ReconIntel

Agentic Attack Surface Intelligence Platform

---

ReconIntel automates the full reconnaissance lifecycle — subdomain enumeration, endpoint discovery, JavaScript analysis, and secret detection — orchestrating industry-standard open-source tools through a modern web UI backed by an async task queue.

Features

• Target Management — Add and manage domains for reconnaissance
• Full Recon Pipeline — Passive subdomain enumeration (subfinder) + HTTP probing with tech detection (httpx)
• Endpoint Discovery — Active crawling (katana) + historical URL retrieval (gau, waybackurls)
• JS Intelligence — JS file discovery, download, hidden endpoint extraction, and secret/key detection
• Findings Dashboard — Search, filter, and review security findings across all targets
• CSV Export — Export any result set for external analysis
• Async Architecture — Non-blocking task execution via Celery + Redis
• Containerized — One-command deployment with Docker Compose

Architecture

graph TB
    subgraph Frontend["Frontend (Next.js 15)"]
        UI[Dashboard UI]
        API[API Client]
    end

    subgraph Backend["Backend (FastAPI)"]
        REST[REST API]
        SVC[Services Layer]
        ORM[SQLAlchemy ORM]
    end

    subgraph Workers["Workers (Celery)"]
        RECON[Recon Tasks]
        EP[Endpoint Tasks]
        JS[JS Intelligence Tasks]
    end

    subgraph Storage["Storage"]
        PG[(PostgreSQL)]
        RD[(Redis)]
    end

    subgraph Tools["Recon Tools"]
        SF[subfinder]
        HX[httpx]
        KA[katana]
        GA[gau]
        WB[waybackurls]
        LF[linkfinder]
        SFI[secretfinder]
    end

    UI --> API
    API --> REST
    REST --> SVC
    SVC --> ORM
    SVC --> RECON
    SVC --> EP
    SVC --> JS
    RECON --> RD
    EP --> RD
    JS --> RD
    RECON --> SF
    RECON --> HX
    EP --> KA
    EP --> GA
    EP --> WB
    JS --> LF
    JS --> SFI
    ORM --> PG
    RECON --> PG
    EP --> PG
    JS --> PG

Loading

Tech Stack

Layer	Technology
Frontend	Next.js 15, React 19, TypeScript, Tailwind CSS
Backend	FastAPI, SQLAlchemy 2.0 (async), Pydantic v2
Database	PostgreSQL 16
Task Queue	Celery + Redis 7
Container	Docker & Docker Compose
Tools	subfinder, httpx, katana, gau, waybackurls, linkfinder, secretfinder

Quick Start

# Clone and launch
git clone https://github.com/AARUSHGAUR/reconintel.git
cd ReconIntel
docker compose up -d

# Access the UI
open http://localhost:3000

# API documentation
open http://localhost:8000/docs

Manual Development Setup

Backend:

cd backend
pip install -r requirements.txt
alembic upgrade head
uvicorn app.main:app --reload --port 8000

Worker (separate terminal):

cd backend
celery -A app.tasks.celery_app worker --loglevel=info --concurrency=4

Frontend:

cd frontend
npm install
npm run dev

Screenshots

Screenshots coming soon. The dashboard provides an overview of all targets, scan jobs, and discovered assets.

Dashboard	Target View	Findings
Stats cards, recent targets, quick actions	Metrics grid, scan history, results links	Tabbed interface: findings / hidden endpoints / secrets

API Overview

Method	Endpoint	Description
POST	/api/v1/targets	Create a target domain
GET	/api/v1/targets	List all targets
GET	/api/v1/targets/{id}	Target details with asset counts
DELETE	/api/v1/targets/{id}	Delete a target and all data
POST	/api/v1/scans/recon/{id}	Start full reconnaissance
POST	/api/v1/scans/endpoints/{id}	Start endpoint discovery
POST	/api/v1/scans/javascript/{id}	Start JS intelligence
GET	/api/v1/scans	List all scan jobs
GET	/api/v1/results/{id}/subdomains	List discovered subdomains
GET	/api/v1/results/{id}/endpoints	List discovered endpoints
GET	/api/v1/results/{id}/javascript	List JS assets
GET	/api/v1/results/{id}/hidden-endpoints	List hidden endpoints from JS
GET	/api/v1/results/{id}/secrets	List detected secrets
GET	/api/v1/results/findings	Global findings across all targets
GET	/api/v1/results/{id}/export/{type}	Export results as CSV

Project Structure

reconintel/
├── backend/
│   ├── app/
│   │   ├── api/v1/          # FastAPI route handlers
│   │   ├── core/            # Config, logging, execution
│   │   ├── db/              # Database session, repository
│   │   ├── models/          # SQLAlchemy ORM models
│   │   ├── schemas/         # Pydantic request/response schemas
│   │   ├── services/        # Business logic layer
│   │   └── tasks/           # Celery async task definitions
│   ├── alembic/             # Database migrations
│   ├── Dockerfile
│   └── requirements.txt
├── frontend/
│   ├── app/                 # Next.js App Router pages
│   ├── components/
│   │   ├── layout/          # Sidebar, shell components
│   │   └── ui/              # Button, Card, Badge, Toast, etc.
│   └── lib/                 # API client, utilities
├── docker-compose.yml
├── .env.example
├── LICENSE
└── README.md

Scan Pipelines

1. Full Recon

Target domain → subfinder (passive enum) → subdomains → httpx (HTTP probe) → live hosts + tech

2. Endpoint Discovery

Live hosts → katana (active crawl) + gau (URL history) + waybackurls (archive) → deduplicated endpoints

3. JS Intelligence

Endpoints → JS file discovery → download + SSRF check → linkfinder (hidden endpoints) → secretfinder (secrets)

Environment Variables

Variable	Default	Required	Description
POSTGRES_HOST	localhost	Yes	PostgreSQL host
POSTGRES_PORT	5432	Yes	PostgreSQL port
POSTGRES_USER	recon	Yes	Database user
POSTGRES_PASSWORD	recon	Yes	Database password
POSTGRES_DB	recon	Yes	Database name
REDIS_HOST	localhost	Yes	Redis host
REDIS_PORT	6379	Yes	Redis port
CELERY_BROKER_URL	auto from Redis	No	Celery broker URL
CELERY_RESULT_BACKEND	auto from Redis	No	Celery result backend
DEBUG	false	No	Enable debug logging
LOG_LEVEL	INFO	No	Logging level

Roadmap

• Target CRUD
• Full recon (subfinder + httpx)
• Endpoint discovery (katana + gau + waybackurls)
• JS intelligence (linkfinder + secretfinder)
• Findings dashboard
• CSV export
• Authentication & authorization
• Port scanning integration (naabu/nmap)
• Screenshot capture (gowitness/aquatone)
• Vulnerability scanning integration (nuclei)
• Webhook notifications
• Schedule-based recurring scans
• Dark web / breach data correlation

License

MIT — see the LICENSE file for details.