InfraRecon

Professional-grade Domain & Infrastructure OSINT CLI tool for passive reconnaissance and infrastructure mapping.

Features

• DNS Enumeration: A, AAAA, MX, TXT, NS, CNAME records
• IP Resolution: Multiple resolution attempts with deduplication
• ASN Lookup: Autonomous System Number and hosting provider identification
• CDN Detection: Confidence-based CDN detection with provider identification
• Subdomain Discovery: Active DNS brute-force and passive CT log queries
• Certificate Transparency: Query public CT logs for historical DNS data
• Risk Assessment: Automated correlation and security scoring
• Multiple Output Formats: Terminal (colored), JSON, SARIF

Installation

Global Installation (Recommended)

npm install -g infrarecon

Local Development

git clone https://github.com/yourusername/infrarecon.git
cd infrarecon
npm install
npm run build

Usage

After Global Installation

infrarecon analyze <domain> [options]

Local Development

npm run scan <domain>

Examples

# Basic analysis
infrarecon analyze example.com

# JSON output
infrarecon analyze example.com --json

# SARIF output
infrarecon analyze example.com --sarif

# With subdomain enumeration
infrarecon analyze example.com --subs

# Custom timeout
infrarecon analyze example.com --timeout 10000

# Save to file
infrarecon analyze example.com --json > report.json

Options

| Option | Description | Default | | ---------------- | ------------------------------- | ------- | | --json | Output in JSON format | false | | --sarif | Output in SARIF format | false | | --subs | Enable subdomain enumeration | false | | --timeout <ms> | Request timeout in milliseconds | 5000 |

Output Formats

Terminal Output

Colored, human-readable output with sections for:

• DNS Records
• IP Addresses
• ASN Information
• CDN Detection
• Subdomains (if enabled)
• Certificate Transparency
• Risk Assessment

JSON Output

Machine-readable JSON structure suitable for automation and CI/CD pipelines.

SARIF Output

Static Analysis Results Interchange Format for security tooling integration.

Example Output

════════════════════════════════════════════════════════════════════════════════
  OSINT Analysis Report: example.com
════════════════════════════════════════════════════════════════════════════════

📋 DNS Records
────────────────────────────────────────────────────────────────────────────────
  A Records: 93.184.216.34
  AAAA Records: 2606:2800:220:1:248:1893:25c8:1946
  NS Records: a.iana-servers.net, b.iana-servers.net

🌐 IP Addresses
────────────────────────────────────────────────────────────────────────────────
  93.184.216.34 (IPv4)
  2606:2800:220:1:248:1893:25c8:1946 (IPv6)

🏢 ASN Information
────────────────────────────────────────────────────────────────────────────────
  AS15133: Edgecast Inc.
    Country: US | Network: 93.184.216.0/24

🛡️  CDN Detection
────────────────────────────────────────────────────────────────────────────────
  ✓ CDN Detected (70% confidence)
  Provider: EDGECAST

⚠️  Risk Assessment
────────────────────────────────────────────────────────────────────────────────
  Origin Exposure: LOW
  Infrastructure Stability: MODERATE
  CDN Confidence: 70%

Technical Details

DNS Resolution

Uses Node.js built-in dns.promises module for reliable DNS queries with proper error handling.

ASN Lookup

Queries public ASN lookup APIs with fallback mechanisms and per-execution caching.

CDN Detection

Multi-factor detection based on:

• ASN organization matching
• HTTP header analysis
• Geographic IP distribution

Subdomain Enumeration

• Active: DNS brute-force using curated wordlist
• Passive: Certificate Transparency log queries
• Validation and deduplication of all discovered subdomains

Risk Scoring

Automated correlation engine that analyzes:

• Origin exposure risk (LOW/MEDIUM/HIGH)
• Infrastructure stability (STABLE/MODERATE/UNSTABLE)
• CDN confidence percentage

Legal & Ethical Use

This tool performs passive reconnaissance only:

• ✅ DNS queries
• ✅ Public API lookups
• ✅ Certificate Transparency logs
• ❌ No port scanning
• ❌ No exploitation attempts
• ❌ No brute-force attacks

Always ensure you have proper authorization before analyzing any domain.

Publishing to npm

# Login to npm
npm login

# Publish package
npm publish

Dependencies

• commander: CLI framework
• axios: HTTP client
• chalk: Terminal styling
• typescript: Type safety
• Node.js built-in modules: dns, fs, path

License

MIT