🛡️ RECON2EXPLOIT: Next-Gen Automated Threat Intelligence & Security Framework

██████╗ ███████╗ ██████╗ ██████╗ ███╗   ██╗██████╗ ███████╗██╗  ██╗██████╗ ██╗      ██████╗ ██╗████████╗
██╔══██╗██╔════╝██╔════╝██╔═══██╗████╗  ██║╚════██╗██╔════╝╚██╗██╔╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝
██████╔╝█████╗  ██║     ██║   ██║██╔██╗ ██║ █████╔╝█████╗   ╚███╔╝ ██████╔╝██║     ██║   ██║██║   ██║   
██╔══██╗██╔══╝  ██║     ██║   ██║██║╚██╗██║██╔═══╝ ██╔══╝   ██╔██╗ ██╔═══╝ ██║     ██║   ██║██║   ██║   
██║  ██║███████╗╚██████╗╚██████╔╝██║ ╚████║███████╗███████╗██╔╝ ██╗██║     ███████╗╚██████╔╝██║   ██║   
╚═╝  ╚═╝╚══════╝ ╚═════╝ ╚═════╝ ╚═╝  ╚═══╝╚══════╝╚══════╝╚═╝  ╚═╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝   

Automated Passive Reconnaissance • Live CIRCL CVE Database Fusion • Executive PDF & Interactive HTML Reports

---

📖 Table of Contents

• Executive Overview
• Key Features Matrix
• System Architecture
• Installation & Setup
• Usage & Execution
• Output Telemetry & Reports
• Executive PDF & Interactive HTML Dashboard
• Remediation Framework
• Legal Disclaimer & Ethics
• License

---

🎯 Executive Overview

RECON2EXPLOIT is an enterprise-grade, cross-platform threat intelligence and security audit framework. Engineered for CISOs, SOC analysts, and security researchers, it aggregates passive intelligence from DNS records, WHOIS domain data, SSL/TLS certificates, multi-threaded port scans, HTTP security headers, and brand spoofing heuristics.

The framework correlates telemetry in real-time with official CIRCL CVE REST APIs to identify active vulnerability vectors, passing all data through a Multi-Factor Threat Risk Fusion Engine. Results are exported simultaneously as structured JSON telemetry, a Dark-Themed Executive PDF Report, and a Futuristic Interactive HTML Dashboard.

---

✨ Key Features Matrix

Module	Core Functionality	Primary Metrics / Outputs
🏷️ Real-Time CVE/CWE Intelligence	Live REST API integration (CIRCL CVE threat engine) querying active service banners and versions dynamically	Real-time CVE identifiers, CVSS v3 ratings, official vulnerability summaries, and remediation guides
⚡ Multi-Threaded Port Scanner	High-performance TCP socket scanner checking key service ports (80, 443, 22, 21, 25, 3389, 3306, etc.)	Open service ports, protocols, socket banners, exposure alerts
🔐 SSL/TLS Security Auditor	Cryptographic certificate inspection, issuer validation, and expiration countdown	Expiration status, days remaining, CA Issuer, TLS version, Subject Alternative Names (SANs)
🌐 DNS & Mail Security	Queries A, AAAA, MX, NS, TXT, and _dmarc SPF/DMARC records	Mail server configuration, IP resolution, email spoofing risk indicators
📜 WHOIS Intelligence	Registrar identification, ICANN EPP status parsing, abuse contacts, creation dates	Domain age (years/days), domain lifecycle phase, registrar details
🛡️ Web Security Audit	Web server header inspections (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy)	Missing security headers, clickjacking vulnerability vector, banner disclosures
🔗 Web Link & Form Scraper	DOM structure parsing harvesting endpoints, input forms, and password fields	External links, exposed login interfaces over unencrypted HTTP
🎯 Phishing Heuristics	Domain string analytics checking brand squatting, IP targets, shorteners, typosquatting	Phishing heuristic score, threat indicators, targeted brand detection
🧮 Threat Risk Fusion Engine	Mathematical risk aggregation combining domain freshness, header gaps, and phishing indicators	Composite threat score (0-10), SOC Severity Verdict (CRITICAL, HIGH, MEDIUM, LOW)
💻 Cross-Platform Engine	100% Pure Python implementation compliant with Windows, Linux (Kali/Ubuntu/Debian), and macOS	Universal path handling, platform-independent socket & HTTP concurrency
📊 Executive PDF Generator	ReportLab dark-themed document generator with two-pass dynamic page numbering (Page X of Y)	Dynamic scorecards, structured security tables, prioritized P1-P4 remediation checklist
🌐 Interactive HTML Dashboard	Single-file futuristic cyber security HTML report with live tabs, risk score gauges & print exports	Interactive dark dashboard matching executive SOC layout, filterable tables & export actions

---

🏗️ System Architecture

recon_2_exploit/
├── core/
│   ├── main.py              # Central orchestrator & ANSI banner execution engine
│   ├── vuln_db.py           # Real-time CIRCL CVE REST API query & CWE mapping engine
│   ├── report_html.py       # Interactive Cyber Dashboard HTML report generator
│   ├── md_to_pdf.py         # ReportLab executive PDF generator with NumberedCanvas
│   ├── dns_enum.py          # DNS record resolution & DMARC audit engine
│   ├── port_scan.py         # Multi-threaded TCP socket scanner with banner grabbing
│   ├── ssl_audit.py         # Cryptographic SSL/TLS certificate inspector
│   ├── whois_enum.py        # Domain WHOIS parser & age calculator
│   ├── web_enum.py          # HTTP header & web server security auditor
│   ├── parser.py            # BeautifulSoup DOM link & form interface parser
│   ├── phishing_runner.py   # Brand impersonation & URL heuristic analyzer
│   └── risk_fusion.py       # Multi-factor threat risk fusion scoring engine
├── reports/                 # Auto-generated per-domain target audit workspaces
│   └── <target_domain>/
│       ├── output/          # Telemetry JSON datastores (dns, ports, ssl, whois, etc.)
│       ├── *.pdf            # Standalone Executive PDF Report
│       └── *.html           # Standalone Interactive Cyber Dashboard HTML Report
├── requirements.txt         # Python dependency manifest
├── .gitignore               # Configured git exclusion rules
└── README.md                # Framework documentation

---

🛠️ Installation & Setup

Prerequisites

• Python 3.8+
• pip package manager

Quick Installation

1. Clone the Repository:

   git clone https://github.com/Bhuvaneshkumar1/Recon_2_Exploit.git
   cd Recon_2_Exploit

2. Set Up Virtual Environment (Recommended):

   python -m venv reconvenv
   # Windows PowerShell:
   .\reconvenv\Scripts\Activate.ps1
   # Linux/macOS:
   source reconvenv/bin/activate

3. Install Dependencies:

   pip install -r requirements.txt

---

🚀 Usage & Execution

Launch the interactive reconnaissance pipeline:

python -m core.main

Execution Flow:

1. Terminal ASCII Banner: Displays the colorized ANSI terminal header banner.
2. Target Selection: Input the target domain (e.g., example.com).
3. Auto Scheme Resolution: Resolves HTTPS/HTTP protocol access automatically.
4. Passive Recon & Audit: Executes DNS, WHOIS, Port Banner Scans, SSL Certificate Inspection, Web Header Matrix, and Phishing Analysis.
5. Real-Time Live CVE API Query: Connects to the CIRCL CVE REST API to fetch live vulnerability IDs, CVSS scores, and summaries for detected service banners.
6. Risk Fusion Computation: Merges telemetry into an overall SOC severity score.
7. Report Generation: Automatically outputs dashboard_report.html and prompts for generating full_report.pdf.

---

📊 Output Telemetry & Reports

All reconnaissance results are saved in reports/<domain>/:

• 🌐 dashboard_report.html - Interactive Cyber Dashboard HTML Report
• 📄 <report_name>_<timestamp>.pdf - Executive Dark PDF Security Audit Report
• 📁 output/vulnerabilities.json - Matched live CVE/CWE entries & CVSS ratings
• 📁 output/dns.json - Complete DNS & DMARC records
• 📁 output/ports.json - Open ports & service socket banners
• 📁 output/ssl_audit.json - Cryptographic certificate details & expiration status
• 📁 output/whois.json - WHOIS domain registration metadata
• 📁 output/web.json - Web server headers & security matrix
• 📁 output/links.json - Discovered web endpoints & sensitive form targets
• 📁 output/phishing.json - Heuristic threat analysis indicators
• 📁 output/risk_analysis.json - Aggregated threat scores & SOC verdict

---

📄 Executive PDF & Interactive HTML Dashboard

🌐 Interactive HTML Dashboard (dashboard_report.html)

• Cyber Aesthetic: Styled with Orbitron & Rajdhani Google Fonts, glassmorphism card containers, glowing risk score gauges, and dark cyan/emerald/red color palettes.
• Overall Risk Gauge: Circular risk score gauge (0.0 to 10.0) with CRITICAL, HIGH, MEDIUM, or LOW risk severity badges.
• Interactive Tabs: Allows seamless switching between:
  • Open Ports & Banners: Active service ports, protocols, and socket banners.
  • CVE & CWE Database: Real-time matched vulnerability IDs, CVSS scores, and remediation guides.
  • Web Security Headers Matrix: Audit table for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
  • DNS & Email Audit: Record queries (A, AAAA, MX, NS, TXT, _dmarc).
  • SSL/TLS Audit: Certificate issuer chain, validity countdown, status, and SANs.
• Browser Export: Includes a 🖨️ EXPORT DASHBOARD action for printing or exporting directly from any browser.

---

🛡️ Remediation Framework

RECON2EXPLOIT automatically prescribes remediations based on discovered vulnerabilities:

• P1 Critical: Enforce HTTP Security Headers (HSTS, CSP, X-Frame-Options), renew expiring SSL certificates immediately.
• P2 High: Configure strict DMARC policies (p=reject), restrict open administrative service ports (SSH, RDP, MySQL, Database).
• P3 Medium: Add missing anti-clickjacking X-Frame-Options headers, patch services matched in live CVE queries.
• P4 Low / Info: Suppress detailed server version banner disclosures (Server, X-Powered-By).

---

⚠️ Legal Disclaimer & Ethics

IMPORTANT: RECON2EXPLOIT is designed solely for legal security assessments, authorized penetration testing, and academic research. Unauthorized scanning of third-party domains without prior explicit consent is illegal. The developers assume no liability for misuse or damage caused by this software. Always operate within legal and ethical boundaries.

---

📜 License

Distributed under the MIT License. See LICENSE for more information.

Made with ❤️ for Security Researchers & Penetration Testers