pi-recon

Red-team recon & asset discovery plugin for Pi Coding Agent — 14 pure Node.js tools, zero external dependencies.

中文文档

Tools (14)

| Tool | Description | Phase | |------|-------------|-------| | icp_lookup | ICP备案 + Tianyancha + Baidu → domains | Target Resolution | | subdomain_enum | Subdomain enumeration (DNS brute + cert transparency / crt.sh) | Domain Discovery | | dns_enum | DNS record enumeration (A / AAAA / CNAME / MX / NS / TXT / SOA) | Domain Discovery | | whois_lookup | WHOIS lookup | Domain Discovery | | cert_search | SSL certificate transparency search (crt.sh) | Domain Discovery | | asn_lookup | ASN / IP range lookup | Domain Discovery | | asset_search | Shodan + FOFA + Hunter + Quake asset search | Asset Mapping | | port_scan | Web port scan (pure net.connect) | Service Discovery | | web_probe | HTTP/HTTPS service probe + fingerprinting (10,000+ rules) | Service Discovery | | dir_brute | Directory brute force | Deep Probing | | backup_finder | Backup file discovery (.bak / .zip / .git / .svn / .env) | Deep Probing | | bypass_403 | 403 bypass (path normalization attacks) | Deep Probing | | vuln_check | Vuln checks — shortname / log4shell / viewstate / sharepoint / apidocs / aclbypass | Vuln Checks | | js_analyzer | JavaScript static analysis (endpoints / secrets / hidden paths) | Analysis |

Install

# npm (recommended)
pi install npm:pi-recon

# Git
pi install git:github.com/Xaaaa-bip/pi-recon

# Local
pi install ./pi-recon

# Temp run
pi --extensions ./pi-recon

Config

Create ~/.pi/recon-config.json:

{
  "shodanKey": "your-shodan-key",
  "fofaEmail": "your-fofa-email",
  "fofaKey": "your-fofa-key",
  "hunterKey": "your-hunter-key",
  "quakeKey": "your-quake-key",
  "otxKey": "your-otx-key",
  "tianyanchaToken": "your-tianyancha-token",
  "callbackServer": "dns://xxx.callback.red"
}

Or via env vars: SHODAN_KEY FOFA_EMAIL FOFA_KEY HUNTER_KEY QUAKE_KEY OTX_KEY TIANYANCHA_TOKEN CALLBACK_SERVER

Usage

/recon <company|domain|IP>

Activates the FastTortoise pipeline:

1. Company → icp_lookup (parallel)
2. All domains → subdomain_enum + asset_search (parallel)
3. Discovered IPs → asset_search(host) (parallel)
4. Live hosts → port_scan + web_probe
5. All web servers → vuln_check (parallel)
6. High-value targets → dir_brute + backup_finder + js_analyzer

Tech Stack

• Pure Node.js, zero npm dependencies
• 10,000+ fingerprint rules (finger-data.json)
• Chrome 131 User-Agent
• Auto wildcard DNS detection
• Aggressive concurrency defaults for red-team speed

Links

• npm: https://www.npmjs.com/package/pi-recon
• GitHub: https://github.com/Xaaaa-bip/pi-recon
• pi.dev: https://pi.dev/packages (search pi-recon)