Docs - Man Pages - ronin-recon-run

NAME

ronin-recon-run - Runs the recon engine with one or more initial values

ronin-recon run [options] {IP | IP-range | DOMAIN | HOST | WILDCARD | WEBSITE} …

Runs the recon engine with one or more initial values.

-D, --debug: Enables debugging output.
-C, --config-file FILE: Loads the ronin-recon configuration file. If not specified, then ~/.config/ronin-recon/config.yml will be loaded instead.
-w, --worker WORKER: Explicitly uses the specified worker instead of the default set of workers.
-e, --enable WORKER: Enables the worker in addition to the default set of workers.
-d, --disable WORKER: Disables the worker from the default set of workers.
--worker-file FILE: Loads a custom worker from the specified .rb file.
-p, --param WORKER.NAME=VALUE: Sets a param value for the given worker.
-c, --concurrency WORKER=NUM: Overrides the concurrency for the given worker.
--max-depth NUM: The maximum recon depth. Defaults to depth of 10 if the option is not specified.
-o, --output FILE: The output file to write results to.
-F, --output-format txt|list|csv|json|ndjson|dot|svg|png|pdf: The output format. If not specified, the output format will be inferred from the --output FILE extension.
--import: Imports each newly discovered value into the Ronin database.
-I, --ignore VALUE: The value to ignore from the result.
-h, --help: Print help information

Run the recon engine on a single domain:

$ ronin-recon run example.com

Run the recon engine on a single host-name:

$ ronin-recon run www.example.com

Run the recon engine on a single IP address:

$ ronin-recon run 1.1.1.1

Run the recon engine on an IP range:

$ ronin-recon run 1.1.1.1/24

Run the recon engine on multiple targets:

$ ronin-recon run example1.com example2.com secret.foo.example1.com \
                  secret.bar.example2.com 1.1.1.1/24

Run the recon engine and ignore specific hosts, IPs, URLs, etc.:

$ ronin-recon run --ignore staging.example.com example.com