Post cover image

August 10, 2026

Stop Drowning in Recon Output. Start Hunting the Signal.

ReconRaptorAI is a reconnaissance workflow for authorised security testing that keeps the useful output separate from the noise.

By Devansh Patel

4 min read

Recon can uncover a lot, but it can also leave you with a directory packed with duplicate URLs, tool output, JavaScript files, and no obvious starting point.

ReconRaptorAI was built for that part of the job.

It is a Bash workflow for bug bounty work and other authorised assessments. It runs asset discovery, URL collection, JavaScript analysis, focused validation, optional AI triage, and reporting in one structured run.

It does not replace manual verification. It gives you a better place to begin: review the strongest lead, follow it back to the evidence, reproduce it, and then report it through the right channel.

What ReconRaptorAI does

The workflow follows this path:

scope → subdomains → URLs → JavaScript → validators → AI triage → reportsIn practice, it handles the following work:
  • It finds subdomains, resolves DNS, and identifies live hosts with subfinder, dnsx, and httpx.
  • It combines historical URLs from waybackurls with live crawling from katana.
  • It downloads live JavaScript, runs Gitleaks, checks higher-confidence secret patterns, and retains source links.
  • It checks exposed files, redirects, CORS, GraphQL, cloud storage, TLS information, and subdomain takeover signals.
  • It runs focused Nuclei profiles and a technology-mapped Nuclei scan.
  • It can rank leads with OpenAI, Ollama, or local rules.
  • It writes a START_HERE.md index and keeps findings, candidates, raw data, and evidence in separate places.

Installation

Clone the repository, make the scripts executable, and run the installer:

git clone https://github.com/Zuri09/ReconRaptor.git
cd ReconRaptor
chmod +x install.sh reconraptor.sh
./install.sh

The installer checks for Go and installs these tools:

subfinder · dnsx · httpx · katana · nuclei · tlsx · subzy · waybackurls · gitleaks

If one of the Go-installed tools is not available after restarting the terminal, add the Go bin directory to your shell profile:

export PATH="$PATH:$(go env GOPATH)/bin"

Local AI triage with Ollama

If you want local AI triage, install Ollama with the rest of the toolchain:

./install.sh - with-ollama

To choose a different model during installation:

./install.sh - with-ollama - ollama-model llama3.1

If you are offline or want to keep your existing Nuclei template cache untouched:

./install.sh - skip-nuclei-templates

These are the commands most readers will want to copy first.

None

Replace example.com with a domain you own or are explicitly allowed to test.

Standard scan

./reconraptor.sh -d example.com

Let ReconRaptorAI select the available AI provider

./reconraptor.sh -d example.com - ai

auto mode uses OpenAI when OPENAI_API_KEY is set, then Ollama when it is available, then local rules.

Run local Ollama triage

./reconraptor.sh -d example.com - ai - ai-provider ollama

Use a specific Ollama model:

./reconraptor.sh -d example.com - ai - ai-provider ollama - ai-model llama3.2:3b

Run cloud triage with OpenAI

OPENAI_API_KEY="your_api_key" ./reconraptor.sh -d example.com - ai - ai-provider openai

Keep triage entirely offline

./reconraptor.sh -d example.com - ai - ai-provider rules

Send the final results archive to Discord

./reconraptor.sh -d example.com -w "https://discord.com/api/webhooks/..."

Use a webhook you control. The results archive may contain sensitive data.

Tune validation speed

MAX_VALIDATION_TARGETS=500 VALIDATOR_PARALLELISM=20 CURL_TIMEOUT=10 \
 ./reconraptor.sh -d example.com

Important options

- `-d, --domain <domain>`: The target domain. This is required.
- `-w, --webhook <url>`: Uploads the final results zip to a Discord webhook.
- `--ai`: Enables AI-powered triage.
- `--ai-provider <mode>`: Select `auto`, `openai`, `ollama`, or `rules`.
- `--ai-model <model>`: Sets the model name for OpenAI or Ollama.
- `NUCLEI_TEMPLATE_TAGS=...`: Replaces the default curated Nuclei template tags.
- `NUCLEI_AUTOMATIC_SCAN=false`: Turns off the technology-mapped Nuclei scan.
- `-h, --help`: Shows the command-line help screen.

For example, to narrow the curated Nuclei profile or disable the automatic scan:

NUCLEI_TEMPLATE_TAGS="exposure,misconfig,kev,vkev,cve" \
 ./reconraptor.sh -d example.com
NUCLEI_AUTOMATIC_SCAN=false ./reconraptor.sh -d example.com

Where the results go

Every run creates a target directory such as recon_example.com/. Start with START_HERE.md.

recon_example.com/
├── START_HERE.md
├── raw/ # discovery data: hosts, URLs, JS, JSON
├── reports/
│ ├── findings/ # confirmed or high-confidence validator output
│ ├── ai/ # optional ranked triage and sanitised AI context
│ ├── js/ # Gitleaks, secrets, and client-side indicators
│ ├── urls/ # URL disclosure leads and sensitive-file matches
│ ├── pd/ # Nuclei and TLS output
│ └── candidates/ # raw candidates checked by validators
└── evidence/ # downloaded JS and validator material

The separation is deliberate. Raw discovery data still has value, but it should not bury the leads you need to review first.

A note on AI triage and sensitive data

AI triage is optional. When enabled, ReconRaptorAI produces a sanitised context file and a ranked summary. Before it sends context to an AI provider, it removes secret-like query values, raw request and response bodies, downloaded JavaScript bodies, and long text.

That helps, but scan output still deserves care. Store the results securely, check what you share, and use offline rules or local Ollama when an engagement requires everything to stay on the machine.

Keep the review path simple

ReconRaptorAI helps you spend less time looking through output and more time deciding what deserves attention.

Use it only on assets you own or are explicitly authorised to test. Treat scanner and AI output as leads, confirm findings manually, follow the program scope, and report responsibly.

Repository: https://github.com/Zuri09/ReconRaptor

If you want to read stories from me about the vulnerabilities:

Auth Bypass is it? Target, domains, API keys, bearer tokens, SSO IDs, and organisation names are redacted. This writeup is for educational…

I Asked the Frontend for Secrets, and It Said Yes Target, domains, API keys, tokens, SSO IDs, and organisation names are redacted. This write-up is for educational…

Unauthenticated Image Access and EXIF Location Leak, Easy P4, you can find under 2 mins FREE LINK

How I hacked a website just by looking at the source code Part-2 This is a very easy P4 bug.

Stay curious. Stay dangerous. 💻🕶

👉 Follow me on LinkedIn 💼 | Portfolio 🧑‍💻