recon-ng从多个源头搜集主机和域名，但需要apikey。不大好用

[95] Recon modules
[8]  Reporting modules
[4]  Import modules
[3]  Disabled modules
[2]  Exploitation modules
[2]  Discovery modules

[recon-ng][default] > help

Commands (type [help|?] <topic>):
---------------------------------
back            Exits the current context
dashboard       Displays a summary of activity
db              Interfaces with the workspace's database
exit            Exits the framework
help            Displays this menu
index           Creates a module index (dev only)
keys            Manages third party resource credentials
marketplace     Interfaces with the module marketplace
modules         Interfaces with installed modules
options         Manages the current context options
pdb             Starts a Python Debugger session (dev only)
script          Records and executes command scripts
shell           Executes shell commands
show            Shows various framework items
snapshots       Manages workspace snapshots
spool           Spools output to a file
workspaces      Manages workspaces

 

options
Manages the current context options

Usage: options <list|set|unset> [...]

[recon-ng][default] > options list

  Name        Current Value    Required  Description
  ----------  -------------    --------  -----------
  NAMESERVER  114.114.114.114  yes       default nameserver for the resolver mixin
  PROXY                        no        proxy server (address:port)
  THREADS     10               yes       number of threads (where applicable)
  TIMEOUT     10               yes       socket timeout (seconds)
  USER-AGENT  Recon-ng/v5      yes       user-agent string
  VERBOSITY   2                yes       verbosity level (0 = minimal, 1 = verbose, 2 = debug)

 

keys add shodan_api  API    (添加API）

 

modules search bin
[*] Searching installed modules for 'bin'...

  Recon
  -----
    recon/companies-contacts/bing_linkedin_cache
    recon/domains-hosts/binaryedge
    recon/domains-hosts/bing_domain_api
    recon/domains-hosts/bing_domain_web
    recon/hosts-hosts/bing_ip
    recon/hosts-ports/binaryedge
    recon/profiles-contacts/bing_linkedin_contacts

modules load recon/domains-hosts/bing_domain_web

options set source thepaper.cn

从很多源头搜集domain，但需要api key