reNgine is an automated reconnaissance framework meant for information gathering during penetration testing of web applications. reNgine has customizable scan engines, which can be used to scan the domains, endpoints, or gather information. The beauty of reNgine is that it gathers everything in one place. It has a pipeline of reconnaissance, which is highly customizable.

reNgine can be very useful when you want to perform the reconnaissance, gather endpoints, directory and file search, grab screenshots, and gather all the results in one place.

Suppose, if you have a domain hackerone.com, reNgine can perform the scan based on your scan engines, gather all the results in one place. reNgine makes it possible for use cases like, “I want to search the subdomain which has page title “Dashboard” and has page status as 200, and I quickly want to have a look at the screenshot”.

Another use-case could be, “I want to list all subdomains that use PHP, and the HTTP status is 200!”

On the endpoints part, reNgine is capable of gathering the URL endpoints using tools like gau, hakrawler which gathers URL from many sources like common crawl, Wayback engine, etc.

reNgine also makes it possible for the use case like, “search the URLs that have extension .php and HTTP status is 200!”

Assume that, you are looking for open redirection, you can quickly search for =http and look for HTTP status 30X, this will give high accuracy of open redirection with minimal efforts.

Demo

Click below to watch the demo

Version 0.5 Release Teaser

Key Features

Vulnerability Scan using Nuclei, Subdomain Discovery, Ports Discovery, Endpoints Discovery, Directory Bruteforce, Visual Reconnaissance (Screenshot the targets)
IP Discovery, CNAME discovery, Subdomain Takeover Scan
Highly configurable scan engines
Run multiple scans in parallel
Run Clocked Scans (Run reconnaissance exactly at X Hours and Y minutes)
Run Periodic Scans (Runs reconnaissance every X minutes/hours/days/week)
Advanced lookup in Recon Results

What it is not

reNgine is not a:

Reconnaissance with high accuracy (No! reNgine, uses other open-source tools, to make this pipeline possible. The accuracy and capability of reNgine is also dependent on those tools)
Speed oriented recon framework with immediate results

Screenshots

Scan results

Gathered Endpoints

Of course, at this point, reNgine does not give the best of the best result compared to other tools, but reNgine has certainly minimal efforts. Also, I am continuously adding new features. You may help me on this journey by creating a PR filled with new features and bug fixes. Please have a look at the Contributing section before doing so.