NoWRecon

A subdomain enumeration and recon tool for red team work. No API keys required for the core features, runs either as a one-shot CLI or as a persistent, msfconsole-style interactive console.

Only run this against domains you are authorized to test. See "Legal" below for details.

Features

• Passive collection: crt.sh, CertSpotter, Wayback Machine, OTX, HackerTarget, RapidDNS, Anubis, urlscan.io, BufferOver, ThreatMiner (10 sources, no API keys needed).
• Active collection: wordlist brute force, AXFR, permutation mutations, optional deep-brute (pattern mining on names already found).
• Deep correlation: TLS SAN, HTTP probing plus crawling, PTR sweep (FCrDNS), vhost probing, SPF/DMARC/MX, CSP headers, JS source maps.
• Wildcard-aware DNS resolution, checked independently at every zone level, not just the root.
• Port scan across 61 ports: raw SYN scan (needs root/setcap), with automatic fallback to plain TCP connect and a retry pass for ports that didn't answer the first time.
• Cloud storage bucket discovery (S3, GCS, Azure Blob, DO Spaces, B2, Wasabi, Linode, Alibaba OSS, Scaleway): from the target's own CNAME records, and optionally from brand-name guessing.
• Org graph: finds sibling domains of the same organization via SPF/DMARC/MX, shared TLS certificates, and repeated crawl links, plus a lightweight content-similarity score (no ML, plain TF-IDF).
• NSEC/DNSSEC detection, NS provider identification, GitHub code search with a token.
• Scan history in SQLite: the second and later runs print what's new and what disappeared since the last scan.
• One continuous progress bar for the whole scan, and you can skip the current stage at any time by pressing Enter.
• Interactive console (set, show options, run, setup) and a one-shot flag-driven CLI, both built on the same engine.

Install

git clone https://github.com/Rebellionxkid/NoWRecon
cd NoWRecon
pip install -r requirements.txt

For a real SYN scan (without it, the tool falls back to TCP connect):

sudo setcap cap_net_raw+ep $(readlink -f $(which python3))

Quick start

Console (recommended to start with):

python -m subscout.cli

Shows the banner, walks you through a guided setup (pick a mode: passive / active / deep / custom), offers a default preset or manual configuration of every setting, then drops into a prompt:

nowrecon (example.com) > show options
nowrecon (example.com) > set MODE deep
nowrecon (example.com) > set EXPAND_ORG true
nowrecon (example.com) > run
...
nowrecon (example.com) > set DOMAIN other-target.com
nowrecon (other-target.com) > run
nowrecon (other-target.com) > exit

The console doesn't exit after one scan. Commands:

• set OPTION VALUE: change a setting, e.g. set MODE deep.
• unset OPTION: reset a setting back to its default.
• show options: table of every setting and its current value.
• show banner / banner: reprint the startup banner.
• setup: re-run the guided configuration flow.
• run (or scan): start a scan with the current settings.
• help: list every command.

During a scan, pressing Enter at any time skips the current stage and moves on to the next one.

Flags, one-shot run:

python -m subscout.cli example.com --mode deep --buckets --expand-org

Settings

CLI flag	Console option	Description
--mode	MODE	passive / active / deep
--out-dir	OUT_DIR	where to write json/csv/txt
--wordlist	WORDLIST	custom brute-force wordlist
--db	DB	path to the SQLite history/diff database
--ptr-prefix	PTR_PREFIX	CIDR radius for deep-mode PTR sweeps
--no-vhost	NO_VHOST	disable deep-mode vhost probing
--dns-rate	DNS_RATE	max DNS queries per second per resolver
--ip-rate	IP_RATE	max HTTP requests per second against one target IP
--connect-timeout	CONNECT_TIMEOUT	per-attempt timeout in the TCP-connect port scan
--expand-org	EXPAND_ORG	also scan sibling org domains, not just list them
--expand-mode	EXPAND_MODE	mode used for sibling-domain sub-scans
--buckets	BUCKETS	guess cloud storage bucket names from the brand
--deep-brute	DEEP_BRUTE	extra pattern-mutation round on names already found
--github-token	GITHUB_TOKEN	token for GitHub code-search recon
--nsec-walk	NSEC_WALK	attempt a full NSEC zone walk (plain NSEC only)
--user-agent	USER_AGENT	custom User-Agent for every request
--random-user-agent	RANDOM_USER_AGENT	random real-browser User-Agent for the whole run
-v / --verbose	VERBOSE	show per-stage log lines
--debug	DEBUG	show which source found each name

Notes:

• If a host you know is alive comes back DEAD, raise CONNECT_TIMEOUT (default 3 seconds). Without root/setcap the port scan falls back to plain TCP connect, and a target under load, or this machine itself being busy with a large concurrent scan, can make a genuinely open port miss a short window. Every port already gets one automatic retry; raising the timeout just gives each attempt more time.
• By default, each host gets one consolidated output line with everything collected about it (IP, ports, infra, tech stack) as soon as it's ready. --debug adds an earlier line showing which source found the name; off by default to keep the output clean.
• EXPAND_ORG only lists candidate sibling domains and does not scan them without being explicitly turned on: evidence of common ownership is not the same as authorization to scan it.

How deep mode avoids pulling in unrelated domains

This was a deliberate design constraint:

• Wildcard DNS is checked independently at every zone level (core/resolver.py: is_wildcard_answer), not just the root: a catch-all on *.dev.example.com is caught even if the root zone has none.
• PTR sweeps in deep mode are capped to the discovered IP's own /24 (Scope.ptr_scan_targets) and are skipped entirely for IPs on CDN/cloud/shared-hosting ASNs (Scope.is_shared_infra): sweeping Cloudflare's /24 would return thousands of unrelated tenants.
• Every PTR hit must pass forward-confirmed reverse DNS (Scope.accept_ptr_result): the name must be in scope, and the forward resolve must land back in the same /24 the reverse lookup came from. An unconfirmed PTR record alone proves nothing.
• vhost probing in deep mode also skips shared-infra IPs, and only counts a candidate if its response fingerprint differs from a baseline probe using a nonsense Host header on the same IP.

Architecture

sources (passive, no key)          ┐
sources (active: brute, AXFR)      ├→ candidates → resolver (wildcard-aware)
dns_extra (SPF/DMARC/SRV)          ┘        │
                                             ▼
                                permutation round (dnsgen-style)
                                             │
                                             ▼ (deep mode only)
                TLS SAN · HTTP probe + crawl · PTR sweep (FCrDNS) · vhost
                                             │
                                             ▼
                        SQLite (history/diff) + JSON/CSV/TXT export