rekono is an open-source offensive security platform that chains 19 hacking tools into automated assessments, built for pentesting, red-teaming and authorized security audits.
| Tool | pablosnt/rekono — offensive security platform automating attack surface discovery and vulnerability management |
| Category | Attack surface management and security automation platform |
| Primary Use | Automating recon and pentesting workflows in authorized engagements: chaining nmap, nuclei and other tools, deduplicating findings, enriching CVEs and generating reports |
| Safe Use | Intended strictly for authorized security testing, education and research; the disclaimer requires explicit permission for every target added to the platform |
| Telemetry Note | Orchestrates well-known scanners (nmap, nikto, OWASP ZAP, nuclei, Metasploit) whose network signatures remain visible to defenders; Rekono itself sends outbound queries to enrichment sources like NVD, VulnCheck and VirusTotal, creating observable traffic patterns |
Every engagement begins the same way: passive collection, host discovery, port and service enumeration, then targeted tooling against whatever answers on the wire. rekono, a GPL-3.0-licensed Python project from pablosnt with 608 stars, is built around the observation that this sequence is tedious, repetitive, and almost identical from one assessment to the next. Its pitch is blunt and well-placed: automate the recon, keep your time for the part that actually needs a hacker. The result is not another wrapper script but a full platform — projects, roles, notes, triage, metrics, reporting and scheduled scans — that orchestrates tooling end to end while the operator focuses on exploitation and judgment.
The core mechanic is chaining. You define a target, and whatever one tool discovers becomes the input of the next: ports found by nmap get routed to the right service-specific scanners, detected technologies get checked for known vulnerabilities, and those vulnerabilities get matched against public exploit databases. The README frames this as the entire value proposition, and it is the correct one — the manual plumbing between tools, copying hostnames and ports from one terminal into the next, is where most recon time evaporates. Because the chain runs unattended, the operator returns to an already-mapped attack surface with leads prioritized rather than a pile of raw output.
The tool inventory is substantial: 19 hacking tools are supported at the time of writing. OSINT is covered by theHarvester and EmailHarvester; host and service enumeration by nmap; content discovery by Dirsearch and Gobuster. TLS hygiene goes through sslscan and SSLyze, exposed secrets through GitLeaks, and protocol-specific checks through ssh-audit for SSH and SMBMap for SMB. The web layer is where it gets dense: Log4j Scan, Spring4Shell Scan, CMSeeK, OWASP JoomScan, OWASP ZAP and Nikto all plug in, with nuclei handling template-based vulnerability scanning and SearchSploit plus Metasploit covering exploit correlation. Notably, Metasploit's presence means the platform can reach into active exploitation territory — a fact that reinforces the author's insistence on explicit authorization for every target.
Where rekono distinguishes itself from a simple orchestrator is data management. The same finding reported by three different tools collapses into one finding in the platform, attached to the host, port or technology where it was found. This deduplication is the difference between an attack surface inventory and a log dump. Vulnerability management goes further: findings can be confirmed or dismissed as false positives, dismissed verdicts survive reappearances, and findings are automatically marked fixed once executions stop detecting them — with exposure duration tracked. That last detail, how long a vulnerability was visible across repeated scans, is report gold for any consultant writing remediation guidance.
CVE enrichment is handled through a notably broad set of integrations. Detected CVEs are enriched from NVD NIST, VulnCheck NVD++, OSV, GHSA and the EU Vulnerability Database, scored with FIRST EPSS percentiles, and flagged as trending when CVE Crowd says so. The EPSS angle matters: prioritization stops being a CVSS-only exercise and starts reflecting exploitation likelihood, which is how most mature programs triage today. There is also a HackTricks integration that links findings to relevant wiki pages, shortening the path from detection to understanding for the auditor.
Defensive-side plumbing is present too. Findings can be shipped to DefectDojo for downstream vulnerability management, and identified hosts get reputation lookups in VirusTotal. This positions rekono sensibly in a broader toolchain rather than as a walled garden — an important architectural choice, since most teams already have a system of record and do not want findings trapped in the scanner that found them.
Operationally, the platform is notification-first. Email via SMTP and a Telegram bot push execution results and alerts, and the Telegram integration is bidirectional: it launches scans and delivers findings to your phone. The alerting model lets you declare what you are hunting for and get pinged the moment it appears, which pairs naturally with scheduled and repeated scans for continuous attack-surface monitoring on long-running authorized programs. Scans are tunable as well — aggressiveness levels, routing through your own proxy, and injecting the headers and credentials your target expects.
Deployment is a single docker compose up -d --scale executions-worker=5, with the scaled worker count revealing the execution architecture: a queue-based worker pool that runs tool executions asynchronously, decoupled from the web frontend. First login is rekono:rekono on https://127.0.0.1, and the README rightly screams at you to change it immediately. There is an upgrade guide for 1.x migrations, noting that database migration runs automatically but with caveats worth reading before you touch a production instance holding engagement history.
Everything the platform does is also exposed via an API — the README calls it the automation of the automation — which opens legitimate integration paths: feeding findings into a SIEM, triggering scans from a ticketing workflow, or driving continuous monitoring from CI. For a consultancy, the reporting module rounds it out: a full assessment becomes a deliverable in seconds using your own template, with project metrics showing where risk concentrates and how exposure evolves over time.
The project's provenance is worth weighing: it is open source under GPL-3.0, maintained by a single developer working in free time with no external funding, supported through Ko-fi and Buy me a Coffee, with a Discord community and documented contribution guidelines. The name comes from Esperanto for recon. A single-maintainer platform at the center of your engagement pipeline is a dependency risk to factor in, but the code quality implied by the architecture — workers, integrations, migration tooling — suggests a serious effort.
The disclaimer is explicit and should be taken at face value: rekono is intended only for authorized security testing, education and research, with explicit permission required for every target you add. In the wrong hands against systems you do not own, an automated chain that runs Metasploit and nuclei against discovered services is a legal liability generator. In the right hands — a scoped engagement, an internal attack-surface program, a lab — it is exactly the kind of plumbing removal that lets a professional spend the day on the work that actually requires judgment.
pablosnt/rekono.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.