recon

Authorized, non-destructive security + due-diligence assessment of a target — a single website/domain or a whole estate — answering one question:

Is this target safe to use / adopt / trust?

It is engagement- and requester-agnostic: the same pipeline serves a company vetting a SaaS vendor, a team auditing its own estate, or an individual checking a site before signing up.

Two fused tracks

1. Technical track — a deterministic scanner (recon.py) builds an explicit inventory and runs 30 passive + active check modules (TLS, headers, CORS, content/secret exposure, subdomain takeover, SQLi/SSRF/XXE/SSTI/XSS/… detection-only, mail/DNS, buckets, …), optionally driving 6 best-of-breed external tools (nuclei, katana, ffuf, trufflehog, testssl, headless Chromium). triage.py then suppresses the known false-positive classes and emits a live-re-verification worklist. You re-verify each survivor by hand and re-grade on demonstrated impact.

2. Due-diligence track — an agentic, multi-subagent investigation (workflows/diligence.js, run via Claude Code's Workflow tool) fans out across seven dimensions — legitimacy/corporate, technical posture (reads the scanner's findings), legal/privacy/DPA, compliance fit, certifications, breach reputation, auth & integration — adversarially verifies every material finding, and synthesizes a safe-to-use verdict with blocking risks, required controls, and contract/DPA asks.

Output: a Markdown report plus a hosted HTML dossier.

Egress: proxy by default (zero direct egress)

All scanner traffic egresses through a dedicated HTTP proxy by default, and DNS is resolved over DoH through that proxy, so nothing leaks from the host's own IP. TCP-level checks (TLS cert grab, port probe, smuggling precondition) are tunneled via HTTP CONNECT. The User-Agent defaults to stock Chrome so traffic blends with the (residential) proxy egress.

Proxy resolution order: --proxy <url> → $RECON_PROXY → ~/.secrets/recon-proxy. The credential file is 0600 and must never be committed (see .gitignore); the tool masks the password in any output. Disable with --no-proxy (egress directly — only for authorized targets the proxy can't reach). DNS AXFR is the one check that cannot ride the proxy; it is reported skipped:proxied, never silently dropped.

export RECON_PROXY="$(cat ~/.secrets/recon-proxy)"   # so manual re-verify curl lines auto-proxy

Quickstart

cd ~/recon

# 1) is this vendor/site safe? (passive — the common third-party case)
python3 recon.py example.com --phases passive --out engagements/example
python3 triage.py --out engagements/example
#    then run the due-diligence workflow (Claude Code Workflow tool):
#    Workflow({ scriptPath: "~/recon/workflows/diligence.js",
#               args: { target: "example.com", context: "...", recon_out: "~/recon/engagements/example" } })

# 2) authorized estate, full depth
python3 recon.py --xlsx estate.xlsx --apex acme.com --ct --brute \
  --alive-only --phases all --aggressive --all-tools --out engagements/acme

There are no built-in targets — with none supplied, recon.py errors rather than scanning anything by default.

Safety / rules of engagement

Non-destructive by design: GET/HEAD/OPTIONS, no authentication attempts, no exploitation, no data download. Injection modules are detection-only. Run active/aggressive depth only against assets you are authorized to test; for an arms-length third party you are merely evaluating, stay passive + OSINT (no injection). See docs/HOW-IT-WORKS.md for the full rules of engagement.

Layout

recon.py                 deterministic scanner (inventory + 30 modules + 6 tool wrappers + proxy/DoH)
triage.py                false-positive suppression + live-re-verify worklist
workflows/diligence.js   agentic 7-dimension due-diligence (Workflow tool)
dossier_template.html    reference HTML dossier to copy per engagement
docs/TUTORIAL.md         normal (via Claude Code skill) and manual usage
docs/HOW-IT-WORKS.md     architecture, the two tracks, proxy/DoH, FP classes, rules of engagement
engagements/             run outputs (gitignored)

In Claude Code this is driven by the due-diligence skill; see docs/TUTORIAL.md.

Requirements

Python 3.9+ with requests (and openpyxl for --xlsx). Optional external tools for full depth: nuclei ffuf katana trufflehog testssl + playwright (Chromium). The pure-Python path runs without them.