Recon-ng: how to use it, and how it compares
Recon-ng is a modular framework for web-based open-source reconnaissance, with a console that feels a lot like Metasploit. It is a toolkit you build an investigation in, not a one-box search. Here is how it works and how to get started.
Web reconnaissance framework. Project: github.com/lanmaster53/recon-ng · License: GPL-3.0 · Last reviewed 2026-10-13
What is Recon-ng?
Recon-ng is written in Python by Tim Tomes (lanmaster53) and released under GPL-3.0. The README says it is designed only for web-based open-source reconnaissance and points people to other tools for exploitation or social engineering.
Everything runs through modules that you install from a marketplace inside the tool. Modules collect data into a workspace database, and many need API keys, which Recon-ng stores in its own key database. A web interface and API (recon-web) come with it, and Kali Linux packages it.
How to use Recon-ng
- You need Python 3.6+. Clone the repository and install the requirements, ideally in a virtual environment.
- Launch the console, then install modules from the marketplace.
- Add API keys for modules that need them and run modules against your workspace.
- Use the -h switch to see runtime options, and the project wiki for module details.
Example commands from the project's README (check it for the current version):
git clone https://github.com/lanmaster53/recon-ng.git
cd recon-ng
pip install -r REQUIREMENTS
./recon-ngRecon-ng vs WhatsMyName Apps
| Feature | Recon-ng | WhatsMyName Apps |
|---|---|---|
| Scope | Modular web reconnaissance | Username search plus seven domain endings |
| Setup | Python 3.6+ from source, Kali package or Docker | Nothing to install. It runs in the browser |
| Extensibility | Module marketplace | No plugins |
| Data storage | Local workspace database | The username goes to our server only to run the check. It is not stored or logged |
| Automation | Console, recon-cli and recon-web | No API and no CLI |
| Export | Through reporting modules | JSON and CSV (no PDF) |
| Price | Free, open source | Free, no sign-up |
Based on Recon-ng's own documentation as of 2026-10-13. Tools change; the project page is the final word.
Pros and cons of Recon-ng
Pros
- Modular design with a marketplace of community modules.
- Workspaces keep data organized across a long investigation.
- Free and open source; packaged in Kali Linux.
Cons
- Steep learning curve if you have never used a console framework.
- Module dependencies and API keys are your job to manage.
- Slow route to a simple answer like "where is this handle used?".
Who Recon-ng is for
Recon-ng is for penetration testers and OSINT specialists who want a scriptable workspace for authorized, multi-step web reconnaissance. Casual users and quick username checks are better served elsewhere.
Try a username search in your browser
Free, no sign-up. Checks 3,166 sites; the username is not stored or logged.
Frequently asked questions
How do I install Recon-ng?
Clone the GitHub repository, run pip install -r REQUIREMENTS, then start it with ./recon-ng. It is also packaged in Kali Linux, and the wiki covers a Docker setup.
Is Recon-ng free?
Yes. It is open source under GPL-3.0, though some modules use third-party services that need API keys.
Recon-ng vs WhatsMyName Apps: are they alternatives?
Not really. Recon-ng is a framework for full reconnaissance. WhatsMyName Apps does one job, username search, in the browser.
Related tools and guides
- SpiderFoot: OSINT automation framework
- theHarvester: Domain reconnaissance
- OSINT Framework: Directory of OSINT tools
- Sherlock: Username search (CLI)
- All OSINT tools compared
- OSINT username search · Reverse username lookup · Platform username checkers
- Username OSINT for beginners
Names and trademarks belong to their owners. WhatsMyName Apps is independent and not affiliated with or endorsed by Recon-ng or its authors.