Learn
LoginRegister
← All tools

Recon-ng

Tool manual · Kali & common usage

OSINT · Intermediate · OSINT lane

IntermediateOSINT — Framework
Authorized usage only. Capture and inspect traffic only on systems and networks you own or have written permission to analyze.

What is Recon-ng?

Recon-ng is a modular OSINT framework with a Metasploit-like console.

Structured recon workspaces and modules for authorized domains.

Official website: Recon-ng · Documentation

When do you use it?

  • You need Modular recon framework (Metasploit-style for OSINT).
  • You are following a CYNARKS lab or authorized engagement that calls for Recon-ng.
  • You already tried simpler checks and need this tool’s deeper capability.

Who uses it?

  • OSINT analysts
  • Investigators (lawful use)
  • Red teamers (authorized recon)

How do you use it? (typical flow)

  1. Install Recon-ng using the steps below (prefer Kali package or official installer).
  2. Confirm you have authorization for the target (lab VM, own system, or written scope).
  3. Run --help / man (or the Help section) to see current flags for your version.
  4. Start with a safe example from Basic commands against localhost or an authorized lab target.
  5. Record what you ran, what you observed, and any follow-up (filter, report, remediation).

Help & manual (like man / --help)

Every serious tool has a built-in way to look up flags. Learn these first so you are not stuck memorizing every option.

  1. 1. Help

    recon-ng -h

  2. 2. Inside console

    help

    Module marketplace / workspace commands.

Kali Linux

Preinstalled on many Kali builds: recon-ng.

1. Installation

OSInstallation
Kali LinuxPreinstalled on many Kali builds: recon-ng.
aptapt install recon-ng or pip

2. Basic commands

  1. 1. List OSINT modules

    marketplace search

    List OSINT modules

  2. 2. Show help

    marketplace --help

    List flags for your installed version (same habit as man/--help).

  3. 3. Short help

    marketplace -h

    Alternate help flag when supported.

  4. 4. Add API keys for passive modules

    keys add

    Add API keys for passive modules

Options / flags

OptionPurpose
keys addAdd API keys for passive modules

5. Useful features

  • Modules
  • Workspace
  • Keys

6. Practical examples

  1. Example 1: List OSINT modules

    marketplace search

    List OSINT modules

  2. Example 2: Show help

    marketplace --help

    List flags for your installed version (same habit as man/--help).

  3. Example 3: Short help

    marketplace -h

    Alternate help flag when supported.

  4. Example 4: Add API keys for passive modules

    keys add

    Add API keys for passive modules

7. Important notes

  • Framework for structured recon — not a free pass to scan strangers.
  • Authorized targets only — labs, systems you own, or written permission.
  • Prefer reading --help / man / official docs for your installed version; flags change over time.

Related course: ethical hacking penetration testing · soc analyst blue team · Commands: /osint