# Recon Ng

> Use for modular passive reconnaissance during authorized pentests. Trigger on domain and company profiling, contact and infrastructure lead generation, and correlating public-source recon with approved scope.

- Skill: `timsonner/recon-ng` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/recon-ng`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/recon-ng/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/recon-ng

---


# Recon-ng

## Purpose

Use this skill for structured, modular recon when the engagement benefits from organizing passive findings into a workspace.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning

## Use When

- Need organized passive recon across public sources.
- Need to correlate company, domain, contact, and infrastructure leads.
- Need a repeatable recon workspace for long engagements.

## Avoid When

- Passive recon scope is unclear.
- Results would be treated as confirmed exposure without validation.

## Inputs

- Approved company or domain scope
- Module set aligned to the recon objective
- Output handling and reporting needs

## Procedure

1. Create a workspace for the specific approved objective.
2. Use only the modules relevant to the current question.
3. Correlate leads rather than collecting indiscriminately.
4. Hand confirmed candidates to direct validation tools.
5. Preserve the workspace and module path for later comparison.

## Command Syntax

Launch syntax is simple; resource files are the most reliable way to show repeatable module execution from the command line.

```bash
# Launch the framework
recon-ng

# Launch with a named workspace
recon-ng -w contoso

# Run a resource file non-interactively
recon-ng -w contoso -r contoso-recon.rc

# Inside the recon-ng console:
workspaces create contoso
db insert domains contoso.com
marketplace install recon/domains-hosts/bing_domain_web
modules load recon/domains-hosts/bing_domain_web
options set SOURCE contoso.com
run
modules load reporting/html
options set FILENAME /tmp/contoso-recon.html
run
```

## Evidence to Capture

- Passive recon leads relevant to the approved scope
- Exact module set and workspace used
- What was validated versus what remained a lead

## Safety Boundaries

- Keep recon passive and scope bound.
- Treat all output as unverified until corroborated.