Reconkit — Authorized Bug Bounty Recon Toolkit

Introduction

Reconkit is a cross-platform toolkit for authorized bug bounty reconnaissance. It wires together modular scan stages, a hard scope gate, program-weighted findings, safe prove (canary-only validation), an attack-path graph, multi-provider LLM agents, and a local cyber dashboard.

It is not an exploit framework. Default posture is detection + safe validation — no sqlmap, reverse shells, credential stuffing, or data dumps.

Principle: recon finds · programs prioritize · prove confirms safely · graph explains · skills kill FPs · cloud or local LLM.

What you get

Six layers, one toolkit:

Entry points

cd path/to/Reconkit
pip install prompt_toolkit colorama
python reconkit.py --version
# → reconkit 3.0.0

python recon_shell.py

Project layout

Reconkit/
├── USAGE.md / OPERATIONS.md / WORKFLOW.md / AGENTS.md
├── reconkit.py           # pipeline + setup + scope + keys
├── recon_shell.py        # interactive cyber prompt
├── recon_dashboard.py    # web UI
├── recon_agents.py       # multi-agent LLM CLI
├── recon_prove.py        # safe validation CLI
├── prove/                # queue, validators, policy
├── agents/               # llm, skills, orchestrator, eval
├── skills/               # Agent skill packs (SKILL.md)
├── findings/ graph/ shell/ dashboard/ programs/
└── config/               # agent + exploit policy + program profiles

Local data (~/.reconkit)

Runtime data lives outside the repo so secrets and loot never get committed.

~/.reconkit/
├── config.json
├── scope.txt                 # authorized targets (hard gate)
├── secrets.env               # API keys (owner-only)
├── agent_config.json         # optional user-global LLM config
├── wordlists/
├── logs/debug.log
├── index/findings_index.json
├── history/<target>/
└── output/<target>/
    ├── subdomains.txt, alive.txt, urls.txt, …
    ├── agent_report.md, report_draft.md, critic_review.md
    └── proofs/

Mental model: files under output/ are source of truth. The findings index is a query cache for the UI — not a separate live database.

One-time setup

Prerequisites

• Python 3.10+ (3.11+ recommended)
• git
• go (ProjectDiscovery / tomnomnom tools)
• cargo optional (Rust tools)
• pip install prompt_toolkit colorama for shell UX

Install sequence

cd path/to/Reconkit

pip install prompt_toolkit colorama
python reconkit.py checkenv
python reconkit.py setup
# Apply PATH lines setup prints (Go bin, Cargo bin, user Scripts)
# Open a NEW terminal, cd back to the project

python reconkit.py verify
python reconkit.py wordlists

setup is idempotent — safe to re-run; skips what already exists.

Shell equivalents

/checkenv
/setup
/verify
/wordlists

Authorization (scope gate)

Nothing in run / /run / agents executes against a host that is not in scope.

python reconkit.py scope add example.com          # type yes to confirm authorization
python reconkit.py scope add "*.example.com"      # wildcard OK
python reconkit.py scope list
python reconkit.py scope check example.com

File: ~/.reconkit/scope.txt (one domain per line; # comments allowed).

/scope add example.com
/scope list
/scope check example.com

Only test assets you are explicitly authorized to assess (bug bounty program scope, signed pentest RoE, or your own lab).

API keys (optional)

Keys boost subdomain yield (subfinder -all, chaos, GitHub, Shodan, …). Stored only in ~/.reconkit/secrets.env — never in the repo.

python reconkit.py keys set PDCP_API_KEY <value>
python reconkit.py keys set GITHUB_TOKEN <value>
python reconkit.py keys set SHODAN_API_KEY <value>
python reconkit.py keys set CENSYS_API_ID <value>
python reconkit.py keys set SECURITYTRAILS_API_KEY <value>
python reconkit.py keys set VIRUSTOTAL_API_KEY <value>

python reconkit.py keys list      # values masked
python reconkit.py keys remove SHODAN_API_KEY

/keys list
/keys set PDCP_API_KEY <value>
/keys remove PDCP_API_KEY

LLM keys (Grok, Claude, OpenAI, …) use environment variables such as XAI_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY — see Agents & LLM.

Recon modules

python reconkit.py modules
# shell: /modules

Logical dependency order:

subdomains → dns / httpprobe → tls, crawl, content, nuclei, screenshots
crawl → js, params, xss, sqli, ssrf_ssti, cloud

Missing tools print [WARN] and skip that stage — they do not crash the whole run.

Running recon

CLI

# Full pipeline
python reconkit.py run --target example.com

# Selected modules (comma-separated, no spaces)
python reconkit.py run --target example.com --modules subdomains,dns,httpprobe,nuclei

# Verbosity flags BEFORE the subcommand
python reconkit.py -v 3 run --target example.com --modules subdomains
python reconkit.py --debug run --target example.com

Output: ~/.reconkit/output/example.com/

Shell shortcuts

/target example.com
/run example.com
/run example.com --modules subdomains,dns,httpprobe
/quick example.com          # subdomains + dns + httpprobe
/full example.com           # all modules
/scan                       # interactive module picker
/pause /resume /stop /jobs  # background job control

/run is background by default; use --fg to block until complete.

Verbosity

/verbose
/verbose 2
/verbose live

Interactive cyber shell

python recon_shell.py
python recon_shell.py --target example.com -v 2

Live autocomplete

Install prompt_toolkit for LIVE slash matching (type /co → /commands /config).

Every command supports:

/<command> -h
/<command> --help

Shell map (high level)

/setup /verify /wordlists
/scope add|list|check
/keys set|list|remove
/target /verbose /rate
/run /quick /full /scan /playbook
/pause /resume /stop /jobs
/findings reindex
/program list|show|set
/notable /diff /doctor /tips
/prove policy|techniques|queue|run|list|show
/graph summary|show
/report /critic
/config …  /check-llm  /agent …
/dashboard

Full catalog lives in the repo as OPERATIONS.md.

Findings index & program profiles

After scans, reindex so scoring / notable / prove queue stay current:

python reconkit.py findings reindex
# shell:
/findings reindex
/findings summary example.com
/notable
/diff example.com

Program profiles (bug bounty weights)

/program list
/program set example-web
/findings reindex
/notable

Profiles live in config/programs/*.json. Env override: RECON_PROGRAM=…. Weights affect /notable and prove queue priority after reindex.

Prove — safe validation

Prove re-checks scanner candidates with canaries / markers only. It does not run exploit frameworks.

Techniques

Policy (config/exploit_policy.json)

• Mode: safe_validation
• require_scope: true
• allow_sqli_boolean: false by default
• Set oast_base_url for interactsh/collaborator-style OAST SSRF
• Disallowed by design: sqlmap, shells, credential stuffing, mass scan, data exfil, destructive

Commands

python recon_prove.py policy
python recon_prove.py techniques
python recon_prove.py queue --target example.com
python recon_prove.py run --target example.com --dry-run
python recon_prove.py run --target example.com
python recon_prove.py run --target example.com --technique xss_reflect

/prove policy
/prove techniques
/prove queue example.com
/prove run example.com --dry-run
/prove run example.com --technique xss_reflect
/prove list example.com
/prove show <id>

Confirmed proof ≈ confidence C2 in the skill suite (see below).

Attack graph

/graph summary
/graph show example.com

curl -s "http://127.0.0.1:8787/api/graph?target=example.com&min_score=40"

The graph links findings + proofs into attack paths for the dashboard Graph tab (force layout, drag nodes).

Dashboard (Starfleet Bridge)

python recon_dashboard.py
python recon_dashboard.py --port 8787 --no-browser
# shell:
/dashboard
/dashboard --host 127.0.0.1    # localhost only (recommended on shared LANs)

Tabs

Selected API routes

Security note: default bind is often 0.0.0.0 for VM→host access. Any client that can reach the port can see recon data. Prefer --host 127.0.0.1 on shared networks. Do not expose this UI on the public internet.

Agents & LLM (local + cloud)

A planner picks specialists; specialists run recon modules; an analyst writes agent_report.md. The same client talks to local Ollama or cloud APIs.

Specialist map

If the LLM is down, heuristics still advance the pipeline.

Providers

python recon_agents.py providers

Configure & run

# Local Ollama (from a VM: use Windows host IP, not the Kali IP)
python recon_agents.py config set --provider ollama \
  --base-url http://192.168.1.4:11434 --model qwen3:8b

# Cloud — set the key in the environment first
# PowerShell: $env:XAI_API_KEY = "xai-..."
# bash:       export XAI_API_KEY=...
python recon_agents.py config set --provider xai --model grok-2-latest

python recon_agents.py check-llm
python recon_agents.py agents
python recon_agents.py run --target example.com --dry-run
python recon_agents.py run --target example.com --max-steps 8

/config set --provider xai --model grok-2-latest
/check-llm
/agents
/agent example.com --max-steps 8

Tip: keep API keys in the environment (or ~/.reconkit), not in tracked config/agent_config.json. Cloud walkthrough: config/CLOUD_LLM_SETUP.md in the repo.

Agent skill suite (C0–C4)

Skills inject methodology by role and surface. They reduce false positives and map scanner hits to safe prove techniques.

Core skills (always role-routed)

On-demand mini-skills (max 3 / turn)

Confidence path

C0 noise          → drop
C1 scanner hit    → /prove or manual
C2 canary confirmed → PoC draft
C3 impact (human) → triage-gate
C4 report-ready

python recon_agents.py agents    # suite by role + surface list
# RECON_AGENT_SKILL=reconkit-bug-bounty   # default
# RECON_AGENT_SKILL=off
# RECON_AGENT_SKILL_EXTRA=reconkit-efficiency

Worked example (XSS surface)

python recon_agents.py run --target example.com --modules xss --max-steps 4
python reconkit.py findings reindex
python recon_prove.py run --target example.com --technique xss_reflect
# confirmed proof ≈ C2; write impact manually for C3; /critic for triage-gate

Ordered hunt (phases A–O)

Replace example.com with a domain you are authorized to test.

Copy-paste skeleton (CLI)

cd path/to/Reconkit
pip install prompt_toolkit colorama

python reconkit.py checkenv
python reconkit.py setup
python reconkit.py verify
python reconkit.py wordlists

python reconkit.py scope add example.com
python reconkit.py run --target example.com --modules subdomains,dns,httpprobe,nuclei
python reconkit.py findings reindex

python recon_prove.py queue --target example.com
python recon_prove.py run --target example.com --dry-run
python recon_prove.py run --target example.com

python recon_dashboard.py --host 127.0.0.1

Shell skeleton

python recon_shell.py

/setup
/verify
/scope add example.com
/keys list
/quick example.com
/findings reindex
/program set example-web
/notable
/prove queue example.com
/prove run example.com --dry-run
/prove run example.com
/graph show example.com
/dashboard --host 127.0.0.1
/report example.com
/critic example.com

Report, critic & jobs

/report example.com      # draft markdown under output/
/critic example.com      # triage-gate style review
/jobs                    # background recon jobs
/pause /resume /stop

Outputs typically land under:

~/.reconkit/output/<target>/report_draft.md
~/.reconkit/output/<target>/critic_review.md
~/.reconkit/output/<target>/agent_report.md

Safety & ethics

Default path: C1 scanner → /prove (C2) → PoC draft → human impact (C3) → triage (C4).
No reverse shells, credential spray lists, or destructive modules in the default path.

Troubleshooting (quick)

Repository docs map

Links

• Source: github.com/thevillagehacker/Reconkit
• Author: thevillagehacker · LinkedIn · X

Use Reconkit only on systems you own or are explicitly authorized to test. Happy (authorized) hunting.