Skip to content

Back to the catalog

Rekono
github.comrepo

Rekono

Rekono is an open-source pentesting automation platform that chains 19 hacking tools (Nmap, Nuclei, Metasploit, OWASP ZAP, Nikto, Gitleaks, SearchSploit, etc.) so that output from one tool feeds the next, automatically covering recon, service enumeration, vulnerability scanning, and exploit correlation. It deduplicates findings into a single attack-surface inventory per host/port, enriches CVEs with community context for prioritization, tracks fixed/reopened vulnerabilities, and supports team collaboration, scheduled scans, Telegram/email alerts, and report generation for engagements.

TL;DR Open-source platform that auto-chains 19 pentesting tools (Nmap, Nuclei, Metasploit, ZAP...) from recon to exploit correlation with deduped findings and reporting.
Open original ↗
Document

What it is

Rekono is a GPL-3.0 platform that chains 19 command-line security tools. Output from one tool becomes input for the next. Ports found by Nmap go to service-specific tools, detected technologies are checked for known vulnerabilities, and vulnerabilities are matched against public exploit databases. The page presents it as a platform rather than a script, with projects, team roles, notes, metrics and an API.

Tool coverage

  • OSINT: theHarvester, EmailHarvester
  • Host, port and service enumeration: Nmap
  • Directory enumeration: Dirsearch, Gobuster
  • SSL/TLS: Sslscan, SSLyze
  • Exposed secrets: GitLeaks
  • SSH: SSH Audit
  • SMB: SMBMap
  • Web: Log4j Scan, Spring4Shell Scan, CMSeeK, OWASP JoomScan, OWASP ZAP, Nikto
  • Vulnerability scanning: Nuclei
  • Exploits: SearchSploit, Metasploit

What to do

Start it with Docker Compose. The worker count is set at launch, so scan parallelism scales by changing the --scale value.

docker compose up -d --scale executions-worker=5

Then open https://127.0.0.1 and log in with rekono:rekono. The page says to change that password at first login.

Scan options include setting how aggressive each scan is, routing through your own proxy, and passing custom headers and credentials to the tools. A Telegram bot can launch scans and deliver findings, and everything is also exposed through the API.

Caveats

  • Upgrading from Rekono 1.x: the database migration runs automatically, but the page tells you to read the upgrade guide first because of changes you need to know about. It does not say what they are.
  • The project has one maintainer, who works in their free time with no external funding. This matters for response time on issues and for the pace of updates to the wrapped tools.
  • The page gives no benchmarks, false-positive rates or detail on how CVE enrichment sources are chosen. Its claims about deduplication, fixed/reopened tracking and prioritization are feature descriptions only.
  • The disclaimer limits use to authorized testing with explicit permission for every target, and the authors accept no liability for misuse.

Technologies named here

Related in Offensive Security