A command-line DNS reconnaissance tool for enumerating subdomains, querying DNS records, and gathering network intelligence on a target domain.
- ASN Lookup — Resolves IP address, ASN, organization, country, city, and reverse DNS
- DNS Records — Queries A, MX, TXT, NS, and CNAME records
- Subdomain Enumeration — Passive discovery via crt.sh certificate transparency logs, with automatic retry
- Brute Force Subdomains — Active enumeration using a 60+ entry wordlist of common subdomain prefixes
- Rich Terminal Output — Color-coded, structured output powered by the Rich library
- Python 3.8+
- Internet access (for crt.sh and ipapi.co lookups)
Clone the repository and install dependencies:
git clone https://github.com/code-saksham-hash/recon_cli.git
cd recon_cli
pip install -r requirements.txtpython recon.py -d <target-domain>Example:
python recon.py -d example.comPull directly from Docker Hub:
docker pull saksham409/recon-toolOr build the image locally:
docker build -t dns-recon-tool .Run against a target:
docker run --rm dns-recon-tool -d example.comdns-recon-tool/
├── recon.py # Main script
├── requirements.txt # Python dependencies
├── Dockerfile # Container definition
└── README.md
| Package | Purpose |
|---|---|
| dnspython | DNS record resolution |
| requests | HTTP requests to crt.sh, ipapi |
| rich | Terminal formatting and output |
This tool is intended for educational purposes and authorized security assessments only. Do not use it against domains you do not own or have explicit written permission to test. Unauthorized use may violate applicable laws.
Saksham Banjade