Practical documentation · Authorized use only

Recon-ng

Recon-ng organizes OSINT collection through modules and workspaces. In a professional setting, use it only for approved domains or organizations, minimize collected personal data, and document source provenance and retention decisions.

OSINTReconPython

Start safely and get useful results

Best for

• Authorized external-footprint research
• Repeatable OSINT workspace management

Not for

• Doxxing
• Unapproved personal profiling

Before you run anything

• Document the authorized target, time window, success criteria, data-handling rules, and a named stop contact before you begin.
• Confirm the installed version with the tool’s version or help command, then compare its documented behavior with the linked upstream project before relying on any option.

Practical workflows

Beginner

Create an approved workspace

Scenario: Track a company-owned domain review separately from other engagements.

recon-ng

Open the framework, then create a named workspace and record the approved scope in its notes.

Expected use: A workspace isolates data, modules, and reporting context.

Intermediate

Use only reviewed modules and sources

Scenario: Collect public domain data under a defined retention policy.

marketplace search domains

Review module descriptions before installing or running any source integration.

Expected use: Source results need manual corroboration; API quotas and privacy terms remain the operator’s responsibility.

Interpret results like an analyst

• OSINT results are leads with varying freshness and attribution, not confirmed ownership or compromise.
• Corroborate high-impact claims with primary records or the asset owner.

Common mistakes and operating tips

Avoid

• Enabling third-party APIs without reviewing their terms and data sharing.
• Retaining personal data longer than the engagement policy permits.

Operational discipline

• Treat command output as evidence, not a conclusion: retain the command, version, scope, timestamp, and a redacted result in the engagement record.
• Start with the smallest safe scope, validate expected behavior in a lab or pilot, then expand only when the authorization and monitoring plan support it.

Verify against the current upstream

Tool behavior and release syntax can change. Treat this guide as practical operating context, then verify version-specific details against the upstream project before an assessment.

Open authoritative upstream documentation