urlrecon

Quick Start

Install via jcli (recommended)

jcli install urlrecon

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Scan a target

urlrecon --target example.com                                 # default modules, terminal output
urlrecon --target example.com --output json                   # pipe-clean JSON
urlrecon --target example.com --modules headers,tls,waf       # subset
urlrecon --target example.com --modules jsendpoints           # opt-in JS endpoint + secret scan
urlrecon --target example.com --output json --out-file r.json # write to file
urlrecon --file targets.txt --output json                     # bulk: one report per target

Absorbed subcommands

# Certificate Transparency / chain validation (former certchain tool)
urlrecon certchain query example.com
urlrecon certchain validate example.com:443
urlrecon certchain inspect ./leaf.pem

# Historical subdomain inventory + takeover detection (former domaindrift tool)
urlrecon domaindrift history example.com
urlrecon domaindrift takeover example.com

What it does

urlrecon is a passive recon CLI: feed it a URL or domain and it runs a fleet of 19 analysis modules concurrently, returning a structured report. Built in Rust, single binary, zero runtime dependencies. Re-implements + extends the capabilities of the retired headerscan, certchain, and domaindrift tools (security headers, WAF, TLS, redirect-chain, CT-log query, chain validation, and subdomain-takeover detection are now part of urlrecon).

• Concurrent module orchestrator. All selected modules run in parallel against a single target. Per-module failures degrade gracefully — one timed-out module doesn't abort the run.
• Pipe-clean JSON output. --output json emits a stable schema suitable for jq / CI pipelines / dashboards. CSV and Markdown are also available.
• Configurable. --modules selects a subset, --timeout bounds slow probes, --concurrency caps async workers, --rate-limit throttles, --no-color for log-friendly output.
• Opt-in heavy modules. jsendpoints and domain_history are off in --modules all because they add real network cost — run them explicitly when you want that depth.
• Post-recon file fetch. --download <bucket> reads the inventory.file.* URLs and writes them to ./urlrecon-downloads/ (override with --download-dir).

Modules

Modules marked opt-in are skipped by --modules all; pass the name explicitly (e.g. --modules jsendpoints) to run them.

Absorbed subcommands

urlrecon ships the former certchain and domaindrift tools as subcommands rather than the flat recon path. Output formats terminal / json / csv / markdown apply uniformly via --format.

CLI

Design choices

• rustls everywhere. HTTP via reqwest+rustls-tls, TLS handshake via tokio-rustls. No openssl-sys, deployable on hardened systems without OpenSSL.
• RDAP, not legacy WHOIS. The whois module queries rdap.org over HTTPS for structured JSON — no fragile text parsing, no TCP-43 firewalling concerns.
• Pre-resolution for geo. ipwho.is's own resolver is unreliable for many domains; the geo module pre-resolves via hickory-resolver and queries with the resolved IP for clean results.
• Bounded port scan. 26 well-known ports, 3s per-port timeout, 32 concurrent connects. Full TCP handshakes (not stealth scan) — connections appear in target logs. Operator authorisation expected.
• Embedded signatures. WAF (10), security headers (9), TLS ciphers, tech (33) are all embedded in the binary via include_str!. Updates require a tool rebuild but the runtime is offline-capable.