ReconX is a web penetration testing tool that scans your app as several logged-in users at once, verifies every finding against the live target, and hands your team proof, not noise.
DockerGitHub ActionsOpenAPIGraphQLnucleisqlmapsemgrepStrixPlaywright| Severity | Finding | Location | Status |
|---|---|---|---|
| Critical | Broken object-level authorization | GET /api/v1/invoices/{id} | ✓ Exploit-proven |
| High | Reflected XSS | GET /search?q= | ✓ Exploit-proven |
| Medium | Dangling MX record | mail.demo.acme | ✓ Verified |
| Medium | Missing security headers | / | ✓ Verified |
| Low | Weak DMARC policy | TXT _dmarc | ✓ Verified |
Broken access control is the #1 risk in the OWASP Top 10, and it only shows up when one user can touch another user's data. One session can't see it. ReconX replays the same request as a second identity and catches the leak.
How multi-identity testing works →// identity A — owner
GET /api/v1/invoices/1042 200
// identity B — different tenant
GET /api/v1/invoices/1042 200 ← leaked
[CRITICAL] Broken object-level authorization
cross-identity read confirmedCapture real logins, including SSO and MFA, then replay every request across identities. ReconX flags cross-identity reads and writes, function-level escalation (BFLA), and endpoints that answer with no auth at all, the access-control flaws single-session scanners cannot reach.
A per-host baseline and proof-required checks suppress false positives, and a safe exploitation pass confirms findings with benign proofs. An optional adaptive agent loop plans targeted retests. Confirmed findings come first; AI assists triage but never overrides a confirmed result.
Every finding ships with a replayable curl proof, full evidence, remediation, and OWASP mapping, as PDF, Markdown, DOCX, or JSON. A report your reviewers sign off and engineering fixes.
From injection to multi-tenant access control and DNS takeover. Extend with Python plugins or no-code YAML checks.
Two benchmarks guard every build. A hermetic corpus of 61 scenarios runs the real scanners against known ground truth. A Docker harness scans live vulnerable apps and fails the build if criticals on a clean app exceed a tight ceiling, the guard that keeps false positives out.
| Live target | Findings | Criticals | FP ceiling | Result |
|---|---|---|---|---|
| OWASP Juice Shop | 9 | 0 | 2 | pass |
| VAmPI (vulnerable API) | 5 | 0 | 3 | pass |
| DVWA | 14 | 0 | 1 | pass |
Reproduce: python benchmark/run_benchmark.py. Numbers captured 2026-10-05.
Subdomain enumeration across seven passive sources plus brute force; DNS, ports, WHOIS, tech fingerprint.
Fast httpx or headless-Chromium crawl, plus OpenAPI, GraphQL, and JS-bundle endpoint discovery.
All 28 scanners run concurrently as every captured identity, with optional nuclei, sqlmap, and semgrep.
Per-host baseline learning and proof-required checks suppress false positives before the report.
Confirmed findings first, each with curl proof, remediation, and OWASP mapping; noise collapsed.
docker pull ghcr.io/clouddrove/reconx
reconx scan demo.acme-corp.example --profile deep -y