MoeRecon - Enhanced Reconnaissance Scanner

MoeRecon is a comprehensive automated Bash wrapper for reconnaissance and vulnerability scanning. It orchestrates powerful tools (like ProjectDiscovery's suite, Amass, Nmap, etc.) to perform deep enumeration of a target domain, organizing the results into a structured directory.

🚀 Features

MoeRecon performs a sequential execution of the following stages:

1. Initial Domain Recon: Basic Whois, NS lookup, and IP resolution.
2. ASN Reconnaissance: Identifies ASN, Organization names, and IP ranges (using bgp.he.net, asnmap, metabigor).
3. Reverse Lookups: Performs Reverse MX, NS, and DNS lookups to expand the attack surface.
4. TLS/SSL Enumeration: Scans for CN/SAN in certificates across IP ranges (tlsx).
5. Reverse Whois: Discovers related domains via registrant organization.
6. Subdomain Discovery:
   • Passive sources (AlienVault, crt.sh, URLScan, etc.).
   • Active tools (subfinder, assetfinder).
   • Permutations (alterx).
7. Live Host Discovery: Validates active subdomains using httpx.
8. Vulnerability Scanning: Integrates nuclei for technology detection, DNS, and SSL checks.
9. Reporting: Generates a summarized text report and organizes all output files.

📋 Prerequisites / Dependencies

Since MoeRecon is a wrapper, you must have the following tools installed and available in your $PATH:

• Standard Tools: curl, dig, nslookup, whois, nmap, python3, jq.
• Go Tools (ProjectDiscovery & Others):
  • subfinder
  • httpx
  • nuclei
  • dnsx
  • tlsx
  • alterx
  • asnmap
• Other Tools:
  • amass
  • metabigor
  • assetfinder

Note: Some features (like Whoxy or specialized APIs) may require you to edit the script to add your own API keys.

📥 Installation

git clone https://github.com/m0erbye/moerecon.git cd moerecon chmod +x moerecon.sh

💻 Usage

Run the tool by specifying the target domain using the -d flag. Bash

./moerecon.sh -d example.com

Output Structure

The tool creates a directory named recon__ containing:

/subdomains - Discovery lists.

/ip_scan - IP resolution details.

/asn - ASN and network range information.

/httpx_results - Live web servers and tech stack.

/nuclei_results - Vulnerability scan results.

SUMMARY.txt - A quick overview of the findings.

⚠️ Disclaimer

This tool is for educational purposes and authorized security testing only. The author is not responsible for any misuse or damage caused by this program. Always obtain proper permission before scanning any target.