windows Support: Full compatibility with Windows terminals
- ๐ง Linux Optimized: Best performance on Linux systems
- โก Fast Startup: Quick dependency checking and loading
Collects historical URLs from the Wayback Machine API and filters for relevant web endpoints.
Analyzes collected URLs to extract unique HTTP query parameters for testing.
Uses multiple tools (subfinder, assetfinder) to discover subdomains related to the target domain.
Checks discovered subdomains to identify which hosts are actively responding.
- Discovers JavaScript files from URLs and live hosts
- Extracts API endpoints and hidden paths from JavaScript code
- Identifies potential attack surfaces
Scans live hosts for commonly exposed sensitive files like configuration files, backups, and credentials.
Takes screenshots of live web assets for visual reconnaissance and documentation.
Logs are automatically generated in the logs/ directory with timestamps for debugging and audit purposes:
logs/
โโโ recon_20260310_123456.log # Timestamped session logs
โโโ recon_20260310_234567.log # Multiple session support
# Check if dependencies are properly installed
python reco-nova.py --check-deps
# Manual installation if auto-install fails
pip install -r requirements.txt# Check Python version (requires 3.12+)
python --version
# Upgrade Python if needed
# On Ubuntu/Debian:
sudo apt update && sudo apt install python3.12
# On Kali Linux:
sudo apt update && sudo apt install python3.12# Check if Go is installed
go version
# Install Go if missing
# On Ubuntu/Debian:
sudo apt install golang-go
# On Kali Linux:
sudo apt install golang-go- Use PowerShell or Command Prompt
- Ensure Python is in PATH
- Run as Administrator if needed
For detailed debugging, check the log files:
# View latest log
tail -f logs/recon_$(date +%Y%m%d)_*.log
# Or check all logs
ls -la logs/- Only scan domains you have permission to test
- Focus on passive reconnaissance techniques
- Respect robots.txt and rate limits
- Use responsibly and ethically
- โจ New Professional CLI Interface - Beautiful, colorful, and interactive
- ๐ Automatic Dependency Management - Auto-install and update dependencies
- ๐ก๏ธ Python 3.12+ Support - Latest Python version compatibility
- ๐จ Enhanced Visual Design - Professional ASCII art and color schemes
- ๐ Improved Error Handling - Graceful error recovery
- ๐ Better Logging System - Structured logs with timestamps
- โก Performance Optimizations - Faster startup and execution
This project is licensed under the MIT License - see the LICENSE file for details.
Developed by Daniyal Shahid
This tool is intended for authorized security testing only. Users are responsible for ensuring they have proper authorization before scanning any targets. The developers are not responsible for misuse of this tool.
- โ Only scan domains you own or have explicit permission to test
- โ Focus on passive reconnaissance techniques
- โ Respect robots.txt and rate limits
- โ Use responsibly and ethically
- โ Do not use for malicious purposes
- โ Do not scan targets without authorization
๐ฏ Thank you for using Reco-Nova - Professional Reconnaissance Automation!

