recon_trigger
Start a reconFTW scan against a target domain and write results to its native output layout for immediate querying. Configure mode, scope, and timeout to run subdomain enumeration, web probing, OSINT, or full active recon.
Instructions
Run a reconFTW scan against a domain.
Subprocess-wraps reconftw.sh (the same tool recon_bridge reads output from) — does not reimplement any recon logic. Writes to reconFTW's own Recon// layout, so recon_bridge's tools can query the results immediately after this completes.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | "subdomains" (fast, default — subdomain enum + web probing), "passive" (passive-only), "zen" (balanced, basics + some vulns), "web" (web checks against an existing subdomain list), "osint" (public intel only), "recon" (full recon incl. nuclei + fuzzing, slow), "all" (full recon + active exploitation — slow, use deliberately). | subdomains |
| domain | Yes | Target domain (e.g. "example.com"). | |
| dry_run | No | Use reconFTW's --dry-run — a real but fast (~seconds) lightweight run good for verifying wiring before committing to a real scan. | |
| timeout | No | Max seconds before the scan is killed. "recon"/ "all" modes can take a long time; raise this if you're running one of those. | |
| scope_exclude | No | Domains/patterns to exclude (out of scope) — passed as reconFTW's own -x scope file. | |
| scope_include | No | Domains/patterns to include — passed as reconFTW's own -i scope file. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||