> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d0pam1ne.blackhatethicalhacking.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The recon pipeline

> Fifteen ordered stages, from subdomains to JavaScript secrets, each running the right tools and filing results as it goes.

A recon run walks fifteen ordered **stages**. Each stage runs only the tools that apply to the current scope and that are installed; a stage with no installed tool is skipped rather than failing the run. You can pause between or within stages, or stop a single tool and let the run carry on.

![The fifteen recon stages, stage by stage](https://mintcdn.com/black-hat-ethical-hacking/GZ18__Wmfy34pdFZ/images/engine/tour-stages.webp?fit=max\&auto=format\&n=GZ18__Wmfy34pdFZ\&q=85\&s=0641e9c59bc354c032b440aaff0420cf)

The fifteen stages, the tools each one runs, and what you get from it

To watch a run happen (the briefing, the live screen and the per-stage summary), see [Running a recon](/engine/running-recon.md).

Scope the run with `--only` and `--skip`:

```bash theme={null}
# Only subdomains, DNS and ports
d0pam1ne recon --only subdomains,active,dns,ports

# Everything except screenshots and content discovery
d0pam1ne recon --skip screenshots,content
```

## The stages, in order

> **1. Subdomains**
>
> Passive subdomain enumeration from your in-scope bases: **subfinder**, **assetfinder**, **amass** (passive, with ASN and IP intel) and the **Chaos** dataset (needs an API key), plus **crt.sh** certificate transparency. IP-only scopes skip this (names come from PTR and certificates instead).

> **2. Active subdomains**
>
> DNS brute force and permutations. **puredns** (with the **massdns** backend and public resolvers) resolves `word.base` candidates with wildcard filtering; **alterx** generates permutations from the top DNS labels. Candidates under excluded names are never resolved.

> **3. DNS resolution**
>
> **dnsx** resolves A, AAAA and CNAME records with responses, at the profile's DNS rate. Writes `dns.json` and the list of names that did not resolve.

> **4. Port discovery**
>
> **naabu** finds open ports (top 100, top 1000 or all 65535 by profile, CDN and excluded IPs removed). Large in-scope CIDR ranges are swept by **masscan** or **rustscan**. Path-limited hosts are not port scanned.

> **5. IP to names (pivot)**
>
> Reverse DNS (PTR) on in-scope IPs via **dnsx**. A discovered name is followed only when every address it resolves to is an in-scope IP.

> **6. Services (nmap)**
>
> **nmap** service, version and (where privileged) OS detection on the open ports, with your project's nmap options and timing. Falls back to naabu's open ports if nmap yields nothing.

> **7. Live web**
>
> **httpx** probes names and host:port pairs for live web: status, title, server, tech, IP, CDN, TLS and redirects. Writes `web.json`, `live.txt` and passive HTTP records (headers and a bounded body).

> **8. WAF detection**
>
> **wafw00f** fingerprints web application firewalls in front of the live hosts.

> **9. TLS certificates**
>
> **tlsx** pulls certificate names and (optionally) TLS checks and versions. New in-scope certificate names are resolved and probed; names on in-scope IPs are followed.

> **10. Fingerprinting**
>
> **nuclei** runs **only** safe detection templates (technology, SSL and DNS, plus exposed panels on request) at info severity. No CVE or DAST templates run during recon, that is the attack phase.

> **11. Screenshots**
>
> **gowitness** screenshots every live web target (needs Chrome or Chromium).

> **12. URLs**
>
> Crawling and archives: **katana** (with optional JavaScript crawling), **gau**, **waybackurls** and **urlfinder**, deduplicated with **uro**. Every URL is then probed live with httpx. Writes `urls.txt`, parameters and JavaScript file lists.

> **13. Content discovery**
>
> **feroxbuster** (preferred) or **ffuf** brute-forces directories and files per site, with the profile's wordlist, depth and time budget. Excluded paths are never requested.

> **14. Parameters**
>
> **x8** (preferred) or **arjun** discovers hidden query and body parameters using the SecLists `burp-parameter-names` list.

> **15. JavaScript**
>
> Fetches in-scope JavaScript (5 MB cap, no out-of-scope redirects) and analyses it with **jsluice**, **SecretOpt1c** and **trufflehog** for endpoints and secrets. Secrets are masked and never validated against the provider.

## Control during a run

> **Pause and resume**
>
> `d0pam1ne pause` winds the tools running now down cleanly; `d0pam1ne recon --resume` continues the unfinished run from where it stopped.

> **Stop one tool**
>
> `d0pam1ne stop-tool <id>` stops a single tool (or `all`) in a running recon; the run carries on with what the rest found.

> [!TIP]
>
> Stages are independent: a failed or skipped stage does not stop the pipeline, and each writes its own JSON so partial runs are still useful. Re-running fills in what was missing rather than starting over.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.