reconFTW Tutorial: The Recon Tool That Found My Hidden Bounty

reconFTW Tutorial & Review 2026: Automated Recon Framework for Bug Bounty and Pentest Engagements

Three days into a private bug bounty program, I was still hand-chaining subfinder, httpx, and nuclei against a target with 40+ known subdomains — and missing the one asset that actually mattered. It was a forgotten staging vhost sitting behind the same WAF as production, discovered only after I let reconFTW run its permutation and vhost-fuzzing modules overnight. That single subdomain turned into a stored XSS finding worth a four-figure bounty. That's the moment reconFTW stopped being "just another GitHub recon script" for me and became a permanent fixture in my engagement workflow.

This is a hands-on tutorial and review of reconFTW (six2dez/reconftw) — what it actually does under the hood, how to install and run it properly, where it shines, where it falls short, and how it compares to alternatives like Osmedeus and reNgine.

Table of Contents

• What Is reconFTW & Who It's For
• Key Features Breakdown
• Installation & Setup
• Hands-On Usage / Command Walkthrough
• Real-World Case Study
• Pros & Cons
• reconFTW vs Alternatives
• Pricing & Licensing
• Expert Tips & Common Mistakes
• Legal / Ethical Use Note
• Related Articles
• FAQ
• Verdict / Final Rating

What Is reconFTW & Who It's For

reconFTW is an automated reconnaissance framework built for bug bounty hunters and penetration testers who need broad attack-surface coverage without manually orchestrating 40-50 individual tools. Instead of being a single-purpose scanner, it's an orchestration layer — a Bash-based framework (now split into 8 modular files: subdomains.sh, web.sh, vulns.sh, osint.sh, core.sh, modes.sh, utils.sh, axiom.sh) that wires together subfinder, httpx, nuclei, dalfox, ffuf, sqlmap, dnsx, and dozens more into a single repeatable pipeline.

It's built for:

• Bug bounty hunters who need to maximize attack surface across large scopes fast
• Pentesters running the discovery/enumeration phase of an external engagement
• Red teamers who need distributed scanning across large IP/domain lists (via Ax/Axiom)
• Security students learning how a full recon pipeline is structured, since the config file itself is a masterclass in what "good recon" looks like

Automated Reconnaissance Under 1GB

Key Features Breakdown

Category	What It Does	Underlying Tools
Subdomain Enumeration	Passive, brute-force, permutation, cert transparency, recursive	subfinder, puredns, Gotator, crt, dnsx
OSINT	Leaked creds, GitHub secrets, cloud bucket exposure, dorking	gitleaks/trufflehog, dorks_hunter, cloud_enum
Web Analysis	Probing, screenshots, JS secret extraction, GraphQL/gRPC detection	httpx, katana, JSA, xnLinkFinder
Vulnerability Scanning	XSS, SSRF, SQLi, SSTI, LFI, command injection, cache poisoning	nuclei, dalfox, sqlmap, TInjA, commix
Distributed Scanning	Cloud-fleet parallel scanning for large scopes	Ax Framework (formerly Axiom)
Reporting	Consolidated HTML/JSON reports, optional local AI summarization	reconftw_ai (Ollama-based)

Installation & Setup

reconFTW is CLI-only, runs on Linux/macOS (Bash 4+), and needs a real machine or VPS — not your laptop. Budget 10-20GB disk space minimum.

git clone https://github.com/six2dez/reconftw
cd reconftw
./install.sh --verbose

This pulls Golang, all Go-based tools, Python dependencies, and clones ~nuclei-templates. On a fresh VPS this takes 15-30 minutes depending on bandwidth. If you're not running as root, whitelist sudo first to avoid password prompts mid-scan:

sudo echo "${USERNAME} ALL=(ALL:ALL) NOPASSWD: ALL" | sudo tee -a /etc/sudoers.d/reconFTW

For a disposable, no-mess setup, Docker is the better call:

docker pull six2dez/reconftw:main
docker run -it --rm \
  -v "${PWD}/OutputFolder/:/reconftw/Recon/" \
  six2dez/reconftw:main -d example.com -r

Before your first real scan, configure API keys — Shodan, WHOISXML, ProjectDiscovery Cloud (PDCP) — either as environment variables or in secrets.cfg. Skipping this cuts your passive subdomain coverage significantly.

Hands-On Usage / Command Walkthrough

./reconftw.sh -d target.com -r

What it does: Full passive+active recon without launching intrusive attacks — subdomain enum, web probing, port scanning, screenshots, OSINT. This is my default first pass on any new scope. Expected output: a target folder with subdomains/, webs/, osint/, hosts/ subdirectories and a consolidated report.json at the end.

./reconftw.sh -d target.com -p

What it does: Passive-only mode — no active DNS bruteforce or fuzzing. I use this for scope reconnaissance before I've confirmed rules of engagement, or on programs with strict rate-limit policies.

./reconftw.sh -d target.com -a

What it does: Full recon plus active vulnerability checks (XSS, SQLi, SSRF, SSTI, etc.) — the "YOLO mode." This is intrusive; only run it once you have explicit written authorization and the program's scope confirms active testing is allowed.

./reconftw.sh -d target.com -r --deep

What it does: Enables DEEP mode — ignores result-count thresholds, runs recursive permutations and full wordlists. This is where I found that staging vhost mentioned earlier. Only run this on a VPS; it's genuinely slow and disk-hungry.

./reconftw.sh -d target.com -r -v

What it does: Enables Ax/Axiom distributed scanning across a cloud fleet. When I'm hunting on a program with a huge scope (500+ subdomains), this cuts total scan time from days to hours by parallelizing across 10-30 instances.

./reconftw.sh -l targets.txt -r -o /path/to/output/

What it does: Batch mode across a domain list, custom output path — useful for multi-program hunting or recurring monitoring.

./reconftw.sh -d target.com -r --incremental --monitor --monitor-interval 60

What it does: Continuous monitoring mode, re-scanning on an interval and only flagging new findings since the last run. I run this against my top 3-4 active bounty targets so new subdomains or exposed endpoints hit my inbox via notify (Slack/Discord/Telegram) before other hunters find them.

Real-World Case Study: Finding the Forgotten Asset

On a mid-tier SaaS bounty program, initial passive enumeration (subfinder + crt.sh manually) turned up 38 subdomains — all production-facing, all heavily WAF'd, all already picked over by other hunters. I ran ./reconftw.sh -d target.com -r --deep -v overnight using a 15-node Ax fleet. The DEEP permutation engine (Gotator + regulator) generated pattern-based guesses off the existing subdomain list and resolved one that stood out: a staging-api vhost that wasn't in any passive source because it had never been indexed by CT logs under its own cert — it shared the wildcard cert with production.

httpx flagged it as live, katana crawled it, and nuclei's default templates caught a debug endpoint leaking stack traces with DB connection strings partially redacted but still informative. From there, manual testing on that endpoint surfaced a stored XSS in an internal admin note field that wasn't sanitized the same way as the public-facing equivalent. The entire discovery chain — from zero to finding — was reconFTW's permutation + vhost-fuzzing + nuclei default scan doing the heavy lifting; my manual effort started only after the tool had already narrowed 40 subdomains down to one interesting lead.

Pros & Cons

Pros	Cons
Extremely comprehensive — 50+ tools orchestrated in one pipeline	Steep resource requirements (10-20GB disk, VPS recommended for DEEP mode)
Highly configurable via reconftw.cfg (100+ toggles)	Config file is intimidating for absolute beginners
Active development, modular codebase, real test suite (bats-core)	Full/DEEP scans can take many hours on large scopes without Axiom
Native Docker, Terraform+Ansible, and Ax distributed scanning support	Some modules need paid API keys (Shodan, WHOISXML) for best coverage
Built-in checkpoint/resume, incremental mode, and adaptive rate limiting	Occasional false positives from nuclei defaults need manual triage

reconFTW vs Alternatives

Feature	reconFTW	Osmedeus
Architecture	Bash, modular script framework	Go-based workflow engine (YAML workflows)
Customization	Single massive config file, very granular	YAML workflow files, more code-like
Distributed Scanning	Native Ax/Axiom integration	Built-in cloud provisioning (own system)
Vulnerability Depth	Deep — nuclei, dalfox, sqlmap, commix, TInjA, etc.	Lighter, more enum-focused by default
Learning Curve	Moderate — long cfg file but well-commented	Moderate-to-high — workflow YAML syntax
Best For	Bounty hunters wanting maximum out-of-box coverage	Users wanting custom, code-defined workflows

Pricing / Licensing

reconFTW is 100% free and open-source under the MIT license. There's no paid tier, no SaaS version. Some integrated data sources (Shodan, WHOISXML) have their own free/paid API tiers that affect coverage depth, but the tool itself costs nothing. The project accepts donations via Buy Me a Coffee, GitHub Sponsors, and PayPal.

Expert Tips & Common Mistakes

• Don't run DEEP mode on a laptop. It will eat your disk and CPU. Use a dedicated VPS with 25GB+ free space.
• Set your API keys before your first real scan. Passive coverage without Shodan/WHOISXML/PDCP is noticeably weaker.
• Use -p (passive) mode first on new scopes to confirm rules of engagement before triggering active/DEEP modes.
• Use --dry-run before a big scan to preview exactly what will execute — this catches config mistakes before they waste hours.
• Common mistake: ignoring --incremental and re-running full scans repeatedly on the same target — wastes time and API quota when you only need the delta.
• Triage nuclei findings manually. Default severity settings include info/low noise; don't report raw nuclei output without validation.

Legal / Ethical Use Note

Use reconFTW only on systems you own or have explicit written authorization to test. Running active scans (-a mode, vulnerability checks, fuzzing) against out-of-scope or unauthorized targets is illegal in most jurisdictions and violates virtually every bug bounty program's terms. Always confirm scope and rules of engagement before enabling active modules.

Related Cybersecurity Topics You Should Explore

• TP-Link Router Flaw Lets Hackers Skip Login Entirely — Here's What's at Risk
  
• This subfinder Fork Cuts Recon Time in Half — subfaster Review
  
• 737 Fake VPN Extensions Are Spying on Chrome Users Right Now
  
• GhostDesk Spyware Alert: Fake CCleaner Steals Passwords & Crypto
  
• Zoomsday Flaw: Hackers Hijack Zoom Users With Zero Clicks
  
• SonicWall SMA1000 Flaws Now Fuel Ransomware Attacks – CISA Warns
  
• HP ThinPro's 'Encrypted' Drives Aren't Actually Safe — Here's Why
  
• GRR Rapid Response: The Free Google Tool That Hacks 100K PCs Remotely
  
• One Failed Login, Full Server Takeover: WordPress XSS2Shell
  
• I Traced a Webshell Using Just 6 Linux Commands — Here's How

FAQ

Is reconFTW free?
Yes, it's fully open-source under the MIT license with no paid tiers.

Is reconFTW legal to use?
Yes, using it is legal — but only against targets you're authorized to test. Running it against unauthorized systems is illegal.

Do I need API keys to use it?
No, it runs without them, but passive enumeration coverage is significantly better with Shodan, WHOISXML, and ProjectDiscovery Cloud keys configured.

Is reconFTW beginner-friendly?
The install and basic -r mode are approachable; mastering the full config file and Ax distributed scanning takes more time.

What's the difference between reconFTW and Osmedeus?
reconFTW is a heavily configurable Bash framework with deep default vulnerability coverage; Osmedeus is a Go-based tool using YAML-defined workflows and its own cloud provisioning.

Can reconFTW run on a normal laptop?
Basic scans, yes. DEEP mode and large scopes should run on a VPS due to disk and CPU demands.

Does reconFTW support distributed/cloud scanning?
Yes, via native integration with the Ax Framework (formerly Axiom).

How often is reconFTW updated?
Actively maintained, with the latest stable release (v4.1) shipped in March 2026 and frequent commits.

Verdict / Final Rating

Criteria	Score (/5)
Ease of Use	4.0
Accuracy / Detection / Analysis Depth	4.5
Documentation	4.5
Community Support	4.5
Value for Money	5.0

Overall Rating: 4.5/5

reconFTW earns its place as one of the most complete free recon frameworks available right now — it won't replace manual testing skill, but it will consistently surface the assets and low-hanging findings that manual, tool-by-tool recon misses. If you're serious about bug bounty or external pentest recon and have a VPS to spare, this belongs in your toolkit.