oORecon — Attack Surface Discovery TUI

oORecon is an open-source Python terminal UI for web reconnaissance and attack surface discovery. It helps bug bounty hunters, penetration testers, and OSINT researchers map a domain quickly: DNS recon, subdomain enumeration, port scanning, reverse IP lookup, leaked login URLs, plus per-host sitemap, directory brute-force, and JavaScript endpoint / secret mining.

If you are looking for an all-in-one recon TUI instead of chaining many CLIs, oORecon runs the main checks one after another after you enter an apex domain.

Disclaimer

This is AI slop. Every line was generated by an AI, and none of it was typed by hand — there wasn't time for that. Treat the code as machine output and use it anyway.

Table of contents

• Disclaimer
• What is oORecon?
• Who is it for?
• Features
• Quick start
• How to use
• Why oORecon?
• Project structure
• FAQ
• Legal / ethics
• Credits & dependencies

What is oORecon?

oORecon is a Textual-based TUI that turns a single domain into a live recon dashboard. On lookup it:

1. Resolves DNS records (A, AAAA, NS, MX, SOA, and related)
2. Runs reverse IP against the domain’s DNS A / AAAA addresses
3. Fetches leaked login / credential URLs for the domain (read-only)
4. Scans a large port set against the looked-up domain
5. Enumerates subdomains from certificate transparency and probes HTTPS

Open any live host to continue with content discovery (sitemaps, directories) and JavaScript analysis (endpoints, URLs, and likely secrets with neighbor context).

Domain input is normalized automatically: https://, paths, ports, and leading www. are stripped so you always work from the apex domain.

Who is it for?

• Bug bounty recon when you want one screen for DNS + subdomains + ports + leaks
• Pentest attack-surface mapping before deeper exploitation
• OSINT and asset inventory for a brand or apex domain
• Researchers who prefer a keyboard-driven TUI over a stack of disconnected tools

Features

Domain reconnaissance (main menu)

Module	What it does
DNS recon	Resolve A, AAAA, NS, MX, SOA and related DNS records
Subdomain finder	Certificate-transparency names + HTTPS alive check (Chrome TLS impersonation)
Port scanner	Large port set against the target domain
Reverse IP lookup	Shared-host discovery from DNS A / AAAA
Leaked Login URL	Stealer-log style login / credential URLs (read-only)

DNS recon

Shows the looked-up domain’s DNS surface in one board so you can see exposed IPs and mail/name infrastructure before scanning further.

Subdomain finder

Pulls certificate names for the apex, then checks each host over HTTPS. Filter by status class (2xx / 3xx / 4xx / 5xx / down) or by host prefix (mixrank.com matches only hosts that start with that string).

Port scanner

Runs a broad port pass on the domain you entered (not every subdomain) and lists open ports with service / banner detail.

Reverse IP lookup

Takes only the apex DNS A and AAAA addresses and looks up related certificate hostnames, then checks each one over HTTPS for status and Cloudflare. Does not fan out to every subdomain IP.

Leaked Login URL

Lists leaked login-related URLs tied to the domain. The table is read-only (no click-through).

Host workspace (per subdomain / host)

Tool	What it does
Sitemap crawler	robots.txt + XML sitemaps (.xml / .xml.gz)
Directory brute-force	Content discovery with a SecLists-style wordlist
JS Miner	Endpoints and URLs from JavaScript; secret-like findings with match + neighbor context

Sitemap crawler

Discovers sitemap endpoints from robots and common paths, then follows nested sitemap indexes. Only confirmed XML sitemap URLs are shown.

Directory brute-force

Bruteforces common paths against the host. Useful for admin panels, backups, and forgotten endpoints.

JS Miner

Fetches page scripts, extracts URLs/endpoints, and scans script bodies for likely API keys and secrets. script / endpoint / url rows are list-only; other kinds open a detail window with the match and surrounding characters.

Quick start

pip install -r requirements.txt
python main.py

Pass a domain on the CLI:

python main.py example.com

Requires: Python 3.10+

Controls: Ctrl+Q quit · Esc back · Enter open host / secret detail · / filter subdomains

How to use

1. Launch oORecon and enter an apex domain (or paste a full URL — it will be normalized).
2. Wait for parallel jobs: DNS, subdomains, ports, reverse IP, leaked URLs.
3. Use the main tabs to review results; filter subdomains as needed.
4. Press Enter on a live host to open the host workspace.
5. Run the host pipeline (sitemap → directories → JS miner) or each tool alone.
6. On JS Miner, open non-URL findings to inspect match + context before acting.

Why oORecon?

• All-in-one recon TUI — DNS, CT subdomains, ports, reverse IP, and leak URLs without juggling five CLIs
• Browser-grade HTTP to targets — Chrome TLS impersonation reduces simple fingerprint blocks
• Secret + endpoint mining — harvest URLs from JS and review likely credentials with surrounding context
• Session host cache — reopening a host in the same run restores prior tool results
• Keyboard-first workflow — designed for speed during live recon sessions

Project structure

main.py                 Entrypoint
ui/app.py               Recon dashboard (lookup order lives here)
ui/phases/              DNS, reverse IP, leaked URLs, ports, subdomains
ui/workspace.py         Per-host sitemap / dirs / JS miner
ui/styles.py            Dashboard CSS
ui/format.py            DNS board and status cell rendering
models.py               Shared result models
utils.py                Domain normalize, curl_cffi thread sessions
tools/                  One module per recon tool (dnsinfo, certsub, ports, …)
requirements.txt        Python dependencies
assets/                 Banner, demo GIF, and banner.ans

FAQ

Is oORecon a subdomain enumeration tool?