Ultimate Recon-ng Cheat Sheet

Samir KC
September 08, 2026


Ultimate Recon-ng Cheat Sheet

Full-featured reconnaissance framework. Modular, powerful, and database-driven OSINT.

1. Getting Started

Launch the framework and navigate the interactive shell.

Launch Recon-ng

recon-ng

Launch with Workspace

recon-ng -w example_com

Launch with Script

recon-ng -r script.rc

Check Version

recon-ng --version

Shell Commands

  • help : Show help
  • exit : Exit framework
  • back : Go back
  • shell : System shell
  • clear : Clear screen

Launch Options

  • -w <name> : Workspace
  • -r <script> : Run script
  • --no-version : Skip update
  • --analytics : Enable analytics
  • -h : Help menu

2. Workspaces

Create Workspace

workspaces create example_com

List Workspaces

workspaces list

Select Workspace

workspaces select example_com

Delete Workspace

workspaces delete example_com
CommandDescriptionExample
workspaces createCreate workspaceworkspaces create test
workspaces listList all workspacesworkspaces list
workspaces selectSelect workspaceworkspaces select test
workspaces deleteDelete workspaceworkspaces delete test
Pro Tip: Workspace Organization
Use separate workspaces for each engagement:
workspaces create client_name
workspaces create bug_bounty_target
workspaces create personal_recon

3. Module Management

Search Modules

modules search

Search by Keyword

modules search subdomain

Search by Category

modules search recon/domains-hosts

Load Module

modules load recon/domains-hosts/brute_hosts

Show Module Info

info

Show Module Options

options list

Module Commands

  • search : Find modules
  • load : Load module
  • info : Module info
  • options : Show options
  • run : Execute module

Option Commands

  • options set <opt> <val>
  • options unset <opt>
  • options list
  • input : Show input
  • output : Show output

4. Recon Modules

Subdomain Enumeration

modules load recon/domains-hosts/brute_hosts options set SOURCE example.com run

Certificate Transparency

modules load recon/domains-hosts/certificate_transparency options set SOURCE example.com run

DNS Enumeration

modules load recon/domains-hosts/google_site_web options set SOURCE example.com run

Contact Discovery

modules load recon/contacts-contacts/github_contacts options set SOURCE example.com run

Port Scanning

modules load recon/hosts-hosts/resolve options set SOURCE example.com run
Module CategoryDescriptionExample Module
recon/domains-hostsSubdomain discoverybrute_hosts
recon/domains-contactsContact discoverywhois_pocs
recon/hosts-hostsHost resolutionresolve
recon/hosts-portsPort scanningnmap_scan
recon/contacts-contactsContact enrichmentgithub_contacts
recon/credentials-credentialsCredential searchpwnedlist
Pro Tip: Module Chaining
Chain modules for comprehensive recon:
modules load recon/domains-hosts/brute_hosts
options set SOURCE example.com
run
modules load recon/hosts-hosts/resolve
run
modules load recon/hosts-ports/nmap_scan
run

5. Reporting Modules

Generate HTML Report

modules load reporting/html options set CREATOR "Your Name" options set CUSTOMER "Client Name" run

Generate CSV Report

modules load reporting/csv options set FILENAME /path/to/report.csv run

Generate JSON Report

modules load reporting/json options set FILENAME /path/to/report.json run

Generate List Report

modules load reporting/list options set TABLE hosts run

Generate XML Report

modules load reporting/xml options set FILENAME /path/to/report.xml run

Report Formats

  • html : Web report
  • csv : Spreadsheet
  • json : API format
  • xml : Structured data
  • list : Simple list

Database Commands

  • show hosts : Display hosts
  • show contacts : Display contacts
  • show credentials : Display creds
  • db query : Custom SQL

6. Automation Scripts

Basic Recon Script

# recon.rc - Basic reconnaissance script workspaces create example_com workspaces select example_com modules load recon/domains-hosts/brute_hosts options set SOURCE example.com run modules load recon/domains-hosts/certificate_transparency options set SOURCE example.com run modules load recon/hosts-hosts/resolve run modules load recon/hosts-ports/nmap_scan run modules load reporting/html options set CREATOR "Pentester" options set CUSTOMER "Client" run exit

Subdomain Enumeration Script

# subdomains.rc - Subdomain enumeration workspaces select example_com modules load recon/domains-hosts/brute_hosts options set SOURCE example.com options set WORDLIST /usr/share/wordlists/subdomains.txt run modules load recon/domains-hosts/certificate_transparency options set SOURCE example.com run modules load recon/domains-hosts/google_site_web options set SOURCE example.com run modules load recon/domains-hosts/bing_domain_web options set SOURCE example.com run show hosts

Contact Discovery Script

# contacts.rc - Contact discovery workspaces select example_com modules load recon/domains-contacts/whois_pocs options set SOURCE example.com run modules load recon/contacts-contacts/github_contacts options set SOURCE example.com run modules load recon/contacts-contacts/linkedin_contacts options set SOURCE example.com run show contacts

Full Recon Script

# full-recon.rc - Complete reconnaissance workspaces create full_recon workspaces select full_recon # Subdomain enumeration modules load recon/domains-hosts/brute_hosts options set SOURCE example.com run modules load recon/domains-hosts/certificate_transparency options set SOURCE example.com run # DNS resolution modules load recon/hosts-hosts/resolve run # Port scanning modules load recon/hosts-ports/nmap_scan run # Contact discovery modules load recon/domains-contacts/whois_pocs options set SOURCE example.com run # Report generation modules load reporting/html options set CREATOR "Pentester" options set CUSTOMER "Client" run exit
Pro Tip: Running Scripts

Execute scripts without interactive mode:
recon-ng -r recon.rc
Or load multiple scripts:
recon-ng -r script1.rc -r script2.rc
Schedule with cron:
0 */12 * * * recon-ng -r /path/to/recon.rc

⇧