• Enum subdomains with Amass
• Create permutations with DnsGen
• Combination of results, check with MassDNS
• Scan with Aquatone
• New subdomains alerts with open ports

• Installation & Recon tested on Debian 10

Run installer :

./install.sh
source ~/.bashrc

Modify line 4 & 5 of recon.sh and add your result path & your slack webhook token If necessary it is necessary to configure Amass with the desired API keys

./recon.sh -d domain.tld

Options :

-d | --domain  (required) : Launch passive scan (Amass & DnsGen)
-m | --monitor (optional) : Launch monitoring (Port scanning & Slack alerting)

Place a crontab to execute the script periodically in order to be removed from the new subdomains

#Execute recon.sh for domain "domain.tld" each monday at 4:00 AM
0 4 * * 1 /root/recon.sh -d domain.tld -m