Ultimate Recon-ng Cheat Sheet
A full-featured Web Reconnaissance framework written in Python.
1. Start & Workspaces
Recon-ng organizes investigations into “Workspaces” to keep data separate.
Launch
Start the framework from the terminal.
Workspace Management
Always create a new workspace for a new client/target.
Add Seed Data
Add the initial target (domain) to the database.
(Then type the domain, e.g., target.com)
2. Marketplace
Recon-ng comes with no modules installed by default. You must fetch them from the marketplace.
Searching
Installing
Install a specific module or all of them.
Run marketplace refresh occasionally to update the list of available modules.
3. API Keys
Many powerful modules (Shodan, Hunter.io, Github) require API keys to work.
List Keys
Add Key
Remove Key
4. Modules & Execution
The workflow: Load Module -> Set Options -> Run.
Load Module
Use tab completion to find paths easily.
Show Info
See what the module does and what “Source” it requires.
Set Options
Typically, the SOURCE option defaults to “default” (the database), but you can override it.
Run
Back
Return to main menu.
5. Database & Results
Recon-ng stores everything in a local database. Use show to view collected data.
Domains & Hosts
People & Credentials
Schema
See all available tables.
Querying
You can run raw SQL queries if needed.
6. Reporting
Export your findings into a readable format.
Load Reporting Module
Configure & Run
You can also use reporting/csv, reporting/json, or reporting/xml.