Skip to content

README_EN.md

Latest commit

 

History

History
107 lines (81 loc) · 3.48 KB

README_EN.md

File metadata and controls

107 lines (81 loc) · 3.48 KB
Raw

AppSec Recon Framework

tests Python License Mode

AppSec Recon Framework is a bounded command-line scanner for initial web service reconnaissance. It combines TCP connect scanning, HTTP(S) protocol probing on standard and non-standard ports, focused AppSec checks, path discovery and structured reporting.

Use it only against localhost, systems you own, or targets for which you have explicit authorization. Every non-loopback scan requires the --acknowledge-authorization flag.

AppSec Recon Framework localhost demo

Capabilities

  • non-root TCP connect scanning;
  • hostnames, IPs, target files and bounded CIDR expansion;
  • HTTP/HTTPS detection on every discovered port;
  • CSP, HSTS, clickjacking and nosniff review;
  • controlled untrusted-Origin CORS checks;
  • signature-confirmed exposed file and debug endpoint checks;
  • redacted secret-pattern detection in HTML and same-origin JavaScript;
  • baseline-aware path discovery;
  • JSON, Markdown and Nuclei target output;
  • a deterministic localhost demo target;
  • optional Subfinder and Telegram orchestration.

Install

git clone https://github.com/fant3k/AppSec-Recon-Framework.git
cd AppSec-Recon-Framework
python3 -m venv .venv
source .venv/bin/activate
python -m pip install --upgrade pip
pip install .
appsec-recon --version

The packaged CLI includes its default wordlist.

Local demo

scripts/demo_local.sh

The script starts an intentionally vulnerable service on 127.0.0.1:8088, scans it, writes JSON and Markdown reports, and stops the service. The expected result is one web service, seven findings and one discovered path.

Authorized external scan

appsec-recon example.com \
  --ports 80,443,7000,8080,9443 \
  --acknowledge-authorization \
  --json-out reports/example.json \
  --markdown-out reports/example.md \
  --nuclei-targets reports/example-urls.txt

Safety model

The scanner validates concurrency, timeouts, fuzzing limits and request delay; caps CIDR expansion and total target × port jobs; submits TCP work in bounded batches; caps HTTP responses; avoids cross-scope redirect following; identifies itself with a User-Agent; and requires explicit acknowledgement for any non-loopback target.

A sensitive-path finding requires both HTTP 200 and an expected content signature. Generic soft-200 responses are not reported as exposed files.

Tests

scripts/test.sh

The suite starts real localhost TCP and HTTP services and verifies target parsing, safety gates, bounded scanning, arbitrary-port HTTP probing, all demo findings, soft-200 filtering, response limits, secret redaction and every report format. CI installs the package and runs the suite on Python 3.9, 3.11 and 3.13.

Docker

docker compose up -d demo
docker compose --profile tools run --rm scanner
docker compose down

The demo port is published on 127.0.0.1 only.

Scope

This is a reconnaissance aid, not a replacement for Nmap, Nuclei, Burp Suite or a full DAST platform. Findings require manual validation within the agreed assessment scope.

See the Russian README, security policy and MIT license.