DEV Community

Cover image for httprecon3: The Ultimate Stealthy Recon Tool for Bug Bounty Hunters and Pentesters
l0n3ly
l0n3ly

Posted on

httprecon3: The Ultimate Stealthy Recon Tool for Bug Bounty Hunters and Pentesters

#recon #cybersecurity #http #https

Introducing httprecon3: The Ultimate Stealthy Recon Tool for Bug Bounty Hunters and Pentesters

By l0n3ly!

October 29, 2025

Cross-posted on DEV.to: https://dev.to/l0n3ly

In the fast-evolving world of cybersecurity, reconnaissance remains the cornerstone of any successful penetration test or bug bounty hunt. Tools like Subfinder, Amass, or even basic wget crawlers have their place, but what if you could combine deep web crawling, secret detection, subdomain enumeration, screenshot capture, and AI-powered insights—all in a single, stealthy Python script? Enter httprecon3, a fresh open-source powerhouse that's set to streamline your recon workflow like never before.

Launched today on GitHub by security researcher l0n3ly! (that's me—feel free to ping me on Discord at l0n3ly_natasha), httprecon3 is designed for the modern hunter: ethical, extensible, and evasion-ready. Whether you're mapping an attack surface for a bug bounty program or auditing your own infrastructure, this tool uncovers hidden gems (and potential landmines) with surgical precision. Let's dive in.

What Makes httprecon3 Stand Out?

Gone are the days of juggling multiple tools for recon. httprecon3 packs a punch with features tailored for real-world scenarios:

  • Deep Crawling with 50+ Link Extraction Methods

    Recursively spider sites up to a configurable depth (default: 3), pulling URLs from everything—HTML anchors, CSS url() declarations, JS fetch() calls, SVG embeds, Web App Manifests, even robots.txt sitemaps. It handles lazy-loaded images (data-src, srcset), videos, audio, iframes, and more. No more missing those sneaky API endpoints buried in minified JS.

  • 300+ API Key and Secret Patterns

    Built-in regex magic detects exposed credentials from heavyweights like AWS (AKIA[0-9A-Z]{16}), Firebase, Stripe (sk_live_[0-9a-zA-Z]{24}), GitHub tokens (ghp_[a-zA-Z0-9]{36}), Slack, Twilio, and over 100 others. It even flags JWTs, SSH keys, and crypto wallets. Pro tip: Run --extract-keys to surface these in your scans.

  • Subdomain Brute-Force with 250+ Wordlist

    Armed with a curated list covering core (e.g., www, api), DevOps (jenkins, k8s), monitoring (grafana, prometheus), and niche terms (hipaa, soc2), it uses multithreaded DNS resolution to validate hits. Load your own wordlist with --wordlist for custom fuzzing.

  • Stealth Mode for Evasion

    Random delays (configurable via --stealth MIN MAX), rotating User-Agents, and headless Chrome integration keep you under the radar. Perfect for production environments where WAFs are watching.

  • Full-Page Screenshots

    Using Selenium, it captures entire pages (not just viewports) and saves them with timestamps. Great for visual verification of admin panels or dynamic content. Just add --screenshots shots/ and watch the PNGs pile up.

  • Keyword Hunting with 300+ Patterns

    Targets sensitive files and paths like .env, /wp-admin, Dockerfile, backups (*.bak), and debug flags (debug=true). Customize with -k for your own hunts.

  • JavaScript Deep Dive

    Parses axios, XMLHttpRequest, template literals, WebSockets, and dynamic imports to unearth endpoints that static scanners miss.

  • AI-Powered Reports

    At scan's end, it queries GPT-4o (via Pollinations API) for a concise summary: high-value assets, critical findings, and next steps. Disable with --no-ai if you're flying solo.

Under the MIT License, it's free to fork, tweak, and deploy. The repo is already extensible—edit the wordlists or patterns right in the script.

Quick Start: From Zero to Recon Hero

Getting up and running is a breeze. Here's the playbook:

Clone and Install 

git clone https://github.com/Noob12345678900000/httprecon3.git
cd httprecon3
pip install requests beautifulsoup4 cssutils selenium colorama dnspython
# For screenshots, grab ChromeDriver or add webdriver-manager for auto-handling.
Enter fullscreen mode Exit fullscreen mode

Basic Scan 

python3 httprecon3.py example.com
Enter fullscreen mode Exit fullscreen mode

This kicks off a depth-3 crawl, keyword hunt, and asset dump.

Pro-Level Recon 

python3 httprecon3.py target.com \
  --subdomains \
  --extract-keys \
  --screenshots shots/ \
  --stealth 2 5 \
  -o assets.txt \
  -e js css json
Enter fullscreen mode Exit fullscreen mode

Brute subdomains, snag secrets, screenshot everything, and stealthily delay requests by 2–5 seconds.

Output? Colorful terminal logs with assets listed, keyword hits with context, API detections, and that slick AI wrap-up. Assets save to file for easy piping into tools like Nuclei or FFUF.

Real-World Use Case: Finding a Leaked AWS Key in 30 Seconds

During a recent bug bounty, I ran httprecon3 on a mid-sized SaaS target. Within the first pass, it flagged:

  • admin.target.com (from subdomain brute-force)
  • /config.js containing AKIA... (via --extract-keys)
  • /graphql with introspection enabled
  • A full screenshot of the admin login panel

The AI report summarized:

Critical: AWS key exposed in JS. Admin panel accessible. GraphQL introspection on. Prioritize key rotation and auth testing.

30 seconds from launch to actionable intel. That’s the power of httprecon3.

Why Open Source? Why Now?

Recon tools are often bloated, paid, or outdated. httprecon3 is:

  • Lightweight: One script, no bloat.
  • Free & Open: MIT licensed.
  • Community-Driven: Pull requests welcome for new patterns, wordlists, or integrations.

Check out the manual page for full command reference.

Get Started Today 

git clone https://github.com/Noob12345678900000/httprecon3.git
Enter fullscreen mode Exit fullscreen mode

Star it. Fork it. Break it. Improve it.

"In recon, speed wins. In depth, secrets fall."

— l0n3ly!

Happy hunting. Stay ethical. And never stop learning.

Top comments (1)

Collapse
 
0root profile image
hmza •

good tool