# FinalRecon | All-in-One Web Recon Toolkit To Scan Websites For Penetration Testing

**URL:** <https://onehack.st/t/finalrecon-all-in-one-web-recon-toolkit-to-scan-websites-for-penetration-testing/89930>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking\
**Created:** [June 4, 2020, 2:19pm UTC](https://onehack.st/t/finalrecon-all-in-one-web-recon-toolkit-to-scan-websites-for-penetration-testing/89930 "2020-06-04T14:19:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\
**Post date:** [June 4, 2020, 2:19pm UTC](https://onehack.st/t/finalrecon-all-in-one-web-recon-toolkit-to-scan-websites-for-penetration-testing/89930/1 "2020-06-04T14:19:19Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/4/2/4293ee7af03d5676ff56db4c2fe7a3418916a4ae.jpeg)

FinalRecon is a web recon toolkit to scan websites for penetration testing. It is made by [TheWhiteh4t](https://github.com/thewhiteh4t). This Python3 toolkit is simple and fast. **[FinalRecon](https://github.com/thewhiteh4t/finalrecon)** is a well maintained tool and they update and add new features regularly.

The key features of this tool is following:

- **Header Information**

- **Whois**

- **SSL Certificate Information**

- **Crawler**

- **DNS Enumeration**

- **Subdomain Enumeration**

- **Traceroute**

- **Directory Searching**

- **Port Scan**

- **Export Results**

Lets start our installation process in Kali Linux machine. First we need to open terminal in our Kali Linux and type following command to clone it from it’s GitHub repository:

```auto
git clone https://github.com/thewhiteh4t/finalrecon

```

The screenshot of the command is following:

 ![image](https://onehack.st/uploads/default/original/3X/8/9/890f332a5d0f212cf566c1a078969c835bc19b7f.png)

After cloning process is done we need to go in the finalrecon directory by using cd command:

cd finalrecon

Then we install the required packages to use this tool by using following command:

sudo pip3 install -r requirements.txt

```auto

```

The screenshot of this command is following:

 ![image](https://onehack.st/uploads/default/original/3X/8/e/8e6f6a581292df48fd2593812f67aa8047d47919.png)

After installing the required packages we are ready to run this tool on a targeted website.

Lets run FinalRecon to check its help options by applying following command:

```auto
sudo python3 finalrecon.py -h

```

Then its help screen will comes in front of us as shown in following screenshot:

 ![image](https://onehack.st/uploads/default/original/3X/c/3/c38ef51bd7ad4440575215f3b07c0d53b705113c.png)

Now we run FinalRecon and do a full scan on google for an example by using following command:

```auto
sudo python3 finalrecon.py --full https://google.com

```

Then it starts the scanning process and try to find information on targeted website as shown in following screenshot:

 ![image](https://onehack.st/uploads/default/original/3X/7/5/751d1c883a5e521e771ad15804b43633a3b88a11.png)

We also can save our scan results by using the -o flag. For an example we save this in txt format, but we can use xml and csv format also.

sudo python3 finalrecon.py --full [https://google.com](https://google.com) -o txt

This toolkit can scan for sensitive files in web directories which may contain more information about the target.

There are lots of this types of toolkit or frameworks like this but FinalRecon really has a good speed with perfection.

#### **Extras :**

1. Some Modules Use API Keys to fetch data from different resources, these are optional, if we are not using an API key, they will be simply skipped. If we are interested in using these resources we can store your API key in the _ **keys.json** _ file.
2. If we don’t want to use a API key for a certain data source we just set its value to null, by default values of all available data sources are null.
3. **FinalRecon** is a tool for Pentesters and it’s designed for **Linux** based Operating Systems, other platforms like **Windows** and **Termux** are NOT supported.

## GitHub:

> **[GitHub - thewhiteh4t/FinalRecon: All In One Web Recon](https://github.com/thewhiteh4t/finalrecon)**
>
> All In One Web Recon