thewhiteh4t/FinalRecon

What it is

FinalRecon (v1.1.6, by Lohitya Pushkar / thewhiteh4t) — the summary covers the module list, so this note carries the operational specifics that decide whether it fits your workflow: API-key integrations, platform constraints, install paths, and the newer detection-quality features.

How it works

Several modules pull from third-party services and take optional API keys — absent keys mean the module is skipped, not that it fails. Nine keys are supported: bevigil, chaos, github, hunter, leakix, netlas, shodan, virustotal, zoomeye. Keys are read from env vars (FR_SHODAN_KEY, etc.) or from ~/.config/finalrecon/keys.json. Config lives at ~/.config/finalrecon/config.json.

Beyond the raw module list, the page describes quality features worth noting: directory enum uses phantom URL probing and real-time soft-404 filtering (based on content length and redirect clustering) to cut false positives; Wayback fetches up to 50,000 URLs and triages them into JS files, API endpoints, juicy parameters, and sensitive extensions; DNS queries 40+ record types and highlights security records including DMARC; header analysis flags missing security headers and breaks down cookie attributes (Secure, HttpOnly, SameSite).

Preconditions / Affected

Linux only. The page states explicitly: "designed for Linux based Operating Systems, other platforms like Windows and Termux are NOT supported." Port scan covers top 1000 ports only. Export format is txt. Docker usage requires root.

What to do

Add API keys either via env var or the -k flag (saved to config automatically):

export FR_SHODAN_KEY="kl32lcdqwcdfv"

python3 finalrecon.py -k 'shodan@kl32lcdqwcdfv'

Install via distro package, git, or Docker:

sudo apt install finalrecon
sudo pacman -S finalrecon

git clone https://github.com/thewhiteh4t/FinalRecon.git
cd FinalRecon
pip3 install -r requirements.txt

docker pull thewhiteh4t/finalrecon

Run per-module or full scan:

python3 finalrecon.py --dir --url https://example.com -e txt,php -w /path/to/wordlist
python3 finalrecon.py --full --url https://example.com

Useful flags: -dt/-pt (thread counts), -T (timeout), -d (custom DNS), -r (allow redirect), -cd (export dir).

Caveats

Key-dependent modules silently skip when no key is set — a "clean" subdomain/OSINT result may just mean the source wasn't queried. Port scan is limited to the top 1000 ports, so it is not a substitute for a full port sweep.