mrhlaingbwardev/hb-recon

What it solves

It automates the tedious process of reconnaissance for bug bounty hunters and security researchers. Instead of running multiple security tools manually, it chains them together into a single workflow and converts the raw output into a structured format that is easy for AI models to analyze.

How it works

The tool acts as an orchestrator that manages several external security binaries. It follows a specific sequence: first finding subdomains, then checking which hosts are alive, then simultaneously identifying the technology stack and crawling for endpoints. Finally, it uses pattern matching to flag potential vulnerabilities (like XSS or SQLi) and compiles all findings into a JSON report with risk scores.

Who it’s for

Security professionals, including penetration testers and bug bounty hunters, who want to speed up their initial reconnaissance phase and leverage LLMs to analyze scan results.

Highlights

• Tool Orchestration: Integrates subfinder, httpx, WhatWeb, Katana, and gf into one pipeline.
• AI-Ready Output: Generates a structured ai_report.json specifically designed to be pasted into LLMs like ChatGPT or Claude for vulnerability analysis.
• Automated Risk Scoring: Groups endpoints by risk level (high, medium, low) and category.
• Deep Crawling: Performs endpoint discovery with a crawl depth of 3.