🔍 ThreatTape Recon
Automated Reconnaissance. Professional Reports.
An automated recon and OSINT platform we're building for our own pentest engagements. From domain enumeration through executive profiling, CVE mapping, and compliance-oriented report generation — all in one containerized platform with optional TOR-anonymous scanning.
[AI] Decision: 4 breached emails → pivot to person scan
[AI] Decision: exec match (LinkedIn) → cross-reference Sherlock
[TOR] Rotating exit node 3/5...
[OK] Tier 1 PoC verification ready for review
Authorized Privateering for the Modern Era
A Letter of Marque was a government-issued commission authorizing private operators to attack enemy ships. Same flag, same firepower, same outcome — but sanctioned, scoped, and documented. We're doing the same thing with networks.
Every Recon engagement runs against a written scope, with explicit authorization boundaries, audit-grade chain of custody, and Tier 1 PoC verification gated behind customer sign-off. Tier 2 red-team exploit chains require a separate authorization. You get the same depth a real adversary would reach — without the legal exposure of operating outside the line.
Signed, scoped, and logged. Every action narrated by the decision engine.
AI Decision Engine
What makes ThreatTape Recon different from a tool launcher is the decision engine. You pick a target — a domain, a company, or a person — and the engine decides what to do next, narrating its reasoning to a real-time terminal panel. Subdomain hits spawn endpoint scans. Endpoints with breached emails spawn person scans. Person scans surface social-graph hits that loop back into company intel. The graph is the product, not the tool list.
Three Target Types
Domain · Company · Person. Each target type seeds the decision engine differently — and the engine cross-references findings into the other two.
Autonomous Sub-Scan Spawning
The engine spawns sub-scans automatically based on what it finds. Real-time
terminal stream narrates [AI] reason → action for every decision,
so the analyst can audit and override.
Tiered Exploit Verification
Tier 1: proof-of-concept verification with authorization workflow. Tier 2: red-team scan flag with audit logging; the engagement-scoped UI is on the roadmap. Both gated behind explicit authorization — recon never escalates without consent.
EDGAR + CGAP Cross-Feed
Connect a Recon engagement to an EDD-i tenant and the decision engine consumes authenticated endpoint inventory (EDGAR) and governance posture (CGAP) to scope external recon against known assets — no duplicate scanning of what's already known.
Core Capabilities
Technical Infrastructure Recon
Automated domain and subdomain discovery using amass and subfinder. Port scanning with nmap, service fingerprinting, and version detection with confidence scoring. Maps the full external attack surface before an adversary does.
CVE Mapping & Vulnerability ID
Nuclei-powered vulnerability scanning correlates discovered services against current CVE databases. CVSS scores, remediation priority, and evidence capture — all structured for reporting. Know what's exploitable, not just what's open.
Executive OSINT
Person-first reconnaissance with company identification. Social media footprint analysis via Sherlock (200+ platforms), email discovery via Hunter.io, breach exposure via Have I Been Pwned and h8mail. Build the target profile that attackers already have.
TOR Anonymous Scanning
Five rotating TOR proxy instances for low-attribution recon. Configurable anonymity level per scan — run stealth assessments without exposing your infrastructure. Scan from the outside the way real adversaries do.
Professional Report Generation
Multi-format output: PDF, HTML, JSON, CSV, XML. SOC 2 and ISO 27001 compliance templates built in. Executive summary and technical detail layers. Full chain of custody tracking for legal admissibility.
Real-Time Scan Progress
WebSocket-based live updates stream asset discoveries and vulnerability findings as they happen. Real-time terminal panel narrates the decision engine's reasoning. Concurrency is tuned per scan tier — up to 10 parallel domain scans for company-level fan-out.
Scan Profiles
Four profiles balance speed against depth. TOR-enabled scans run 2–3x longer to maintain anonymity.
OSINT & Threat Intel Integrations
Recon pulls from the same data sources threat actors use. No proprietary sensors — just the intelligence the open web already has on your targets.
Technology Stack
Fully containerized multi-service architecture. Each layer scales independently — scanning workers, API backend, and UI are separate containers with isolated networks.
Minimum specs: 8 cores · 32 GB RAM · 500 GB SSD
Recon Like the Adversary Does
ThreatTape Recon is in active early development. We're building it for our own engagements first — so it has to work in the real world, not just in demos. If you want early access when we open testing, get on the list.