DeepRecon

DeepRecon is an expert-grade, modular target intelligence and reconnaissance framework designed for security professionals, bug bounty hunters, and red team operators. Created by etshx, DeepRecon automates deep discovery, documentation analysis, application understanding, role modeling, API inventorying, JavaScript deconstruction, data model inference, threat modeling, and testing roadmap generation -- producing a beautiful, interactive HTML report to fully understand a target before any vulnerability assessment begins.

---

Overview

DeepRecon executes a rigorous 10-phase reconnaissance methodology against a target URL, API, mobile application, or GitHub repository. It maps attack surfaces, extracts secrets from JavaScript, enumerates APIs, builds threat models, and generates a professional, dark-mode HTML dashboard with Mermaid diagrams, collapsible sections, global search, and risk-colored findings.

---

Features

• 10 Deep Reconnaissance Phases

  1. Discovery (fingerprinting, subdomain enumeration, endpoint crawling, asset mapping)
  2. Documentation (Swagger/OpenAPI, GraphQL, README, changelogs, GitHub repos)
  3. Application Understanding (purpose, user journeys, data flow, critical assets)
  4. Role Analysis (permissions, trust boundaries, privilege escalation vectors)
  5. API Knowledge (endpoint enrichment, auth detection, CORS analysis, dependency graphs)
  6. JavaScript Analysis (secret recovery, hidden APIs, feature flags, source maps, debug routes)
  7. Data Model (object inference, relationships, ownership, identifier classification)
  8. Threat Model (trust boundaries, attack surface, abuse cases, risk register)
  9. Testing Roadmap (prioritized tests mapped to OWASP Top 10, OWASP API Top 10, CWE, MITRE ATT&CK)
  10. Final Report (professional interactive HTML with search, navigation, diagrams, and tables)

• Interactive HTML Report

  • Dark mode professional dashboard
  • Collapsible sections
  • Global search
  • Navigation sidebar
  • Mermaid diagrams (architecture, auth flow)
  • Risk-colored badges (Critical / High / Medium / Low)
  • Responsive and printable

• Extensible Architecture

  • Modular phase-based engine
  • Pluggable HTTP client with proxy, cookie, header, and auth support
  • YAML-based configuration
  • Jinja2 templating for custom reports

---

Installation

git clone https://github.com/etshx/deeprecon.git
cd deeprecon
pip install -r requirements.txt

---

Quick Start

Run against a target URL:

python -m deeprecon -u https://target.com -o ./output

With a custom configuration file:

python -m deeprecon --config config.yml

Generate both HTML and JSON reports:

python -m deeprecon -u https://target.com --json

---

Configuration

Create a config.yml:

target:
  name: "Example Corp"
  url: "https://example.com"
  type: "web"
  scope:
    - "https://example.com"
  out_of_scope:
    - "https://thirdparty.com"
  headers:
    X-Bug-Bounty: "etshx"
  proxy: "http://127.0.0.1:8080"
  threads: 20
  rate_limit: 10
  depth: 3

recon:
  output_dir: "./output"
  report_format: "html"
  verbose: true
  skip_ssl_verify: false
  max_pages: 1000
  max_js_files: 500

---

Architecture

DeepRecon/
├── deeprecon/
│   ├── __init__.py
│   ├── __main__.py          # CLI entry point
│   ├── core/
│   │   ├── config.py        # Configuration dataclasses
│   │   ├── base.py          # BasePhase & ReconContext
│   │   └── reporter.py      # HTML/JSON report generator
│   ├── phases/
│   │   ├── discovery.py
│   │   ├── documentation.py
│   │   ├── application.py
│   │   ├── roles.py
│   │   ├── api_knowledge.py
│   │   ├── js_analysis.py
│   │   ├── data_model.py
│   │   ├── threat_model.py
│   │   └── testing_roadmap.py
│   ├── utils/
│   │   ├── http_client.py
│   │   └── dns_enum.py
│   └── templates/
│       └── report.html      # Professional interactive template
├── tests/
├── examples/
├── requirements.txt
└── README.md

---

Methodology

DeepRecon follows a systematic, intelligence-driven approach:

Phase 1 -- Discovery

Fingerprint the target technology stack, enumerate subdomains, crawl endpoints, discover APIs, and map public assets.

Phase 2 -- Documentation

Automatically discover and read every documentation source: Swagger, OpenAPI, Postman, GraphQL schemas, READMEs, developer docs, SDKs, GitHub repositories, release notes, and changelogs.

Phase 3 -- Application Understanding

Infer the application purpose, map user journeys (Guest to Dashboard to Billing to Export), identify business-critical assets, and detect state-changing actions.

Phase 4 -- Role Analysis

Identify all roles (Guest, Member, Owner, Admin, Support, Billing, Developer, Organization Owner, Super Admin), build permission matrices, map trust boundaries, and highlight privilege escalation opportunities.

Phase 5 -- API Knowledge

Enrich every discovered endpoint with authentication type, authorization model, parameters, headers, cookies, CORS policy, rate limiting, business impact, and risk level.

Phase 6 -- JavaScript Analysis

Read every JavaScript file to recover endpoints, secrets (AWS keys, API keys, JWTs), feature flags, hidden APIs, debug routes, environment variables, source maps, and internal functions.

Phase 7 -- Data Model

Infer objects, relationships, ownership chains, and identifier patterns (UUIDs, sequential IDs, MongoDB ObjectIds). Assess tenant isolation risks.

Phase 8 -- Threat Model

Produce a complete threat model with trust boundaries, attack surface mapping, asset inventory, actors, abuse cases, and a prioritized risk register covering business logic, authentication, authorization, and data exposure risks.

Phase 9 -- Testing Roadmap

Generate an expert testing roadmap with prioritized tests (Critical / High / Medium / Low), manual steps, automation opportunities, required tools, and full mapping to OWASP Top 10, OWASP API Top 10, CWE, and MITRE ATT&CK. Includes recommended Burp Suite workflows, ffuf wordlists, nuclei templates, and recon commands.

Phase 10 -- Final Report

Compile everything into a professional, interactive HTML report with executive summaries, architecture diagrams, technology stack tables, role matrices, API inventories, authentication flows, data models, threat models, testing checklists, and all findings.

---

Output

The final deliverable is an interactive HTML file (report.html) containing:

• Executive Summary with key metrics
• Architecture Overview with Mermaid diagrams
• Technology Stack fingerprinting results
• Application Flow and User Journeys
• Role Matrix and Permission tables
• API Inventory with risk badges
• Authentication Flow diagram
• JavaScript Analysis (secrets, hidden APIs, source maps)
• Data Model (objects, relationships, ownership)
• Threat Model (trust boundaries, risk register)
• Testing Roadmap (prioritized tests, tool recommendations, recon commands)
• Complete Findings table with severity-colored badges

---

Contributing

Contributions are welcome. DeepRecon is built with extensibility in mind. To add a new phase, inherit from BasePhase in deeprecon/core/base.py, implement the run method, and register it in __main__.py.

---

Disclaimer

DeepRecon is intended for authorized security testing and research only. Always ensure you have explicit permission before scanning any target. The author assumes no liability for misuse.

---

Author

etshx -- Security Researcher & Developer

---

License

MIT License. See LICENSE for details.