How a website security scanner works: a look at ReconRadar

ReconRadar is a website security scanner I built in Python (FastAPI); the public source is downloadable. This post explains the stages of a recon scanner. It is educational, not an attack guide.

What recon means

Before looking for vulnerabilities you must know what the target actually has: domains, servers, services. Recon is gathering that. ReconRadar does it in several modules and streams results live to a dashboard over WebSocket.

Modules

DNS and WHOIS: domain records and registration data, including a check whether the DNS server allows a full zone transfer, a well-known misconfiguration. crt.sh: certificates in public certificate logs list domain names, revealing subdomains documented nowhere else. Subdomains: besides crt.sh, a wordlist is used to guess subdomains. Takeover detection: if a subdomain points to an external service that no longer exists, someone else may claim it; the module checks for that. HTTP probe: which subdomains really respond, with what title, server and technology. HTTP vulnerability checks: light checks such as reachable sensitive files (like a .env that may hold secrets) and weak security headers; it reports that something is reachable, it does not exploit it. OSINT: public information about the target. Ports with nmap: open services; some nmap modes such as OS detection need admin/root.

Every scan is saved in a history and produces an HTML report.

Authorization

Scanning a system you do not have permission to test is a crime in many countries. Use it only on your own systems or where you have explicit permission. That is why I published the base, less aggressive version and removed the reports of real scans from the package.

What I learned

Most findings are not sophisticated attacks; they are a forgotten .env, an abandoned subdomain, a missing header. I found the same kinds of problems in my own projects (example). Good recon helps the system owner first.