NoWRecon is a Python subdomain enumeration and reconnaissance tool combining ten keyless passive sources with active brute forcing and deep correlation, built for authorized red team assessments.
| Tool | Rebellionxkid/NoWRecon — subdomain enumeration and recon console with passive and active collection, deep correlation, and bucket discovery |
| Category | Domain reconnaissance / attack surface mapping |
| Primary Use | Mapping subdomains, DNS records, open ports, vhosts, and cloud storage buckets of an in-scope domain during authorized assessments |
| Safe Use | Use only against domains you are explicitly authorized to test — the README itself warns that AXFR attempts, brute force, and vhost probing touch the target's infrastructure directly |
| Telemetry Note | Active stages generate direct DNS queries, SYN/TCP-connect scans against 61 ports, and HTTP probes visible in target logs; passive queries hit public sources like crt.sh, urlscan.io, and OTX from your own IP |
NoWRecon is a Python-based reconnaissance tool, MIT-licensed and sitting at 27 stars on GitHub, that positions itself squarely as a subdomain enumeration and recon console for red team work. What immediately distinguishes it from the crowded field of subfinder-style enumerators is its dual front end: a one-shot flag-driven CLI and a persistent, msfconsole-style interactive console, both built on top of a shared engine (subscout/runner.py). The tool requires no API keys for its core functionality, which lowers the barrier to entry considerably for operators who don't maintain a stack of SecurityTrails or Censys credentials.
The passive collection layer pulls from ten sources without any API keys: crt.sh, CertSpotter, Wayback Machine, OTX, HackerTarget, RapidDNS, Anubis, urlscan.io, BufferOver, and ThreatMiner. These live in subscout/sources/ as pluggable modules, which is a clean architectural decision — the README explicitly notes that key-gated sources like VirusTotal, Shodan, and Censys aren't wired in yet but the plugin structure anticipates them. Passive collection is the lowest-signal stage from a detection standpoint since it queries third-party archives rather than the target itself.
Active collection is where NoWRecon earns its red team framing. Wordlist brute force, AXFR zone transfer attempts, permutation mutations in the dnsgen style, and an optional deep-brute round that mines patterns from names already found all touch the target's DNS infrastructure directly. The README is refreshingly honest about this in its Legal section, stating plainly that only authorized domains should ever be scanned. A resolver module (core/resolver.py) handles wildcard-aware DNS resolution, and critically it checks for wildcard catch-alls independently at every zone level rather than just the root — so a wildcard on *.dev.example.com gets caught even when the apex zone is clean.
The deep correlation stage is the most technically interesting part. It chains TLS SAN extraction, HTTP probing plus crawling, PTR sweeps with forward-confirmed reverse DNS (FCrDNS), vhost probing, SPF/DMARC/MX record analysis, CSP header inspection, and JS source map discovery. The pipeline diagram in the README shows candidates flowing from passive and active sources through the resolver, into the permutation round, and only then into deep-mode enrichment before landing in a SQLite history store with JSON/CSV/TXT export. This is a genuine correlation engine, not a wrapper that shells out to other tools.
What sets NoWRecon apart conceptually is its obsession with scope discipline. The README dedicates an entire section to how deep mode avoids pulling in unrelated domains, and the details matter. PTR sweeps are capped to the discovered IP's own /24 (Scope.ptr_scan_targets) and skipped entirely for IPs on CDN, cloud, or shared-hosting ASNs (Scope.is_shared_infra) — sweeping Cloudflare's /24 would otherwise return thousands of unrelated tenants. Every PTR hit must pass forward-confirmed reverse DNS in Scope.accept_ptr_result, requiring the name to be in scope and the forward resolve to land back in the same /24. Vhost probing uses a baseline fingerprint with a nonsense Host header and only counts candidates whose responses differ.
Port scanning covers 61 ports using raw SYN packets when the interpreter has CAP_NET_RAW — granted via sudo setcap cap_net_raw+ep $(readlink -f $(which python3)) — with automatic fallback to plain TCP connect and a built-in retry pass. The README's troubleshooting note is unusually candid about false negatives: hosts under load or a busy scanning machine can cause genuinely open ports to miss a short timing window, and the advice is to raise CONNECT_TIMEOUT above its 3-second default. This kind of operational nuance suggests the author has actually run the tool against real infrastructure.
Cloud storage bucket discovery spans S3, GCS, Azure Blob, DO Spaces, B2, Wasabi, Linode, Alibaba OSS, and Scaleway. The primary discovery method is clever: it derives bucket candidates from the target's own CNAME records, which is evidence-based rather than speculative. The optional --buckets flag adds brand-name guessing on top. The org graph feature extends this organizational thinking, finding sibling domains via shared SPF/DMARC/MX records, shared TLS certificates, repeated crawl links, and a lightweight TF-IDF content-similarity score — notably without any ML dependency.
The EXPAND_ORG setting deserves particular attention for its authorship ethics: by default it only lists candidate sibling domains and refuses to scan them without explicit opt-in. The README states the reasoning directly — evidence of common ownership is not the same as authorization to scan it. This is a rare explicit boundary in recon tooling, and it reflects a correct understanding of how scope agreements actually work in professional engagements. Similarly, NSEC/DNSSEC detection is passive while a full NSEC walk via --nsec-walk is opt-in.
The interactive console, launched with python -m subscout.cli, follows the Metasploit interaction model closely: set OPTION VALUE, show options, run, setup, and unset commands against a persistent prompt that displays the current target domain. The console doesn't exit after one scan, letting operators pivot between targets in a session. During any scan, pressing Enter skips the current stage — a pragmatic touch for long-running deep scans where one stage is dragging. Rate-limiting controls exist for DNS queries per resolver (--dns-rate) and HTTP requests per target IP (--ip-rate), both important for keeping authorized scans from becoming accidental denial of service.
Scan history in SQLite gives NoWRecon a diffing capability that most enumerators lack: the second and later runs report what's new and what disappeared since the last scan. For continuous attack surface monitoring of your own estate, this turns the tool from a one-shot enumerator into a change-detection system, and it's equally useful for defenders watching their own perimeter drift. The --debug flag adds per-source attribution showing which source found each name — valuable when triaging whether a finding came from crt.sh or a live brute-force hit.
The honest Status section is worth reading before deploying this anywhere serious. The author discloses that resolver and pipeline tests were only syntax-checked with py_compile, not executed, and recommends running pip install -r requirements.txt && pytest plus a test scan against a domain you control before relying on the tool. Tor/bridge support is planned but absent. Installation is standard: git clone the Rebellionxkid/NoWRecon repository and pip install -r requirements.txt. The internal package is subscout, with cli.py built on Typer and console.py providing the interactive front end. For professionals who value a tool whose author documents its own limitations this precisely, NoWRecon is worth a look — just verify its wildcard filtering and PTR gating behave as claimed in your own lab first.
Rebellionxkid/NoWRecon.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.