reconkit

An interactive CLI wizard for recon tasks in pentesting. Built so you don't have to memorize dozens of ffuf/gobuster/feroxbuster flags — and don't get flooded with 404/403 noise in the output.

The problem

Beginner pentesters end up keeping the syntax of a dozen different recon tools in their head. Worse — many sites respond 200 OK to any nonexistent path or subdomain (custom error pages, wildcard DNS), so filtering by HTTP status code alone doesn't save you from noise.

The solution

reconkit asks a few simple questions (domain → what to search → wordlist size) and then:

1. Builds the correct ffuf command for the task (subdomains via Host-header fuzzing, directories via path fuzzing)
2. Runs a baseline calibration: one request to a guaranteed-nonexistent path/subdomain, to learn what a "noise" response looks like
3. Filters out everything matching that response size — even if the status code is 200

Install

sudo apt install ffuf seclists curl
git clone https://github.com/Saidislom0613/reconkit
cd reconkit

Usage

python3 cli.py

Just answer the prompts:

Enter target domain: example.com
What do you want to do? [1] Find subdomains  [2] Find hidden pages
Which wordlist size? [1] small [2] medium (default) [3] large

Output is a clean list with the noise already removed:

[200] https://api.example.com  (1204 bytes)
[200] https://dev.example.com  (890 bytes)

Architecture (built to be extended)

reconkit/
├── cli.py                    # interactive wizard, entry point
├── core/
│   ├── wordlists.py          # resolves SecLists wordlists by size
│   ├── filters.py            # baseline calibration + noise filtering
│   └── engines/
│       └── ffuf_engine.py    # wrapper around ffuf

Adding a new tool (e.g. gobuster or feroxbuster) means adding another file under core/engines/ with the same function signatures (run_subdomain_scan, run_dir_scan) — cli.py and filters.py don't need to change.

Roadmap

• gobuster / feroxbuster backend as an alternative to ffuf
• Port-scan module
• Directory brute-force with recursion
• Export results to JSON/CSV for reports
• Auto-download SecLists if not found

Disclaimer

This tool is intended for authorized testing only (pentests with the owner's permission, bug bounty programs within scope, CTFs). Using it against systems without authorization is illegal.