recon-shinobi

A simple reconnaissance CLI tool for discovering subdomains, open ports, and DNS records of a target domain.
Built with Node.js & TypeScript.

🚀 Features

• Subdomain enumeration from certificate transparency logs.
• Open port scanning (popular ports or full range).
• DNS records lookup (A, AAAA, CNAME, MX, NS, TXT, PTR).
• Optional verbose debugging.
• JSON output with table display in CLI.

📦 Installation

npm install -g recon-shinobi

Or run without installing:

npx recon-shinobi <domain>

💻 Usage

recon-shinobi <domain> [--verbose] [--full] [--timeout=<ms>]

Arguments

| Flag | Description | | ---------------- | -------------------------------------------------- | | <domain> | Target domain to scan. | | --verbose | Enable debug logs and show detailed progress. | | --full | Scan all 65,535 ports instead of only common ones. | | --timeout=<ms> | Timeout per port check (default: 2000ms). |

📊 Example Output

Command:

npx recon-shinobi google.com --verbose

Output:

Subdomains

| Subdomain | | ------------------------------------- | | accounts.google.com | | adwords.google.com | | answers.google.com | | apps-secure-data-connector.google.com | | audioads.google.com | | ... |

Open Ports

| Port | Description | | ---- | ------------------------------------------------ | | 80 | Hypertext Transfer Protocol (HTTP) | | 443 | Hypertext Transfer Protocol over TLS/SSL (HTTPS) |

DNS Records

| Type | Value | | ------- | -------------------------------------------------------------------------------------------------- | | A | ["142.250.4.113","142.250.4.139","142.250.4.101","142.250.4.102","142.250.4.100","142.250.4.138"] | | AAAA | [] | | CNAME | ["forcesafesearch.google.com"] | | MX | [] | | NS | [] | | TXT | [] | | reverse | [{"ip":"142.250.4.113","ptr":["sm-in-f113.1e100.net"]}, ...] |

📌 Example with Debug Logs

npx recon-shinobi example.com --verbose

[recon-shinobi] Starting recon for: example.com

[DEBUG] Fetching subdomains...
[DEBUG] Scanning common ports...
[DEBUG] Fetching DNS records...
[DEBUG] Recon completed!

📜 License

MIT License

---

If you want, I can also make a **"Sample Output"** section with syntax-highlighted code blocks for JSON results so people can easily copy and parse it for automation.  
Do you want me to add that?