# En Kali Linux (ya incluido)
recon-ng

# Instalar desde pip (cualquier Linux)
pip3 install recon-ng

# Desde fuente (última versión)
git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng && pip3 install -r REQUIREMENTS
./recon-ng

# Primer arranque
recon-ng

    _/_/_/    _/_/_/_/    _/_/_/    _/_/_/    _/      _/            _/      _/    _/_/_/
   _/    _/  _/        _/        _/      _/  _/_/    _/            _/_/    _/  _/
  _/_/_/    _/_/_/    _/        _/      _/  _/  _/  _/  _/_/_/_/  _/  _/  _/  _/  _/_/
 _/    _/  _/        _/        _/      _/  _/    _/_/            _/    _/_/  _/      _/
_/    _/  _/_/_/_/    _/_/_/    _/_/_/    _/      _/            _/      _/    _/_/_/

                                          /v5.1.2/

[78] Recon modules
[8]  Reporting modules
[2]  Import modules
[2]  Exploitation modules
[2]  Discovery modules

[recon-ng][default] >

# Instalar dependencias de módulos
[recon-ng][default] > marketplace install all

## WORKSPACES
workspaces list                    # listar workspaces
workspaces create cliente_acme     # crear workspace
workspaces load cliente_acme       # cambiar al workspace
workspaces remove cliente_acme     # eliminar workspace

## MÓDULOS
modules search domain              # buscar módulos
modules load recon/domains-hosts/hackertarget  # cargar módulo
modules info                       # info del módulo activo
back                               # descargar módulo

## OPCIONES (dentro de un módulo)
options list                       # ver opciones del módulo
options set SOURCE example.com     # establecer opción
run                                # ejecutar el módulo

## BASE DE DATOS
db query SELECT * FROM hosts       # consulta SQL directa
db insert hosts (host) VALUES ('sub.example.com')
show hosts                         # ver tabla hosts
show contacts                      # ver tabla contacts

## MARKETPLACE
marketplace search                 # listar módulos disponibles
marketplace search shodan          # buscar en marketplace
marketplace install recon/domains-hosts/shodan_hostname
marketplace install all            # instalar todos

## API KEYS
keys list                          # ver APIs configuradas
keys add shodan_api TU_API_KEY     # añadir clave
keys remove shodan_api             # eliminar clave

## DASHBOARD
dashboard                          # resumen de actividad
[recon-ng][cliente_acme] > dashboard
  +------------------+---------+
  | Category         | Modules |
  +------------------+---------+
  | hosts            |      45 |
  | contacts         |      12 |
  | credentials      |       3 |
  | ports            |      28 |
  +------------------+---------+

## CREAR Y USAR WORKSPACES
workspaces create nombre_proyecto
workspaces load nombre_proyecto
workspaces list
workspaces remove nombre_proyecto

## SNAPSHOTS (backup del workspace)
snapshots take          # crear snapshot
snapshots list          # listar snapshots
snapshots load nombre   # restaurar snapshot
snapshots remove nombre # eliminar snapshot

## UBICACIÓN FÍSICA DE LOS WORKSPACES
~/.recon-ng/workspaces/
├── default/
│   └── data.db          ← SQLite de cada workspace
├── pentest_example_com/
│   └── data.db
└── cliente_acme/
    └── data.db

## ACCEDER A LA DB DESDE SQLITE3
sqlite3 ~/.recon-ng/workspaces/pentest_example_com/data.db
sqlite> .tables
companies  contacts  credentials  hosts  leaks  locations  netblocks  ports  profiles  pushpins  repositories  vulnerabilities
sqlite> SELECT host, ip_address FROM hosts LIMIT 10;

## VER TABLAS
show hosts
show contacts
show credentials
show ports
show vulnerabilities

## CONSULTAS SQL DIRECTAS
db query SELECT * FROM hosts WHERE ip_address IS NOT NULL
db query SELECT email FROM contacts ORDER BY last_name
db query SELECT host, port FROM ports WHERE port='443'
db query SELECT COUNT(*) FROM hosts

## INSERTAR DATOS MANUALMENTE (seeds)
# Añadir el dominio objetivo como punto de partida
db insert domains (domain) VALUES ('example.com')
db insert hosts (host) VALUES ('api.example.com')
db insert companies (company) VALUES ('Example Corp')

## IMPORTAR DESDE ARCHIVO
modules load import/list
options set FILENAME /tmp/hosts.txt
options set TABLE hosts
options set COLUMN host
run
[*] 45 records imported into 'hosts'

## EXPORTAR A CSV
db query SELECT * FROM hosts > /tmp/hosts_export.csv

## VER TODAS LAS APIS Y SU ESTADO
keys list
+-------------------+--------------------+
| Name              | Value              |
+-------------------+--------------------+
| bing_api          |                    | ← sin configurar
| censys_id         |                    |
| censys_secret     |                    |
| github_api        | ghp_xxxxxxxxxxxx   | ← configurada
| hunter_io         |                    |
| shodan_api        | 3D28xxxxxxxxxxxx   | ← configurada
| virustotal_api    |                    |
+-------------------+--------------------+

## AÑADIR API KEYS
keys add shodan_api TU_SHODAN_KEY
keys add github_api ghp_TU_GITHUB_TOKEN
keys add virustotal_api TU_VT_KEY
keys add hunter_io TU_HUNTER_KEY
keys add censys_id TU_CENSYS_ID
keys add censys_secret TU_CENSYS_SECRET
keys add bing_api TU_BING_KEY

## TABLA DE APIS — DÓNDE CONSEGUIRLAS (GRATUITAS)
shodan_api     → account.shodan.io        (1 clave gratuita, 100 queries/mes)
github_api     → github.com/settings/tokens  (gratuito — rate limit sin clave)
virustotal_api → virustotal.com            (500 queries/día gratuitas)
hunter_io      → hunter.io                (25 búsquedas/mes gratuitas)
censys_id/secret → search.censys.io       (250 queries/mes gratuitas)
bing_api       → portal.azure.com         (3000 queries/mes gratuitas)

## VER QUÉ KEY REQUIERE UN MÓDULO
modules load recon/domains-hosts/shodan_hostname
modules info
...
  Required Keys: shodan_api
...

## BUSCAR MÓDULOS
marketplace search                 # todos los módulos
marketplace search domain           # por nombre
marketplace search shodan
marketplace search -c Path recon    # filtrar por categoría

## INSTALAR MÓDULOS
marketplace install recon/domains-hosts/hackertarget
marketplace install recon/domains-contacts/whois_pocs
marketplace install all             # instalar todos (puede tardar)

## VER INFO DE UN MÓDULO
marketplace info recon/domains-hosts/shodan_hostname
+----------------------+---------------------------------------------------+
| Path                 | recon/domains-hosts/shodan_hostname               |
| Name                 | Shodan - Hostname Search                          |
| Author(s)            | Tim Tomes (@LaNMaSteR53)                          |
| Version              | 1.0                                               |
| Last Updated         | 2021-05-13                                        |
| Status               | not installed                                     |
| Description          | Harvests hosts from Shodan.io using...            |
| Required Keys        | shodan_api                                        |
| Dependencies         | shodan                                            |
+----------------------+---------------------------------------------------+

## ACTUALIZAR Y ELIMINAR
marketplace update recon/domains-hosts/hackertarget
marketplace remove recon/domains-hosts/hackertarget

## VER MÓDULOS INSTALADOS
modules list
Recon
-----
  recon/domains-contacts/whois_pocs
  recon/domains-hosts/hackertarget
  recon/domains-hosts/shodan_hostname
  recon/hosts-ports/shodan_ip
  ...

## RESOLUCIÓN DNS — hosts sin IP → hosts con IP
modules load recon/hosts-hosts/resolve
options list
  Name       Current Value  Required  Description
  ------     -------------  --------  -----------
  SOURCE     default        yes       Source of input (table, or query)
run
[*] [1/45] api.example.com => 93.184.216.34
[*] [2/45] mail.example.com => 93.184.216.35
[*] [3/45] dev.example.com => (no resolution)
[+] 43 new records added to hosts

## ENRIQUECER HOSTS CON SHODAN (puertos y banners)
modules load recon/hosts-ports/shodan_ip
run
[*] [1/43] 93.184.216.34
[*]     Port: 80/tcp
[*]     Port: 443/tcp
[*]     Port: 22/tcp
[+] 28 new records added to ports

## DISCOVERY DE REDES (módulos de discovery)
modules load discovery/info_disclosure/interesting_files
options set SOURCE example.com
run
[+] http://example.com/.git/HEAD - 200 OK!
[+] http://example.com/phpinfo.php - 200 OK!
[+] http://example.com/robots.txt - 200 OK!

## VERIFICAR EXISTENCIA DE HOSTS
modules load recon/hosts-hosts/ipinfodb
run
[*] Fetching geolocation for 93.184.216.34
[+] Country: United States
[+] City: Norwood
[+] Latitude: 42.1949
[+] Longitude: -71.2012

## INFORME HTML (el más completo)
modules load reporting/html
options set FILENAME /tmp/informe_recon.html
options set CREATOR "GhostAcademy"
options set CUSTOMER "Cliente ACME"
run
[*] Report generated: /tmp/informe_recon.html

## CSV (para análisis en Excel/Python)
modules load reporting/csv
options set FILENAME /tmp/hosts.csv
options set TABLE hosts
run

## JSON
modules load reporting/json
options set FILENAME /tmp/recon_data.json
run

## XML
modules load reporting/xml
options set FILENAME /tmp/recon_data.xml
run

## EXPORTAR A MALTEGO (para visualización de grafos)
modules load reporting/maltego_table
options set TABLE hosts
run

## VER RESUMEN RÁPIDO EN CONSOLA
dashboard
show hosts
show contacts
db query SELECT email FROM contacts WHERE email IS NOT NULL

## MÓDULOS EN ORDEN — de dominio a perfil completo

# 1. Subdominios via Certificate Transparency (sin API key)
modules load recon/domains-hosts/certificate_transparency && run && back

# 2. Subdominios via HackerTarget (sin API key)
modules load recon/domains-hosts/hackertarget && run && back

# 3. Subdominios via Shodan (requiere shodan_api)
modules load recon/domains-hosts/shodan_hostname && run && back

# 4. Subdominios via Bing dorking (requiere bing_api)
modules load recon/domains-hosts/bing_domain_web && run && back

# 5. Resolución DNS (hosts → IPs)
modules load recon/hosts-hosts/resolve && run && back

# 6. Información de puertos por IP (requiere shodan_api)
modules load recon/hosts-ports/shodan_ip && run && back

# 7. Contactos WHOIS
modules load recon/domains-contacts/whois_pocs && run && back

# 8. Ver resultados
show hosts
+----------------------+----------------+
| host                 | ip_address     |
+----------------------+----------------+
| api.example.com      | 93.184.216.34  |
| mail.example.com     | 93.184.216.35  |
| dev.example.com      | 93.184.216.36  |
| staging.example.com  | 93.184.216.37  |
+----------------------+----------------+

show ports
+----------------+------+----------+
| ip_address     | port | protocol |
+----------------+------+----------+
| 93.184.216.34  | 80   | tcp      |
| 93.184.216.34  | 443  | tcp      |
| 93.184.216.34  | 22   | tcp      |
+----------------+------+----------+

## FUENTES DE EMAILS

# 1. Emails desde WHOIS
modules load recon/domains-contacts/whois_pocs
run
[+] admin@example.com (Administrative)
[+] tech@example.com (Technical)

# 2. Emails desde Hunter.io (requiere hunter_io key)
modules load recon/domains-contacts/hunter_io
run
[+] john.doe@example.com (CTO)
[+] jane.smith@example.com (CEO)
[+] support@example.com

# 3. Emails desde PGP keyservers
modules load recon/domains-contacts/pgp_search
run

# 4. Emails desde GitHub (requiere github_api)
modules load recon/profiles-contacts/github_users
options set SOURCE example
run
[+] devuser: dev.user@example.com (GitHub profile)

## VERIFICAR EMAILS EN BRECHAS

# HaveIBeenPwned — verificar cada email
modules load recon/contacts-credentials/hibp_breach
run
[*] Checking john.doe@example.com...
[+] john.doe@example.com found in: LinkedIn, Collection#1, Adobe
[*] Checking admin@example.com...
[+] admin@example.com found in: RockYou2021

## VER CREDENCIALES COMPROMETIDAS
show credentials
+------------------------+---------+------------------+
| username               | password| leak             |
+------------------------+---------+------------------+
| john.doe@example.com   |         | LinkedIn 2021    |
| admin@example.com      |         | RockYou2021      |
+------------------------+---------+------------------+

## EXPORTAR SOLO LOS EMAILS
db query SELECT email FROM contacts WHERE email IS NOT NULL

## PASO 1: Insertar la empresa como punto de partida
db insert companies (company) VALUES ('Example Corp')

## PASO 2: Encontrar rangos IP de la empresa (ARIN)
modules load recon/companies-hosts/censys_org
run
[+] 203.0.113.0/24 (Example Corp)
[+] 198.51.100.0/24 (Example Corp Cloud)

## PASO 3: Escanear los rangos en Shodan
modules load recon/netblocks-hosts/shodan_net
run
[+] 203.0.113.1 (Apache/2.4.52, ports: 80,443)
[+] 203.0.113.5 (nginx, ports: 80,443,8080)
[+] 203.0.113.10 (OpenSSH, ports: 22)
[+] 18 new records added to hosts

## PASO 4: Buscar empleados en LinkedIn
modules load recon/companies-contacts/linkedin_auth
options set SOURCE "Example Corp"
run
[+] John Doe - CTO
[+] Jane Smith - CISO
[+] Bob Johnson - DevOps Engineer

## PASO 5: Buscar repos en GitHub de la organización
modules load recon/companies-multi/github_miner
options set SOURCE example-corp
run
[+] Repository: example-corp/api-backend
    [!] Possible secret in commit: 'Add DB connection string'
[+] Repository: example-corp/infrastructure
    [!] Found .env file in history

## PASO 6: Resumen de todo lo encontrado
dashboard
  +------------------+---------+
  | Category         | Records |
  +------------------+---------+
  | companies        |       1 |
  | netblocks        |       2 |
  | hosts            |      18 |
  | ports            |      42 |
  | contacts         |       8 |
  +------------------+---------+

## GRABAR COMANDOS EN TIEMPO REAL
script start /tmp/mi_recon.rc    # iniciar grabación
# ... hacer comandos normalmente ...
script stop                      # detener grabación
script replay /tmp/mi_recon.rc   # reproducir

## CREAR SCRIPT .rc MANUALMENTE
cat > /tmp/recon_dominio.rc << 'EOF'
workspaces create TARGET_WORKSPACE
db insert domains (domain) VALUES ('TARGET_DOMAIN')
modules load recon/domains-hosts/certificate_transparency
run
back
modules load recon/domains-hosts/hackertarget
run
back
modules load recon/hosts-hosts/resolve
run
back
modules load recon/domains-contacts/whois_pocs
run
back
modules load recon/contacts-credentials/hibp_breach
run
back
modules load reporting/html
options set FILENAME /tmp/recon_TARGET_DOMAIN.html
options set CREATOR "GhostAcademy"
run
exit
EOF

## EJECUTAR SCRIPT DESDE LA TERMINAL
recon-ng -w pentest_example_com --script /tmp/recon_dominio.rc
[*] Loading workspace: pentest_example_com
[*] Running script: /tmp/recon_dominio.rc
[*] Executing: workspaces create...
...
[*] Report generated: /tmp/recon_example.com.html

## SCRIPT BASH PARAMETRIZABLE
cat > recon_target.sh << 'BASH'
#!/bin/bash
DOMAIN=$1
WORKSPACE=$(echo $DOMAIN | tr '.' '_')
OUTFILE="/tmp/recon_${DOMAIN}.html"

echo "[*] Iniciando reconocimiento de: $DOMAIN"

cat > /tmp/recon_script.rc << EOF
workspaces create ${WORKSPACE}
db insert domains (domain) VALUES ('${DOMAIN}')
modules load recon/domains-hosts/certificate_transparency
run
back
modules load recon/domains-hosts/hackertarget
run
back
modules load recon/hosts-hosts/resolve
run
back
modules load recon/domains-contacts/whois_pocs
run
back
modules load reporting/html
options set FILENAME ${OUTFILE}
run
exit
EOF

recon-ng --script /tmp/recon_script.rc
echo "[+] Informe generado: ${OUTFILE}"
BASH
chmod +x recon_target.sh
./recon_target.sh example.com

## IMPORTAR RESULTADOS DE THEHARVESTER
theHarvester -d example.com -l 500 -b all -f /tmp/harvester_out
cat /tmp/harvester_out.json | python3 -c "
import json,sys
data=json.load(sys.stdin)
for host in data.get('hosts', []):
    print(host)
" > /tmp/hosts_harvester.txt

# Importar en Recon-ng
modules load import/list
options set FILENAME /tmp/hosts_harvester.txt
options set TABLE hosts
options set COLUMN host
run

## EXPORTAR PARA MALTEGO
modules load reporting/maltego_table
options set TABLE hosts
run

## PIPELINE COMPLETO: Recon-ng → SpiderFoot
# Exportar subdominios de Recon-ng
db query SELECT host FROM hosts > /tmp/reconng_hosts.txt
# Usar esos hosts como targets en SpiderFoot
python3 /opt/spiderfoot/sf.py -s "$(head -1 /tmp/reconng_hosts.txt)" -t DOMAIN_NAME -u Footprint -o json > spiderfoot_out.json

## COMPARAR RESULTADOS DE RECONNG Y NMAP
# Exportar IPs de Recon-ng
db query SELECT DISTINCT ip_address FROM hosts WHERE ip_address IS NOT NULL > /tmp/ips.txt
# Pasar a nmap
nmap -sV -p 80,443,22,3306 -iL /tmp/ips.txt -oX /tmp/nmap_results.xml
# Importar resultados nmap de vuelta
modules load import/nmap
options set FILENAME /tmp/nmap_results.xml
run

## INSTALAR MÓDULOS NECESARIOS (si no están instalados)
marketplace install recon/domains-hosts/certificate_transparency
marketplace install recon/domains-hosts/hackertarget
marketplace install recon/hosts-hosts/resolve
marketplace install recon/domains-contacts/whois_pocs
marketplace install reporting/html

## PASO 1: Crear workspace y seed
workspaces create lab_hackthebox
db insert domains (domain) VALUES ('hackthebox.com')
[*] 1 record added to domains

## PASO 2: Certificate Transparency (sin API)
modules load recon/domains-hosts/certificate_transparency
run
[*] Searching crt.sh for hackthebox.com
[+] app.hackthebox.com
[+] api.hackthebox.com
[+] forum.hackthebox.com
[+] labs.hackthebox.com
[+] 18 new records added to hosts
back

## PASO 3: HackerTarget (sin API)
modules load recon/domains-hosts/hackertarget
run
[+] 5 new records added to hosts
back

## PASO 4: Resolver IPs
modules load recon/hosts-hosts/resolve
run
[*] 21 hosts resolved
back

## PASO 5: Contactos WHOIS
modules load recon/domains-contacts/whois_pocs
run
back

## PASO 6: Ver resultados
show hosts
show contacts
dashboard

## PASO 7: Generar informe HTML
modules load reporting/html
options set FILENAME /tmp/lab_hackthebox.html
options set CREATOR "GhostAcademy"
options set CUSTOMER "Lab Práctica"
run
[*] Report generated: /tmp/lab_hackthebox.html

## CREAR EL SCRIPT DE RECONOCIMIENTO
cat > /tmp/empresa_recon.rc << 'EOF'
workspaces create empresa_lab

db insert domains (domain) VALUES ('ejemplo-empresa.com')
db insert companies (company) VALUES ('Ejemplo Empresa SL')

modules load recon/domains-hosts/certificate_transparency
run
back

modules load recon/domains-hosts/hackertarget
run
back

modules load recon/hosts-hosts/resolve
run
back

modules load recon/domains-contacts/whois_pocs
run
back

modules load recon/domains-contacts/pgp_search
run
back

modules load reporting/html
options set FILENAME /tmp/informe_empresa.html
options set CREATOR "GhostAcademy"
run

exit
EOF

## EJECUTAR EL SCRIPT
recon-ng --script /tmp/empresa_recon.rc

## ANÁLISIS MANUAL POST-SCRIPT
recon-ng -w empresa_lab

# Ver todos los emails encontrados
db query SELECT email, first_name, last_name FROM contacts WHERE email IS NOT NULL ORDER BY last_name

# Exportar solo emails para usar con otras herramientas
db query SELECT email FROM contacts WHERE email IS NOT NULL > /tmp/emails_empresa.txt
wc -l /tmp/emails_empresa.txt

# Ver hosts con IP asignada
db query SELECT host, ip_address FROM hosts WHERE ip_address IS NOT NULL ORDER BY host

# Contar hallazgos totales
db query SELECT 'hosts' as tabla, COUNT(*) as total FROM hosts
UNION SELECT 'contacts', COUNT(*) FROM contacts
UNION SELECT 'ports', COUNT(*) FROM ports
UNION SELECT 'credentials', COUNT(*) FROM credentials

## OPCIÓN 1: Módulo reporting/html (integrado)
modules load reporting/html
options list
  Name      Value                 Required  Description
  ----      -----                 --------  -----------
  CREATOR   GhostAcademy          yes       Report creator
  CUSTOMER  Ejemplo Empresa SL    yes       Report customer
  FILENAME  /tmp/informe.html     yes       Output file
run
[*] Generating report...
[*] 23 hosts processed
[*] 8 contacts processed
[*] 42 ports processed
[*] Report generated: /tmp/informe.html

## OPCIÓN 2: Informe personalizado desde Python
python3 << 'EOF'
import sqlite3
from datetime import datetime

# Conectar a la DB del workspace
DB = f"{__import__('os').path.expanduser('~')}/.recon-ng/workspaces/empresa_lab/data.db"
conn = sqlite3.connect(DB)
c = conn.cursor()

print(f"INFORME OSINT — {datetime.now().strftime('%Y-%m-%d')}")
print("=" * 60)

print(f"\n[HOSTS] ({c.execute('SELECT COUNT(*) FROM hosts').fetchone()[0]} encontrados):")
for row in c.execute("SELECT host, ip_address FROM hosts WHERE ip_address IS NOT NULL LIMIT 10"):
    print(f"  {row[0]:<35} {row[1]}")

print(f"\n[CONTACTOS] ({c.execute('SELECT COUNT(*) FROM contacts').fetchone()[0]} encontrados):")
for row in c.execute("SELECT first_name, last_name, email FROM contacts WHERE email IS NOT NULL LIMIT 10"):
    print(f"  {row[0]} {row[1]:<20} {row[2]}")

print(f"\n[PUERTOS] ({c.execute('SELECT COUNT(*) FROM ports').fetchone()[0]} registros):")
for row in c.execute("SELECT ip_address, port, protocol FROM ports ORDER BY ip_address, port LIMIT 15"):
    print(f"  {row[0]}:{row[1]}/{row[2]}")

conn.close()
EOF