GitHub - rix4uni/GarudRecon: GarudRecon automates domain recon with top open-source tools to discover assets, enumerate subdomains, and detect XSS, SQLi, LFI, RCE & more.

GarudRecon

GarudRecon is a comprehensive bash-based reconnaissance automation framework that streamlines the asset discovery and vulnerability assessment process for security professionals and bug bounty hunters. This tool orchestrates over 80+ open-source security tools to provide thorough reconnaissance capabilities across multiple attack vectors.

Subdomain enumeration using 20+ tools including subfinder, amass, and chaos
Certificate transparency monitoring through multiple CT log sources
DNS enumeration with advanced bruteforcing and permutation techniques
Port scanning with naabu, masscan, and nmap integration
Virtual host discovery and web technology fingerprinting

Vulnerability Detection

Cross-Site Scripting (XSS) detection with multiple payload sets
SQL injection testing through automated parameter fuzzing
Local File Inclusion (LFI) and Remote Code Execution (RCE) checks
Subdomain takeover vulnerability scanning
Open redirect detection and validation
Exposed .git directories and sensitive file discovery

Flexible Reconnaissance Modes

The framework provides three distinct operational modes tailored to different engagement scopes:

SmallScope Mode - Designed for focused subdomain reconnaissance (e.g., support.domain.com) with deep vulnerability analysis on a limited attack surface.
MediumScope Mode - Comprehensive wildcard domain scanning (e.g., *.domain.com) with balanced coverage and performance optimization.
LargeScope Mode - Organization-wide reconnaissance for maximum asset discovery and extensive vulnerability coverage.
CidrScope Mode - ⚠️ Coming Soon - CIDR-based reconnaissance for IP range scanning
Workflow Mode - Chain multiple tools into a reusable pipeline so you can run complex scans with a single command.
Fleet Mode - Distribute work across many VPS instances — split input automatically and run workflows in parallel on 100+ hosts.
CronJobs Mode - Schedule and monitor recurring recon tasks (subdomains, open ports, JS leaks, templates, alerts).

Advanced Features

Automated Monitoring

Continuous subdomain monitoring with change detection
Port state change notifications
JavaScript file monitoring for new endpoints
Automated scheduled reconnaissance via cron integration

Intelligent Resource Management

RAM-optimized configurations for different system specifications
VPS deployment optimization settings
Parallel processing with configurable thread limits
Custom wordlist generation based on target characteristics

History

I originally created GarudRecon in 2022, but I later removed it after some API keys were accidentally leaked. Despite this, someone forked the project and preserved it here.

Afterwards, I experimented with rewriting GarudRecon in Python and Go, but I found the heavy string concatenation in those languages unappealing. In the end, I decided to return to Bash, which felt simpler and more natural for me.

Prerequisites

Before installing GarudRecon, ensure you have:

Root access (switch to root user, not sudo su)
Bash shell (verify with echo $SHELL)
Internet connection for downloading tools and dependencies
Minimum 4GB RAM (8GB+ recommended for large scans)
Sufficient disk space (at least 10GB free for tools and output)

Referral Links

Click to view cloud provider referral links

Installation

Note: Switch to the root user first (instead of using sudo su) before running the installation command.
This helps avoid permission and environment-related issues.

If any tool fails to install during the script execution, install it manually.

Make sure your shell is set to bash.

Docker

Note: Docker support is coming soon. For now, please use the Git Clone or prebuilt binaries installation method.

Quick Install (No Clone Required)

# Install directly via curl (recommended for quick setup)
bash <(curl -s https://raw.githubusercontent.com/rix4uni/GarudRecon/main/setup)

Using Git Clone

git clone --depth 1 https://github.com/rix4uni/GarudRecon.git
cd GarudRecon
bash setup

Download prebuilt binaries

wget -q https://github.com/rix4uni/GarudRecon/archive/refs/tags/v0.1.2.zip
unzip v0.1.2.zip
cd GarudRecon
bash setup

Note: The setup script automatically downloads and installs pre-built binaries from GarudReconBinary nightly releases for faster installation.

Quick Start

After installation, you can immediately start using GarudRecon:

# Small scope scan (single subdomain)
garudrecon smallscope -d support.example.com

# Medium scope scan (wildcard domain)
garudrecon mediumscope -d example.com

# Large scope scan (organization-wide)
garudrecon largescope -d example

# Workflow mode
garudrecon workflow ls

# CronJobs mode
garudrecon cronjobs -d example.com -f MONITOR_SUBDOMAIN

For more detailed usage examples, see the Usage section below.

Configuration

GarudRecon uses configuration files located in configuration/ directory. The main configuration file is garudrecon.cfg.

Key Configuration Options

API Keys: Configure API keys for various services (subfinder, amass, chaos, etc.)
Thread Limits: Adjust parallel processing threads based on your system resources
Output Directories: Customize where scan results are stored
Tool Paths: Specify custom paths if tools are installed in non-standard locations

To use a custom configuration file:

garudrecon mediumscope -d example.com -c /path/to/custom.cfg

Usage

SmallScope Mode

Quick recon for a single host or subdomain (e.g. support.domain.com).
Lightweight, fast checks — ideal for a single target when you want quick visibility without a full-scale scan.

Usage:
  garudrecon smallscope [flags]

Flags:
  -d, --domain                          Scan a domain (e.g. support.domain.com)
  -ef, --exclude-functions              Exclude a function from running (e.g. WAYMORE)
  -rx, --recon-xss                      Run full recon with XSS checks
  -rs, --recon-sqli                     Run full recon with SQLi checks
  -rl, --recon-lfi                      Run full recon with LFI checks
  -rst, --recon-subtakeover             Run full recon with Subdomain Takeover checks
  -rr, --recon-rce                      Run full recon with RCE checks
  -ri, --recon-iis                      Run full recon with IIS checks
  -c, --config                          Custom configuration file path
  -r, --resume <scan_folder>            Resume stopped/uncompleted scan from /root/.garudrecon/scans/<scan_folder> (e.g., --resume support.domain.com or --resume support.domain.com_1). Skips functions already completed in resume.cfg.
  -h, --help                            help for smallscope

Example:
# Full recon
  garudrecon smallscope -d support.domain.com

# Recon with XSS only
  garudrecon smallscope -d support.domain.com -rx

# Recon with SQLi only
  garudrecon smallscope -d support.domain.com -rs

# Exclude functions manually
  garudrecon smallscope -d support.domain.com -ef "GOSPIDER,WAYMORE"

# Combined
  garudrecon smallscope -d support.domain.com -rx -ef "WAYMORE"

# Skips functions already completed in resume.cfg.
  garudrecon smallscope -d support.domain.com -rx --resume support.domain.com_1

Output

MediumScope Mode

Moderate recon for a wildcard domain (e.g. *.domain.com) with optional vuln checks.
Balanced scan depth: discovers subdomains, does basic service/port checks and optional lightweight vulnerability checks.

Usage:
  garudrecon mediumscope [flags]

Flags:
  -d, --domain                          Scan a domain (e.g. domain.com)
  -ef, --exclude-functions              Exclude a function from running (e.g. AMASS)
  -s, --recon-subdomain                 Run Subdomain Enumeration only
  -a, --active                          Run Active Subdomain Enumeration also (e.g. puredns, altdns)
  -su, --recon-subdomainurls            Run Subdomain Enumeration + Url Crawling only
  -rx, --recon-xss                      Run full recon with XSS checks
  -rs, --recon-sqli                     Run full recon with SQLi checks
  -rl, --recon-lfi                      Run full recon with LFI checks
  -rst, --recon-subtakeover             Run full recon with Subdomain Takeover checks
  -rr, --recon-rce                      Run full recon with RCE checks
  -ri, --recon-iis                      Run full recon with IIS checks
  -oos, --outofscope                    Exclude outofscope subdomains from a list (e.g. domain.com.oos)
  -c, --config                          Custom configuration file path
  -r, --resume <scan_folder>            Resume stopped/uncompleted scan from /root/.garudrecon/scans/<scan_folder> (e.g., --resume domain.com or --resume domain.com_1). Skips functions already completed in resume.cfg.
  -h, --help                            help for mediumscope

Example:
# Full recon with all vulnerability scan
  garudrecon mediumscope -d domain.com

# Recon Subdomain Enumeration only
  garudrecon mediumscope -d domain.com -s

# Run Active Subdomain Enumeration also (e.g. puredns, altdns)
  garudrecon mediumscope -d domain.com -s -a

# Recon Subdomain Enumeration + Url Crawling only
  garudrecon mediumscope -d domain.com -su

# Recon with XSS only
  garudrecon mediumscope -d domain.com -rx

# Recon with SQLi only
  garudrecon mediumscope -d domain.com -rs

# Exclude functions manually
  garudrecon mediumscope -d domain.com -ef "SUBFINDER,AMASS"

# Combined
  garudrecon mediumscope -d domain.com -rx -ef "AMASS"

# Skips functions already completed in resume.cfg.
  garudrecon mediumscope -d domain.com -rx --resume domain.com_1

Output

LargeScope Mode

Full-scale recon for an organization.
Deep discovery and enumeration (subdomains, ports, asset correlation, extensive vuln checks) for comprehensive coverage.

Usage:
  garudrecon largescope [flags]

Flags:
  -d, --domain                          Scan a domain (e.g. domain)
  -ef, --exclude-functions              Exclude a function from running (e.g. AMASS)
  -s, --recon-subdomain                 Run Subdomain Enumeration only
  -a, --active                          Run Active Subdomain Enumeration also (e.g. puredns, altdns)
  -su, --recon-subdomainurls            Run Subdomain Enumeration + Url Crawling only
  -rx, --recon-xss                      Run full recon with XSS checks
  -rs, --recon-sqli                     Run full recon with SQLi checks
  -rl, --recon-lfi                      Run full recon with LFI checks
  -rst, --recon-subtakeover             Run full recon with Subdomain Takeover checks
  -rr, --recon-rce                      Run full recon with RCE checks
  -ri, --recon-iis                      Run full recon with IIS checks
  -oos, --outofscope                    Exclude outofscope subdomains from a list (e.g. domain.oos)
  -c, --config                          Custom configuration file path
  -r, --resume <scan_folder>            Resume stopped/uncompleted scan from /root/.garudrecon/scans/<scan_folder> (e.g., --resume domain or --resume domain_1). Skips functions already completed in resume.cfg.
  -h, --help                            help for largescope

Example:
# Full recon with all vulnerability scan
  garudrecon largescope -d domain

# Recon Subdomain Enumeration only
  garudrecon largescope -d domain -s

# Run Active Subdomain Enumeration also (e.g. puredns, altdns)
  garudrecon largescope -d domain -s -a

# Recon Subdomain Enumeration + Url Crawling only
  garudrecon largescope -d domain -su

# Recon with XSS only
  garudrecon largescope -d domain -rx

# Recon with SQLi only
  garudrecon largescope -d domain -rs

# Exclude functions manually
  garudrecon largescope -d domain -ef "SUBFINDER,AMASS"

# Combined
  garudrecon largescope -d domain -rx -ef "AMASS"

# Skips functions already completed in resume.cfg.
  garudrecon largescope -d domain -rx --resume domain_1

Output

CidrScope Mode

⚠️ Coming Soon: CIDR-based reconnaissance mode for IP range scanning is currently under development.

This mode will allow you to:

Scan entire CIDR ranges for open ports and services
Discover assets within IP ranges
Perform vulnerability assessments on IP-based targets

Stay tuned for updates!

Output

Coming soon

Workflow Mode

Chain multiple tools into a reusable pipeline so you can run complex scans with a single command.
Compose small steps (mapcidr → httpx → nuclei …) into one workflow file and execute it without manually installing or running each tool.

Usage:
  garudrecon workflow [flags]

Flags:
  -i, --input       Pass the input
  -o, --output      Location where you want to save output
  -v, --verbose     enable verbose mode
  -h, --help        help for workflows

Example:
  garudrecon workflow amass --input <domain> --output <file> [--verbose]
  garudrecon workflow CVE-2025-0133 -i all.cidr -o CVE-2025-0133.nuclei
  garudrecon workflow ls
  garudrecon workflow ls [workflow]
  garudrecon workflow cat [workflow]
  garudrecon workflow add [workflow]
  garudrecon workflow edit [workflow]
  garudrecon workflow delete [workflow]

Validating Workflows

To check if all workflow JSON files are valid:

for f in workflow/*.json; do
  echo -n "Checking $f ... "
  jq empty "$f" && echo "✅ OK" || echo "❌ INVALID"
done

Output

Fleet Mode

Note: Progress bar and enhanced monitoring features are included. Use fleetsetup to automate worker configuration.

Setup

Create fleet.yaml configuration file:

# Create the configuration file
mkdir -p ~/.garudrecon
nano ~/.garudrecon/fleet.yaml

Add your credentials in YAML format:

worker:
  - root@192.168.1.10:PASSWORD1
  - root@192.168.1.11:PASSWORD2
  - root@192.168.1.12:PASSWORD3
master:
  - root@192.168.1.1:MASTER_PASSWORD

Note: To avoid single/double quotes problems with passwords, you can use the password encoder

Setup in master VPS:

Run this command directly on your master VPS (no need to clone the repo):

bash <(curl -s https://raw.githubusercontent.com/rix4uni/GarudRecon/main/setup)

Setup in workers (run this in master VPS):

After master setup is complete, run this command on the master VPS to automatically configure all workers. The fleetsetup script will:

Install GarudRecon on all worker VPS instances
Set up SSH keys for passwordless communication
Test connectivity between master and workers

bash <(curl -s https://raw.githubusercontent.com/rix4uni/GarudRecon/main/fleetsetup)

Note: Both setup and fleetsetup can be run directly via curl without cloning the repository.

Options:

--skip-install - Skip GarudRecon installation (only setup SSH keys)
--skip-keys - Skip SSH key setup (only install GarudRecon)
--test-only - Only test connectivity (skip installation and key setup)

Usage

Distribute work across many VPS instances — split input automatically and run workflows in parallel on 100+ hosts.
Use one command to shard data, push jobs to remote nodes, run the chosen workflow, and collect consolidated results. Perfect for massively-parallel scans.

Usage:
  garudrecon fleet [flags]

Flags:
  -i, --input       Pass the input
  -o, --output      Location where you want to save output
  -m, --module      workflow name you want to run
  -v, --verbose     enable verbose mode
  -h, --help        help for workflows

Example:
  garudrecon fleet -m <workflow> -i <wildcards> -o <file> [--verbose]
  garudrecon fleet -m httpx -i subs.txt -o subs.httpx --verbose
  garudrecon fleet -m subfinder -i wildcards.txt -o wildcards.subs

Testing

After setup, test with a simple scan:

# Create test input file
echo "example.com" > subs.txt
echo "test.example.com" >> subs.txt

# Run fleet test
garudrecon fleet -m httpx -i subs.txt -o subs.httpx --verbose

CronJobs Mode

Schedule and monitor recurring recon tasks (subdomains, open ports, JS leaks, templates, alerts).
Run continuous monitoring: periodic scans, delta detection, and notifications when new assets or issues appear.

Usage:
  garudrecon cronjobs [flags]

Flags:
  -d, --domain                  Domain to monitor
  -f, --function                Function to run (e.g. MONITOR_SUBDOMAIN)
  -c, --config                  Custom configuration file path
  -i, --interval                Customize the sleep duration (e.g. 1800)
  -v, --verbose                 enable verbose mode
  -h, --help                    help for cronjobs

Example:
  garudrecon cronjobs -d domain.com -f MONITOR_SUBDOMAIN
  garudrecon cronjobs -d domain.com -f MONITOR_PORTS
  garudrecon cronjobs -d domain.com -f MONITOR_ALIVESUBD
  garudrecon cronjobs -d domain.com -f MONITOR_JS
  garudrecon cronjobs -d domain.com -f MONITOR_JSLEAKS

Output

✅ Short commands

👉 Short commands automatically adds in ~/.bashrc during installation:
gs="garudrecon smallscope"
gm="garudrecon mediumscope"
gl="garudrecon largescope"
gcidr="garudrecon cidrscope"
gw="garudrecon workflow"
gf="garudrecon fleet"
gc="garudrecon cronjobs"

Demo

Note: Demo videos and screenshots coming soon. Check the Usage section for output examples.

For visual demonstrations, see the output screenshots in each mode's section above.

Troubleshooting

Common Issues

Issue: Permission denied errors

Solution: Make sure you're running as root user (not using sudo su). Switch to root with su - or sudo -i.

Issue: Tools not installing

Solution: Install failed tools manually. Check the installation logs for specific errors. Ensure you have internet connectivity and sufficient disk space.

Issue: Bash not found

Solution: Verify your shell is bash: echo $SHELL. If not, switch to bash: bash or chsh -s /bin/bash.

Issue: Scan stops or hangs

Solution: Check system resources (RAM, disk space). Use -ef flag to exclude problematic functions. Use --resume to continue interrupted scans.

Issue: API rate limits

Solution: Configure API keys in the configuration file to increase rate limits. Some tools have free tier limitations.

Getting Help

Check existing Issues
Create a new issue with:
- Error messages
- Command used
- System information
- Relevant logs

FAQ

Q: Do I need to install all tools manually?
A: No, the setup script automatically installs most tools. If any tool fails, you'll need to install it manually.

Q: Can I run scans without root access?
A: Some tools require root access for certain operations (like port scanning). It's recommended to run as root.

Q: How long do scans typically take?
A: Scan duration is highly variable and depends on many factors:

Target size: Number of subdomains, endpoints, and assets discovered
Enabled tools: Which functions are included/excluded (via -ef flag or DEFAULT_EXCLUDE_FUNCS in config)
Scan modes: NORMAL vs ADVANCED modes for various tools (configured in garudrecon.cfg)
TIMELIMITX settings: Time limits set for individual tools (e.g., WAYMORE_TIMELIMITX="1h")
RAM profile: System RAM determines which tools run (1g/2g profiles exclude many tools)
System resources: CPU, RAM, disk I/O, and network speed
API rate limits: Some tools are limited by API quotas

A small target with minimal tools might complete in minutes, while a large organization scan with all tools enabled could take days. Check your configuration file (garudrecon.cfg) to see which tools and modes are active.

Q: Can I pause and resume scans?
A: Yes! Use the --resume flag with the scan folder name to continue interrupted scans.

Q: How do I exclude specific tools from running?
A: Use the -ef flag: garudrecon mediumscope -d example.com -ef "AMASS,SUBFINDER"

Q: Where are scan results stored?
A: Results are stored in /root/.garudrecon/scans/<domain>/ by default.

Q: Can I customize which vulnerability checks run?
A: Yes, use flags like -rx for XSS, -rs for SQLi, -rl for LFI, etc. See the Usage section for details.

Contributing

Contributions are welcome! Here's how you can help:

Report Bugs: Open an issue with detailed information
Suggest Features: Share your ideas for improvements
Submit Pull Requests:
- Fork the repository
- Create a feature branch
- Make your changes
- Submit a pull request

Development Guidelines

Follow existing code style and conventions
Test your changes thoroughly
Update documentation as needed
Ensure backward compatibility when possible

For more details, see CONTRIBUTING.md (if available) or open an issue to discuss your contribution.

Operating Systems Supported

OS	Supported	Easy Install	Tested
Ubuntu	✅	✅	Ubuntu 24.04
Kali	✅	✅	Kali 2025.2
Debian	✅	✅	❌
Windows	✅	✅	WSL Ubuntu
MacOS	✅	✅	❌
Arch Linux	✅	❌	❌

Tools

Subdomain Enumeration

Certificate Transparency

Subdomain Permutations

Subdomain Resolving

Subdomain DNS Enumeration

dnsx

Port Scanning

Favicon Lookup

Screenshotting

Directory Enumeration

Email Enumeration

emailfinder

Url Crawling

Google Dorking

gorker

JS Crawling

Hidden Parameter

Program Based Wordlist Generator

unfurl

Subdomain Takeover

subzy
nuclei

MX Takeover

mx-takeover

DNS takeover

dnstake

Zone Transfer

dig (built-in system tool)

Vulnerability Scanning

Thanks 🙏

Thanks for creating awesome tools

projectdiscovery

tomnomnom

rix4uni

hakluke

jaeles-project

lc

gau
subjs

Thanks for #bugbountytips 🙏

Changelog

See CHANGELOG.md for detailed version history and updates.

Note: Changelog file coming soon. Check releases for version updates.

Mindmap

See Mindmap in different format mindmap

Name		Name	Last commit message	Last commit date
Latest commit History 212 Commits
.config		.config
.github		.github
cmd		cmd
configuration		configuration
images		images
mindmap		mindmap
workflow		workflow
.gitattributes		.gitattributes
HELPERS.md		HELPERS.md
LICENSE		LICENSE
README.md		README.md
TODO.md		TODO.md
fleetsetup		fleetsetup
garudrecon		garudrecon
setup		setup

Uh oh!

License

rix4uni/GarudRecon

Folders and files

Latest commit

History

Repository files navigation

GarudRecon

Table of Contents

Core Capabilities

Flexible Reconnaissance Modes

Advanced Features

History

Prerequisites

Referral Links

Installation

Docker

Quick Install (No Clone Required)

Using Git Clone

Download prebuilt binaries

Quick Start

Configuration

Key Configuration Options

Usage

Output

Output

Output

Output

Validating Workflows

Output

Setup

Usage

Testing

Output

Demo

Troubleshooting

Common Issues

Getting Help

FAQ

Contributing

Development Guidelines

Operating Systems Supported

Tools

Subdomain Enumeration

Certificate Transparency

Subdomain Permutations

Subdomain Resolving

Subdomain DNS Enumeration

Port Scanning

Subdomain Probing

Subdomain Bruteforcing

VHOST Discovery

Favicon Lookup

Screenshotting

Directory Enumeration

Email Enumeration

Url Crawling

Google Dorking

JS Crawling

Hidden Parameter

Program Based Wordlist Generator

Subdomain Takeover

MX Takeover

DNS takeover

Zone Transfer

Vulnerability Scanning

Thanks 🙏

Thanks for #bugbountytips 🙏

Changelog

Mindmap

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases 9

Sponsor this project

Packages