Automated Web
Penetration Testing
ReconX is a comprehensive AI-powered penetration testing framework with 26 scanner modules, multi-LLM intelligence, and professional report generation. Built for security professionals.
$ reconx scan --target example.com --profile deep
[*] ReconX v1.0.0 - AI-Native Penetration Testing
[*] Target: example.com
[*] Profile: deep (26 modules)
[*] AI Engine: Claude claude-sonnet-4-20250514
[+] Running scanner: SQL Injection............ done
[+] Running scanner: XSS Detection............ done
[+] Running scanner: CSRF Analysis............ done
[!] Found: SQL Injection in /api/users?id=1
[!] Found: Reflected XSS in /search?q=
[!] Found: Missing CSRF token on /api/transfer
[*] AI Analysis: Validating 47 findings...
[+] False positives removed: 12
[+] Attack paths identified: 3
[+] Report generated: report_example_com.htmlBuilt for Security Professionals
Everything you need for comprehensive web application security testing, powered by AI.
Multi-LLM AI Engine
Supports Claude, GPT-4, Gemini, and Ollama for intelligent vulnerability analysis.
26 Scanner Modules
Comprehensive coverage from SQL injection to subdomain takeover.
Professional Reports
Generate HTML, PDF, and JSON reports with executive summaries.
OWASP Top 10
Full coverage of every OWASP Top 10 (2021) vulnerability category.
Scan Profiles
Quick, standard, deep, stealth, and API-focused scan modes.
AI False Positive Validation
Machine learning reduces noise by validating findings automatically.
Attack Path Analysis
AI maps how vulnerabilities chain together for maximum impact.
Smart Payloads
Context-aware payload generation that adapts to the target.
Open Source
MIT licensed, community-driven, and fully transparent.
26 Scanner Modules
From injection attacks to misconfigurations, ReconX covers the full spectrum of web vulnerabilities.
SQL Injection
Union, blind, time-based SQLi detection
XSS Scanner
Reflected, stored, and DOM-based XSS
CSRF Detection
Missing tokens and SameSite issues
SSRF Scanner
Server-side request forgery detection
LFI/RFI
Local and remote file inclusion
Command Injection
OS command injection vectors
XXE Scanner
XML external entity injection
SSTI Detection
Server-side template injection
Auth Bypass
Authentication weakness detection
IDOR Scanner
Insecure direct object references
Open Redirect
URL redirect and forward flaws
CORS Misconfig
Cross-origin policy analysis
Header Security
Missing and misconfigured headers
SSL/TLS Analysis
Certificate and cipher analysis
Subdomain Enum
Subdomain discovery and takeover
Directory Brute
Hidden path and file discovery
CMS Detection
WordPress, Joomla, Drupal scanning
API Security
REST and GraphQL endpoint testing
JWT Analysis
Token weakness and key confusion
WebSocket
WebSocket security testing
CRLF Injection
HTTP response splitting attacks
Clickjacking
Frame-based UI redress attacks
DNS Recon
DNS enumeration and zone analysis
WAF Detection
Web application firewall fingerprint
Tech Fingerprint
Technology stack identification
Port Scanner
Service and port enumeration
AI-Native Intelligence
ReconX goes beyond automated summaries. AI is embedded into every stage of the penetration testing workflow.
Intelligent Analysis
AI analyzes raw scanner output to identify patterns humans might miss, correlating findings across modules to uncover complex vulnerability chains.
False Positive Validation
Machine learning models evaluate each finding against known patterns, reducing noise by up to 60% and letting you focus on real threats.
Attack Path Mapping
AI constructs exploitation chains showing how individual vulnerabilities combine for maximum impact, from initial access to data exfiltration.
Smart Payload Generation
Context-aware payload generation that adapts to the target application, bypassing WAFs and custom input validation.
Executive Reporting
AI-generated executive summaries translate technical findings into business impact language for stakeholder communication.
Scan Profiles
Choose the right level of depth for every engagement.
Quick Scan
Essential checks in under 5 minutes
8 modulesStandard
Balanced coverage for routine testing
18 modulesDeep Scan
Maximum depth with all scanner modules
26 modulesStealth
Low-noise scanning for production systems
12 modulesAPI Only
Focused on REST and GraphQL endpoints
10 modulesStart Securing Your Applications
ReconX is free, open-source, and ready to use. Install it in under a minute.
pip install reconx