Web Recon
All-in-one web security scanner for pentesting, bug bounty, and security audits.
Scan any target with a single command and get a structured report with findings prioritized by severity. Modular — run the full suite or pick individual steps.
Why Use This
- - One command → full security assessment with prioritized findings
- 12 scan modules — DNS, ports, fingerprinting, subdomains, directories, secrets, vulnerabilities, headers, CORS, SSL, WordPress, Nuclei templates
- Security header scoring — instant letter-grade for any site's HTTP security posture
- Secrets detection — 459 rules covering AWS, GCP, GitHub, Slack, databases, and more
- Skips missing tools gracefully — works with whatever you have installed
- Resume mode — pick up where a crashed scan left off
- JSON + Markdown reports — machine-readable and human-readable output
Quick Start
CODEBLOCK0
Output: INLINECODE0
Options
| Flag | Description |
|---|
| INLINECODE1 | Light scan: recon, fingerprint, secrets, vulns, report |
| INLINECODE2 |
All steps (default) |
|
--json | Generate
results.json alongside markdown report |
|
--screenshot | Capture homepage screenshot |
|
--resume | Skip steps that already have output files |
Environment Variables
| Variable | Purpose |
|---|
| INLINECODE7 | Shodan API key for infrastructure intel (falls back to CLI) |
| INLINECODE8 |
Override output directory |
Scan Modules
| Step | What it does | Tools |
|---|
| INLINECODE9 | DNS records, IP geolocation, port scan, Shodan, Wayback URLs | nmap, dig, Shodan |
| INLINECODE10 |
HTTP headers, tech stack, WAF detection, CMS check | WhatWeb, wafw00f |
|
subdomains | Subdomain enumeration + live probing | Subfinder, Amass, httpx |
|
dirs | Directory and file bruteforce | Gobuster, ffuf |
|
secrets | Secrets scan + sensitive file checks (30+ paths) | Titus (459 rules) |
|
vulns | Security header scoring, CORS check, SSL analysis, vulnerability scan | Nikto, custom |
|
wpscan | WordPress-specific vulnerabilities (auto-skips if not WP) | WPScan |
|
nuclei | Template-based CVE scanning | Nuclei |
|
ssl | Full SSL/TLS analysis | testssl |
|
screenshot | Homepage capture | cutycapt/chromium |
|
report | Markdown + JSON report generation | — |
Security Header Scoring
Scores 10 security headers by severity:
| Severity | Points | Headers |
|---|
| Critical | 30 | Strict-Transport-Security, Content-Security-Policy |
| High |
20 | X-Frame-Options |
| Medium | 10 | X-Content-Type-Options, Referrer-Policy, Permissions-Policy |
| Low | 5 | X-XSS-Protection, COOP, CORP, COEP |
Rating: 🟢 ≥80% · 🟡 ≥50% · 🟠 ≥25% · 🔴 <25%
Output Structure
CODEBLOCK1
Review Priority
- 1. header-score.txt — overall security posture at a glance
- sensitive-files.txt — any "FOUND" = critical exposure
- cors.txt — misconfigured CORS = data theft risk
- titus.txt — exposed secrets/API keys
- ports.txt — unexpected open ports
- nuclei.txt — known CVEs
- subdomains-live.txt — forgotten/dev subdomains
Tool Requirements
See references/tools.md for install instructions. Scripts skip missing tools gracefully — you don't need everything installed to get useful results.
Wordlists
See references/wordlists.md. Auto-selects medium wordlists, falls back to smaller if unavailable.
Web Recon
用于渗透测试、漏洞赏金和安全审计的全能Web安全扫描器。
通过单个命令扫描任何目标，并生成按严重性排序的结构化报告。模块化设计——可运行完整套件或选择单个步骤。
为何使用
- - 一条命令 → 完整的优先级排序安全评估
- 12个扫描模块 — DNS、端口、指纹识别、子域名、目录、密钥、漏洞、安全头、CORS、SSL、WordPress、Nuclei模板
- 安全头评分 — 任何网站的HTTP安全态势即时字母等级评分
- 密钥检测 — 459条规则覆盖AWS、GCP、GitHub、Slack、数据库等
- 优雅跳过缺失工具 — 根据已安装工具正常工作
- 恢复模式 — 从中断的扫描处继续
- JSON + Markdown报告 — 机器可读和人类可读输出
快速开始
bash
快速扫描（侦察、指纹识别、密钥、头评分、报告）
scripts/webscan.sh example.com --quick
完整扫描（全部12个步骤）
scripts/webscan.sh example.com
带JSON输出和截图的完整扫描
scripts/webscan.sh example.com --json --screenshot
恢复中断的扫描（跳过已完成步骤）
scripts/webscan.sh example.com --resume
单步执行
scripts/webscan.sh example.com recon
scripts/webscan.sh example.com vulns
仅密钥扫描
scripts/titus-web.sh https://example.com
输出目录：~/.openclaw/workspace/recon//
选项
| 标志 | 描述 |
|---|
| --quick | 轻量扫描：侦察、指纹识别、密钥、漏洞、报告 |
| --full |
所有步骤（默认） |
| --json | 在markdown报告旁生成results.json |
| --screenshot | 捕获首页截图 |
| --resume | 跳过已有输出文件的步骤 |
环境变量
| 变量 | 用途 |
|---|
| SHODANAPIKEY | 用于基础设施情报的Shodan API密钥（回退到CLI） |
| OUTDIR |
覆盖输出目录 |
扫描模块
| 步骤 | 功能 | 工具 |
|---|
| recon | DNS记录、IP地理定位、端口扫描、Shodan、Wayback URL | nmap、dig、Shodan |
| fingerprint |
HTTP头、技术栈、WAF检测、CMS检查 | WhatWeb、wafw00f |
| subdomains | 子域名枚举+存活探测 | Subfinder、Amass、httpx |
| dirs | 目录和文件暴力破解 | Gobuster、ffuf |
| secrets | 密钥扫描+敏感文件检查（30+路径） | Titus（459条规则） |
| vulns | 安全头评分、CORS检查、SSL分析、漏洞扫描 | Nikto、自定义 |
| wpscan | WordPress特定漏洞（非WP自动跳过） | WPScan |
| nuclei | 基于模板的CVE扫描 | Nuclei |
| ssl | 完整SSL/TLS分析 | testssl |
| screenshot | 首页捕获 | cutycapt/chromium |
| report | Markdown+JSON报告生成 | — |
安全头评分
按严重性对10个安全头评分：
| 严重性 | 分值 | 安全头 |
|---|
| 严重 | 30 | Strict-Transport-Security、Content-Security-Policy |
| 高 |
20 | X-Frame-Options |
| 中 | 10 | X-Content-Type-Options、Referrer-Policy、Permissions-Policy |
| 低 | 5 | X-XSS-Protection、COOP、CORP、COEP |
评级：🟢 ≥80% · 🟡 ≥50% · 🟠 ≥25% · 🔴 <25%
输出结构
~/.openclaw/workspace/recon//
├── results.md # 带执行摘要的Markdown报告
├── results.json # 机器可读报告（--json）
├── screenshot.png # 首页截图（--screenshot）
├── dns.txt / geo.json # DNS记录、IP地理定位
├── ports.txt # nmap端口扫描结果
├── shodan.json # Shodan基础设施数据
├── header-score.txt # 安全头评分卡
├── cors.txt # CORS配置错误检查
├── whatweb.txt / waf.txt # 技术指纹、WAF检测
├── subdomains-live.txt # 发现的存活子域名
├── dirs.txt # 发现的目录/文件
├── sensitive-files.txt # 暴露的配置/备份文件
├── titus.txt # 泄露的密钥/API密钥
├── nikto.txt / nuclei.txt # 漏洞发现
├── ssl.txt # SSL/TLS分析
└── wpscan.txt # WordPress扫描（如适用）
审查优先级
- 1. header-score.txt — 整体安全态势一览
- sensitive-files.txt — 任何已发现=严重暴露
- cors.txt — CORS配置错误=数据窃取风险
- titus.txt — 暴露的密钥/API密钥
- ports.txt — 意外的开放端口
- nuclei.txt — 已知CVE
- subdomains-live.txt — 被遗忘/开发子域名
工具要求
安装说明请参见references/tools.md。脚本会优雅地跳过缺失工具——无需安装所有工具即可获得有用结果。
词库
请参见references/wordlists.md。自动选择中等词库，如不可用则回退到较小词库。
