Recon-ng is a reconnaissance framework written in Python. It gathers open-source information about a target through modules, and its interface looks like Metasploit. The latest tagged release is 5.1.2, and it needs Python 3.6 or newer. Penetration testers and attackers both use tools like it, so defenders should know what it shows about their own domains.
Updated October 2026: this guide now follows Recon-ng 5. Version 5 changed several commands and moved all modules into a marketplace, so many older tutorials no longer work.
Reconnaissance is information gathering before an action. A penetration tester and an attacker both scout a target first. Use Recon-ng only against domains you own or have written permission to test.
What is Recon-ng and how do you install it?
Recon-ng is an OSINT (Open-Source Intelligence) framework. If you know Metasploit, the layout feels familiar. Kali Linux ships it in its package repositories. On other Linux systems you install it from source:
- Clone the project with git clone https://github.com/lanmaster53/recon-ng.git.
- Change into the recon-ng folder.
- Install the core dependencies with pip install -r REQUIREMENTS.
- Start the tool with ./recon-ng.
The project advises using a Python virtual environment, so the install does not touch system packages. The source and wiki are on Recon-ng on GitHub.
How do you use Recon-ng workspaces?
A workspace keeps the database, settings and reports of one engagement apart from the others. The first workspace is called default. To make your own, type workspaces create followed by a name. Type workspaces list to see all of them, and workspaces load followed by a name to switch.
Version 4 used workspaces add and workspaces select. Those commands no longer exist in version 5.
How do Recon-ng modules and API keys work?
Recon-ng 5 ships with no modules. You install them from the marketplace. Type marketplace search to browse the list and marketplace info followed by a module name to read its details. The search output marks modules that need a dependency or an API key. Type marketplace install followed by a module name to add one, or marketplace install all to add everything.
Some modules only work with a key from a third-party service. The Shodan host module is one example. Add a key with keys add followed by the key name and the value, for example keys add shodan_api and your key. Type keys list to check what is stored.
How do you run a Recon-ng module? An example
Say you want a list of hosts for your own domain without any API key. The HackerTarget module finds host names with the HackerTarget.com API. Follow these steps:
- Start the toolRun ./recon-ng from the install folder.
- Create a workspaceworkspaces create followed by a name.
- Install the modulemarketplace install hackertarget.
- Load the modulemodules load hackertarget.
- Check the optionsType info to read the description and options.
- Set the sourceoptions set SOURCE followed by your domain.
- LaunchType run and wait for the results.
- Read the resultsType show hosts to list what was found.
The old guide used the module recon/domains-hosts/google_site_api. It is no longer in the marketplace. The current Google module is google_site_web, which scrapes search results and can be blocked by Google.
Every other module works the same way. Modules read seed data from the database, such as domains, and write new records back. One module’s output becomes the next module’s input.
What can defenders learn from Recon-ng?
Run the same modules against your own domains and you see what an attacker sees first: host names, subdomains and exposed services. Doing this by hand once is useful. Doing it continuously is the job of external attack surface management, which watches for new hosts and forgotten assets all the time.
Sources: the Recon-ng Getting Started page and the Recon-ng Features page, read on 20 October 2026.
If you have a question about the blog post, you can contact us.
Ian Kings
For the bigger picture, read OSINT Framework 101. Searching with operators is covered in Google Dorking 101.