2. Usage Guide

Table of Contents

• Target Options
• Mode Options
• General Options
• Output Options

---

Target Options

Target could be a domain or a subdomain. It important to specify a target for a scan. Also reconFTW has ability to import a list of target from a text file.(The targets must be specified one on each line)

Subcommand	Description
-d	Target domain
-l	Specify a list of targets (targets.txt)
-x	Out of scope subdomain list(oos.txt)

Mode Options

• reconFTW supports several mode options. It's best preferred to use all checks. But depending on your needs you can select the required mode.
• Changes in the mode options results in varying execution time of the script.

Subcommand	Description
-r	Recon - Full recon process (only recon without attacks)
-s	Subdomains - Search subdomains, check tko and web probe
-p	Passive - Performs only passive steps
-a	All - Perform all checks and exploitations
-w	Web - Just web checks from list provided
-v	Verbose - Prints everything including errors, for debug purposes
-h	Help - Show this help

General Options

• Some checks/tasks of reconFTW take a longer time and generate a lot of web traffic.
• You can enable these tasks by using the following options.

Subcommand	Description
--deep	Deep scan (Enable some slow options for deeper scan)

Output Options

Supports option for user-defined output directory of the results.

Subcommand	Description
-o	Define the output folder