authorized-recon

Authorized Endpoint Recon

An automated Python-based reconnaissance tool for authorized security testing, bug-bounty reconnaissance, endpoint discovery, subdomain enumeration, parameter inventory, and passive security assessment.

Features

• Subdomain discovery through Certificate Transparency data
• DNS resolution of discovered hosts
• Live host detection
• HTTP/HTTPS endpoint discovery
• HTML link extraction
• JavaScript endpoint discovery
• Query parameter extraction
• Endpoint deduplication
• Live/dead endpoint filtering
• robots.txt and sitemap discovery
• OpenAPI/Swagger endpoint discovery
• GraphQL endpoint discovery
• Passive security-header checks
• Passive CORS configuration checks
• Cookie security-flag checks
• Server-header information detection
• JSON report generation
• HTML report generation
• Multiple target support
• Target-list file support
• Combined scan summary

Requirements

• Python 3.9+
• Internet connection
• aiohttp

Installation

Clone the repository:

git clone YOUR_REPOSITORY_URL

Enter the project directory:

cd authorized-recon

Install dependencies:

pip install -r requirements.txt

Usage

Scan one authorized domain

python recon.py example.com

Scan multiple authorized domains

python recon.py example.com example.org

Scan targets from a file

Create a targets.txt file:

example.com
example.org
your-authorized-domain.com

Then run:

python recon.py -i targets.txt

Custom output directory

python recon.py example.com -o reports

Output

The tool generates reports for each target.

Example:

reports/
├── example.com.json
├── example.com.html
├── example.org.json
├── example.org.html
└── summary.json

JSON Report

The JSON report contains structured reconnaissance data including:

• Discovered subdomains
• DNS-resolved hosts
• Live hosts
• Live endpoints
• Query parameters
• Passive security findings
• Scan statistics

HTML Report

The HTML report provides a human-readable view of:

• Scan statistics
• Security findings
• Live endpoints
• Parameters
• Discovered subdomains

What This Tool Does

The tool focuses on reconnaissance and passive security assessment.

Its workflow is:

Target
   ↓
Subdomain Discovery
   ↓
DNS Resolution
   ↓
Live Host Detection
   ↓
Endpoint Discovery
   ↓
Parameter Extraction
   ↓
Passive Security Checks
   ↓
JSON + HTML Reports

Security Checks

The current version performs non-destructive checks for indicators such as:

• Missing security headers
• HTTP accessibility
• Permissive CORS configuration
• Cookies missing Secure
• Cookies missing HttpOnly
• Cookies missing SameSite
• Exposed server information
• Interesting API/debug/documentation endpoints

These findings are indicators for manual review and should not automatically be considered confirmed vulnerabilities.

Scope and Authorization

This tool is intended only for systems that you own or are explicitly authorized to test.

Before scanning a bug-bounty target, verify that:

1. The target is included in the program scope.
2. Automated scanning is permitted.
3. The request rate is within the program's limits.
4. The testing does not affect availability or user data.
5. You follow the program's vulnerability disclosure rules.

Do not use this tool against systems without authorization.

Safety

This project is designed around reconnaissance and passive assessment.

It does not intentionally perform:

• SQL injection exploitation
• XSS exploitation
• Remote code execution
• Credential attacks
• Password guessing
• Destructive testing
• Denial-of-service testing
• WAF bypass attempts

Responsible Use

The author is not responsible for misuse of this software.

Users are responsible for ensuring that their testing activities comply with applicable laws, contracts, bug-bounty program rules, and authorization requirements.

Limitations

Subdomain discovery depends on publicly available Certificate Transparency information and therefore cannot guarantee discovery of every subdomain.

Endpoint discovery is also dependent on links, JavaScript references, and known paths exposed by the target.

Passive findings require manual verification before being treated as security vulnerabilities.

Project Status

Current version:

2.0

The project currently focuses on automated reconnaissance and passive security assessment.

Future versions may improve endpoint discovery, reporting, scope management, crawling efficiency, and result prioritization.

License

MIT License

Copyright (c) 2026

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files, to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.