# code-saksham-hash/recon_cli architecture

> Architecture diagram of the GitHub repository code-saksham-hash/recon_cli, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-06-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/code-saksham-hash/recon_cli
- Repository: https://github.com/code-saksham-hash/recon_cli

## Overview

1. **Repository shape**
   - This is a very small, single-purpose Python CLI project.
   - The entire application appears to live in `recon.py`, with `requirements.txt` defining runtime dependencies and `Dockerfile` providing a containerized execution path.

2. **Primary execution model**
   - The tool runs as a command-line program invoked with a target domain argument, e.g. `python recon.py -d example.com`.
   - There is no evidence of a server, background worker, or multi-service deployment; the architecture is centered on one process that performs a set of reconnaissance tasks sequentially.

3. **Core responsibility**
   - The main job is DNS and domain intelligence gathering for a single target domain.
   - It combines passive data collection, active DNS probing, and IP/ASN enrichment into one reporting pipeline.

4. **Input boundary**
   - The only explicit user input is the target domain.
   - From that input, the tool derives subdomains and DNS queries; there are no signs of local database state, authentication, or user management.

5. **DNS resolution subsystem**
   - One subsystem queries standard DNS record types: A, MX, TXT, NS, and CNAME.
   - This is likely the deterministic, low-latency part of the tool and depends on local DNS resolution through `dnspython`.

6. **Passive enumeration subsystem**
   - Subdomain discovery is augmented via crt.sh certificate transparency logs.
   - This is an external HTTP dependency and an important architectural boundary: the tool is only as complete as the public CT data returned by crt.sh, and the README notes automatic retry behavior for that lookup.

7. **Active enumeration subsystem**
   - The tool also performs brute-force subdomain discovery using a 60+ entry wordlist of common prefixes.
   - Architecturally, this is the active probing path: it generates candidate names locally, then validates them by DNS lookup against the target domain.

8. **Network intelligence enrichment**
   - The ASN lookup path resolves IP address metadata such as ASN, organization, country, city, and reverse DNS.
   - This enrichment depends on an external IP intelligence service (`ipapi.co` per the README), making it another network-facing integration distinct from DNS queries.

9. **Output/reporting layer**
   - Results are rendered in the terminal using Rich, with structured and color-coded output.
   - The reporting layer is console-first rather than file-first; no persistent report storage or API output format is indicated.

10. **Runtime and dependencies**
   - The project targets Python 3.8+.
   - Key dependencies are `dnspython` for DNS, `requests` for HTTP to external services, and `rich` for terminal presentation.
   - The Dockerfile packages these dependencies into a container image, giving the project a second runtime boundary: native Python execution or containerized execution.

11. **End-to-end data flow**
   - Flow is: user supplies domain → tool enumerates subdomains passively and actively → tool resolves DNS records for discovered names → tool enriches with IP/ASN metadata where applicable → results are formatted in the terminal.
   - The only external systems in the architecture are public internet services and DNS infrastructure; there are no internal microservices or local data stores.

12. **Architecture summary for diagramming**
   - This repo should be drawn as a single CLI application with three outbound integrations: DNS resolver traffic, crt.sh HTTP requests, and ipapi.co HTTP requests.
   - Around that core, show two discovery modes (passive and brute-force) feeding into a shared resolution/reporting stage, with Rich as the final presentation boundary.

Main entry points: [`recon.py`](https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py) (recon.py), [`Dockerfile`](https://github.com/code-saksham-hash/recon_cli/tree/main/Dockerfile) (Dockerfile), [`requirements.txt`](https://github.com/code-saksham-hash/recon_cli/blob/main/requirements.txt) (requirements.txt)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Runtime"]
  node_input_domain(("Target domain<br/>cli arg"))
  node_recon_py["recon.py<br/>orchestrator<br/>[recon.py]"]
  node_passive_enum["Passive enum<br/>ct lookup<br/>[recon.py]"]
  node_bruteforce_enum["Brute-force<br/>subdomain probe<br/>[recon.py]"]
  node_dns_resolver["DNS resolve<br/>record lookup<br/>[recon.py]"]
  node_asn_enrich["ASN enrich<br/>ip metadata<br/>[recon.py]"]
  node_reporter["Rich output<br/>terminal report<br/>[recon.py]"]
  node_dockerfile["Dockerfile<br/>container build"]
  node_requirements["requirements.txt<br/>deps manifest<br/>[requirements.txt]"]
end

subgraph group_external["External Services"]
  node_crtsh[("crt.sh<br/>ct source")]
  node_dns_net[("DNS network<br/>dns infra")]
  node_ipapi[("ipapi.co<br/>ip intel")]
end

node_input_domain -->|"invoke"| node_recon_py
node_recon_py -->|"start"| node_passive_enum
node_recon_py -->|"start"| node_bruteforce_enum
node_passive_enum -->|"query"| node_crtsh
node_bruteforce_enum -->|"probe"| node_dns_net
node_recon_py -->|"resolve"| node_dns_resolver
node_dns_resolver -->|"lookup"| node_dns_net
node_dns_resolver -->|"extract IPs"| node_asn_enrich
node_asn_enrich -->|"enrich"| node_ipapi
node_passive_enum -->|"subdomains"| node_recon_py
node_bruteforce_enum -->|"hits"| node_recon_py
node_dns_resolver -->|"records"| node_recon_py
node_asn_enrich -->|"metadata"| node_recon_py
node_recon_py -->|"render"| node_reporter
node_recon_py -.->|"depends on"| node_requirements
node_recon_py -.->|"package"| node_dockerfile

click node_recon_py "https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py"
click node_passive_enum "https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py"
click node_bruteforce_enum "https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py"
click node_dns_resolver "https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py"
click node_asn_enrich "https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py"
click node_reporter "https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py"
click node_dockerfile "https://github.com/code-saksham-hash/recon_cli/tree/main/Dockerfile"
click node_requirements "https://github.com/code-saksham-hash/recon_cli/blob/main/requirements.txt"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_input_domain,node_recon_py,node_passive_enum,node_bruteforce_enum,node_dns_resolver,node_asn_enrich,node_reporter,node_dockerfile,node_requirements toneBlue
class node_crtsh,node_dns_net,node_ipapi toneAmber
```

## Components

### Runtime

Single-process CLI execution and packaging boundary

- **Target domain**: cli arg · User-supplied domain to investigate
- [recon.py](https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py): orchestrator · Main CLI entrypoint that coordinates reconnaissance steps · `recon.py`
- [Passive enum](https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py): ct lookup · Discovers subdomains from certificate transparency data · `recon.py`
- [Brute-force](https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py): subdomain probe · Generates common subdomain candidates and validates them via DNS · `recon.py`
- [DNS resolve](https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py): record lookup · Queries A, MX, TXT, NS, and CNAME records for discovered hosts · `recon.py`
- [ASN enrich](https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py): ip metadata · Enriches resolved IPs with ASN and location details · `recon.py`
- [Rich output](https://github.com/code-saksham-hash/recon_cli/blob/main/recon.py): terminal report · Formats and prints structured results in the console · `recon.py`
- [Dockerfile](https://github.com/code-saksham-hash/recon_cli/tree/main/Dockerfile): container build · Container image path for running the CLI in Docker · `Dockerfile`
- [requirements.txt](https://github.com/code-saksham-hash/recon_cli/blob/main/requirements.txt): deps manifest · Python runtime dependencies for DNS, HTTP, and terminal output · `requirements.txt`

### External Services

Public DNS and HTTP dependencies used during reconnaissance

- **crt.sh**: ct source · Certificate transparency data source for passive enumeration
- **DNS network**: dns infra · Public DNS infrastructure used for resolution and validation
- **ipapi.co**: ip intel · External IP intelligence service for ASN and geo metadata

## Connections

- Target domain → recon.py: invoke · CLI receives the target domain
- recon.py → Passive enum: start · Orchestrator launches passive discovery
- recon.py → Brute-force: start · Orchestrator launches active subdomain probing
- Passive enum → crt.sh: query · Fetch certificate transparency subdomains
- Brute-force → DNS network: probe · Validate candidate subdomains through DNS lookup
- recon.py → DNS resolve: resolve · Shared DNS record resolution for discovered names
- DNS resolve → DNS network: lookup · Resolve A, MX, TXT, NS, and CNAME records
- DNS resolve → ASN enrich: extract IPs · Pass resolved addresses into enrichment
- ASN enrich → ipapi.co: enrich · Request ASN and geo metadata
- Passive enum → recon.py: subdomains · Return discovered hostnames
- Brute-force → recon.py: hits · Return valid brute-force discoveries
- DNS resolve → recon.py: records · Return DNS record data for reporting
- ASN enrich → recon.py: metadata · Return ASN and reverse DNS details
- recon.py → Rich output: render · Send combined results to console reporting
- recon.py → requirements.txt: depends on · Python dependencies required for execution
- recon.py → Dockerfile: package · Optional containerized execution path