May 27, 2026
MAXMAP: Your automated recon sidekick.
I remember the nights when recon meant opening six terminal tabs, copy-pasting subdomains from one tool to another, normalizing URLs by…
Issan
2 min read
I remember the nights when recon meant opening six terminal tabs, copy-pasting subdomains from one tool to another, normalizing URLs by hand, and still wondering what I'd missed. That workflow was killing my curiosity and my edge. So I built MAXMAP: a single-command pipeline that runs your entire attack-surface discovery from start to finish, the way a human would, just faster and without the burnout.
What MAXMAP Actually Does
MAXMAP isn't just a script that chains tools together. It's a battle tested reconnaissance workflow wrapped in bash. You feed it a domain, and it delivers everything you need to start hunting:
- Every subdomain from passive sources (
subfinder+crt.sh). - Only the live ones, filtered through
httpx. - Open ports across the estate, discovered with
naabu. - Service and version data from a targeted
nmapscan. - Hidden directories brute-forced with
dirsearch. - Historical URLs and parameters extracted by
gau. - JavaScript files ripped from those endpoints, then cleaned with
uro.
All of this lands in a single timestamped report folder. No mess, no manual merging, no "where did I save that file" moments.
The Pipeline
Every step feeds the next without human intervention. Here's the flow:
text
Subfinder → crt.sh → Live Host Detection → Port Scan → Nmap → Dirsearch → GAU → JS Extraction → Normalization → Clean ReportsSubfinder → crt.sh → Live Host Detection → Port Scan → Nmap → Dirsearch → GAU → JS Extraction → Normalization → Clean ReportsDeduplication happens automatically. Dead hosts are ignored early. Timeouts are built in so a single unresponsive server doesn't stall the whole operation. It feels like turning on a surveillance radar over a target's entire internet presence.
Using It Is Painfully Simple
Clone the repo, make it executable, and run it.
bash
git clone https://github.com/IssanPy/MAXMAP.git
cd MAXMAP
chmod +x maxmap.sh
./maxmap.sh target.comgit clone https://github.com/IssanPy/MAXMAP.git
cd MAXMAP
chmod +x maxmap.sh
./maxmap.sh target.comMiss a dependency? MAXMAP installs it for you on the first run if you let it. You don't need to chase Go tools or Python packages manually. It's built to work on a fresh Kali install.
What You're Left With
After the scan, you'll have a directory like maxmap_reports/target.com_2026-05-28_14-32/ containing:
all_subdomains.txt— every subdomain discovered.subdomains_alive_urls.txt— live HTTP/HTTPS URLs ready for fuzzing.naabu_ports.txt— open ports across all hosts.nmap_full.txt— service banners and versions.directory.txt— interesting directories and files.filterparam.txt— unique parameters waiting for injection tests.jsfiles_uro.txt— clean JavaScript URLs begging to be crawled.
It's not raw telemetry, it's a curated attack surface, organized for immediate action. Whether you're hunting IDORs, XSS, info leaks, or subdomain takeovers, everything you need is already sitting in that folder.
Why It Matters
Recon is where most bugs are found, but it's also where most hunters burn out before they even start testing. MAXMAP removes the repetitive grind so you can spend your time doing the part that actually matters: thinking like an attacker and exploiting the weaknesses the scan uncovered. I wrote this tool because I was tired of the noise. I wanted one command that answered the question "What the hell is actually out there?" and gave me a clean map of the territory. Now I start every hunt with MAXMAP, and within minutes I know more about the target than most people learn in hours.
Get Started
The code is open-source under MIT. If you believe recon should be fast, complete, and human centric, give it a star and take it for a spin.
Screenshots:
Recon hard. Hunt clean. Let the machine do the grunt work.Recon hard. Hunt clean. Let the machine do the grunt work.