🔍 ThreatTape Recon

Automated Reconnaissance. Professional Reports.

Enterprise-grade automated recon and OSINT platform built for penetration testers and security teams. From domain enumeration through executive profiling, CVE mapping, and compliance-ready report generation — all in one containerized platform with optional TOR-anonymous scanning.

🛠️ Early Development FastAPI SvelteKit Docker TOR-Anonymous
Request Early Access Schedule Demo
ThreatTape Recon Dashboard

Core Capabilities

🌐

Technical Infrastructure Recon

Automated domain and subdomain discovery using amass and subfinder. Port scanning with nmap, service fingerprinting, and version detection with confidence scoring. Maps the full external attack surface before an adversary does.

🎯

CVE Mapping & Vulnerability ID

Nuclei-powered vulnerability scanning correlates discovered services against current CVE databases. CVSS scores, remediation priority, and evidence capture — all structured for reporting. Know what's exploitable, not just what's open.

🕵️

Executive OSINT

Person-first reconnaissance with company identification. Social media footprint analysis via Sherlock, email discovery via Hunter.io, data breach exposure via HaveIBeenPwned and LeakCheck. Build the target profile that attackers already have.

🧅

TOR Anonymous Scanning

Five rotating TOR proxy instances for low-attribution recon. Configurable anonymity level per scan — run stealth assessments without exposing your infrastructure. Scan from the outside the way real adversaries do.

📄

Professional Report Generation

Multi-format output: PDF, HTML, JSON, CSV, XML. SOC 2 and ISO 27001 compliance templates built in. Executive summary and technical detail layers. Full chain of custody tracking for legal admissibility.

⚡

Real-Time Scan Progress

WebSocket-based live updates stream asset discoveries and vulnerability findings as they happen. Up to 50 concurrent scans via Celery workers. Watch the surface area grow in real time.

Scan Profiles

Four profiles balance speed against depth. TOR-enabled scans run 2–3x longer to maintain anonymity.

⚡ Quick
15–20 minutes
High-level overview. Rapid asset discovery and top-severity vulnerability surface. Good for triage.
🔍 Standard
30–45 minutes
Comprehensive scan covering most common vulnerabilities and full subdomain enumeration. The default for engagements.
🔬 Deep
60–90 minutes
Thorough analysis with service version detection, web application profiling, and API discovery. For full assessments.
👻 Stealth
2–3 hours
Low-and-slow with TOR routing. Designed to minimize detection signatures while achieving complete coverage.

OSINT & Threat Intel Integrations

Recon pulls from the same data sources threat actors use. No proprietary sensors — just the intelligence the open web already has on your targets.

Hunter.io
Email discovery and verification. Map the human attack surface behind the domain.
HaveIBeenPwned
Breach exposure checking for email addresses associated with the target org.
LeakCheck / IntelX
Leak database searching for credentials, PII, and internal data in the wild.
Sherlock
Social media footprint analysis across 300+ platforms for executive OSINT targets.
Shodan / VirusTotal
Passive infrastructure intelligence and malware/reputation data for discovered IPs and domains.
amass + subfinder
Industry-standard subdomain enumeration tools for complete external surface mapping.

Technology Stack

Fully containerized multi-service architecture. Each layer scales independently — scanning workers, API backend, and UI are separate containers with isolated networks.

SvelteKit (TypeScript) FastAPI PostgreSQL 15 Redis 7 Celery Docker Compose Nginx WebSockets JWT / OAuth2 nmap nuclei amass subfinder theHarvester Sherlock TOR (5 proxies) WeasyPrint SQLAlchemy 2.0

Minimum specs: 8 cores · 32 GB RAM · 500 GB SSD  |  Recommended production: 16 cores · 64 GB ECC RAM · 2 TB NVMe · 10 Gbps

Recon Like the Adversary Does

ThreatTape Recon is in active early development. We're building it for our own engagements first — so it has to work in the real world, not just in demos. If you want early access when we open testing, get on the list.

Request Early Access Schedule a Demo