reconsuite-ai

README

🚀 ReconSuite-AI

The Ultimate AI-Powered Bug Bounty & Exploitation Framework

ReconSuite-AI is an AI-driven bug bounty and penetration testing framework designed for security researchers, ethical hackers, and red teamers. Built in Go, it features AI-enhanced payload crafting, automated reconnaissance, and smart vulnerability exploitation—making your security assessments efficient, accurate, and scalable.

---

🔥 Core Features

• Automated Reconnaissance & Enumeration

  • 🔍 Subdomain discovery & API endpoint extraction
  • 🧠 Smart filtering & AI-powered fingerprinting

• AI-Driven Exploitation

  • 🤖 AI-crafted payloads for SQLi, XSS, SSRF, RCE, LFI, IDOR, and more
  • 🎯 Adaptive attack strategies based on target responses

• Authentication Handling

  • 🛡️ Supports JWT, OAuth, API Keys, Cookies, and Headers
  • 🔄 Automated session tracking & replay attacks

• Vulnerability Filtering & Detection

  • 🕵️‍♂️ Integration with gf for vulnerability pattern matching
  • 🚨 Automated anomaly detection to uncover hidden parameters and bypass techniques

• Exploit Execution & Post-Exploitation

  • ⚡ Real-time attack execution with proxy support
  • ✔️ Smart validation of high-risk vulnerabilities

• Multi-Threaded & Optimized Scanning

  • 🚀 High-performance scanning with threading & rate-limiting
  • 🌐 Support for proxies, custom headers, and timeout settings

• Custom Recon & Exploit Pipelines

  • 🏗️ Modular architecture for custom workflows
  • 🔌 API integration for seamless automation

• Automated Reporting

  • 📊 Generates structured reports in JSON, HTML, or Markdown

---

⚙ Installation & Setup

Prerequisites

Make sure you have the following installed:

• Go (version 1.16 or later)
• Git
• OpenAI API Key

Install via Go

go install github.com/Harry7U/reconsuite-ai@latest

Manual Installation

Clone the Repository:

git clone https://github.com/Harry7U/ReconSuite-AI.git
cd ReconSuite-AI

Install Dependencies:

go mod tidy

Build the Project:

go build -o reconsuite-ai main.go

Set Up Your OpenAI API Key:

export OPENAI_API_KEY=your_openai_api_key

Additional Tool Installation

ReconSuite-AI integrates with advanced tools to extend its capabilities. Install these tools as needed:

gf (Gf Patterns) – Vulnerability Pattern Matching:

go install github.com/tomnomnom/gf@latest

subfinder – Subdomain Enumeration:

go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

httpx – HTTP Probing:

go install github.com/projectdiscovery/httpx/cmd/httpx@latest

Setting Up GF Patterns

git clone https://github.com/1ndianl33t/Gf-Patterns
cp -r Gf-Patterns/*.json ~/.gf

---

🛠 Supported Vulnerabilities

ReconSuite-AI automates reconnaissance and exploitation for a comprehensive list of vulnerabilities:

Authentication & Access Control

• 🔐 Account Takeover
• 🔑 OAuth & JWT Misconfiguration
• 🔍 Insecure Direct Object References (IDOR)
• 🕵️‍♂️ Hidden Parameters Discovery

Injection-Based Attacks

• 💉 SQL Injection (SQLi)
• 💉 NoSQL Injection
• 💉 Command Injection
• 💉 Prototype Pollution
• 💉 GraphQL Injection
• 💉 LDAP Injection
• 💉 CRLF Injection

Client-Side Attacks

• 🌐 CORS Misconfiguration
• 🖱️ Clickjacking
• 📦 DOM Clobbering
• 🗄️ Web Cache Deception
• 🚪 Open Redirects

Server-Side Vulnerabilities

• 🌐 SSRF (Server-Side Request Forgery)
• 🗂️ SSTI (Server-Side Template Injection)
• 📂 XXE (XML External Entity Injection)
• 🗃️ LFI/RFI (Local/Remote File Inclusion)
• 🗄️ Path & Directory Traversal
• 🏃‍♂️ Race Conditions & Privilege Escalation

Denial-of-Service & Exploits

• 🌐 DNS Rebinding
• 🔀 Dependency Confusion
• 📦 Request Smuggling
• 💥 Mass Assignment Attacks

Miscellaneous Security Flaws

• 🛡️ Public CVE Exploits & Known Vulnerabilities
• 🛠️ Google Web Toolkit (GWT) Misconfigurations
• 🔐 SAML Injection
• 🔄 Type Juggling
• 🚨 WAF Evasion Techniques

---

🔧 Usage Examples

Full Recon & Enumeration:

reconsuite-ai -target example.com -subdomains -extract -filter

API & URL Extraction:

reconsuite-ai -target example.com -extract

AI-Powered Exploitation:

reconsuite-ai -target example.com -exploit

AI-Powered Payload Generation:

reconsuite-ai -target example.com -ai

Smart Vulnerability Filtering:

reconsuite-ai -target example.com -filter

Testing with Custom Authentication:

reconsuite-ai -target example.com -header "Authorization: Bearer YOUR_TOKEN"

---

🏗 Core Project Structure

ReconSuite-AI/
├── cmd/                 # CLI command handlers
├── config/              # Configuration files & settings
├── core/                # Core vulnerability scanning logic
│   ├── recon.go         # Subdomain enumeration & API crawling
│   ├── filter.go        # GF filtering & vulnerability detection
│   ├── exploit.go       # Exploitation phase (SQLi, XSS, IDOR, etc.)
│   ├── ai_payload.go    # AI-powered payload crafting
│   └── http_utils.go    # Custom HTTP request handling
├── data/                # Wordlists, payloads, and scan results
├── reports/             # Scan reports (JSON, HTML, Markdown)
├── scripts/             # Automation scripts
├── main.go              # Main execution entry point
├── go.mod               # Go module dependencies
├── LICENSE              # MIT License
├── README.md            # Documentation
└── Makefile             # Build & install automation

---

🛠 Help Menu

Display all available options by running:

reconsuite-ai -h

Usage:

reconsuite-ai [flags]

Flags:
  -h, --help                 Show this help message
  -t, --target DOMAIN        Set target domain
  -H, --header "KEY:VALUE"   Set custom HTTP headers
  -e, --extract              Extract URLs, APIs, and JS endpoints
  -s, --subdomains           Run subdomain enumeration
  -a, --ai                   Use AI for payload generation
  -f, --filter               Apply GF filtering for vulnerabilities
  -x, --exploit              Run exploitation (SQLi, XSS, SSRF, RCE, etc.)
  -o, --output FORMAT        Save results as JSON/HTML/Markdown
  --threads INT              Set number of threads (default: 10)
  --timeout SECONDS          Set request timeout (default: 10)
  --proxy URL                Use a proxy for scanning
  --debug                    Enable debug mode