Raccoon: reconnaissance and vulnerability scanning


Raccoon is a tool made for reconnaissance and information gathering with an emphasis on simplicity.
It will do everything from fetching DNS records, retrieving WHOIS information, obtaining TLS data, detecting WAF presence and up to threaded dir busting and subdomain enumeration. Every scan outputs to a corresponding file.

As most of Raccoon’s scans are independent and do not rely on each other’s results, it utilizes Python’s asyncio to run most scans asynchronously.

Raccoon supports Tor/proxy for anonymous routing. It uses default wordlists (for URL fuzzing and subdomain discovery) from the amazing SecLists repository but different lists can be passed as arguments.

  •  DNS details
  •  DNS visual mapping using DNS dumpster
  •  WHOIS information
  •  TLS Data – supported ciphers, TLS versions, certificate details and SANs
  •  Port Scan
  •  Services and scripts scan
  •  URL fuzzing and directory detection
  •  Subdomain enumeration – uses Google Dorking, bruteforce and SAN discovery
  •  Web application data (CMS, Web Server info, robots & sitemap extraction)
  •  Detects known WAFs
  •  Supports anonymous routing through Tor/Proxies
  •  Uses asyncio for improved performance
  •  Saves output to files – separates targets by folders and modules by files


pip install raccoon-scanner


Usage: raccoon [OPTIONS]

  -t, --target TEXT              Target to scan  [required]
  -d, --dns-records TEXT         Comma separated DNS records to query.
                                 Defaults to: A, MX, NS, CNAME, SOA
  --tor-routing                  Route HTTP traffic through Tor. Slows total
                                 runtime significantly
  --proxy-list TEXT              Path to proxy list file that would be used
                                 for routing HTTP traffic. A proxy from the
                                 list will be chosen at random for each
                                 request. Slows total runtime
  --proxy TEXT                   Proxy address to route HTTP traffic through.
                                 Slows total runtime
  -w, --wordlist TEXT            Path to wordlist that would be used for URL
  -T, --threads INTEGER          Number of threads to use for URL
                                 Fuzzing/Subdomain enumeration. Default: 25
  --ignored-response-codes TEXT  Comma separated list of HTTP status code to
                                 ignore for fuzzing. Defaults to:
  --subdomain-list TEXT          Path to subdomain list file that would be
                                 used for enumeration
  -f, --full-scan                Run Nmap scan with both -sV and -sC
  -S, --scripts                  Run Nmap scan with -sC flag
  -s, --services                 Run Nmap scan with -sV flag
  -p, --port TEXT                Use this port range for Nmap scan instead of
                                 the default
  --tls-port INTEGER             Use this port for TLS queries. Default: 443
  --no-health-check              Do not test for target host availability
  -fr, --follow-redirects        Follow redirects when fuzzing. Default: True
  --no-url-fuzzing               Do not fuzz URLs
  --no-sub-enum                  Do not bruteforce subdomains
  -q, --quiet                    Do not output to stdout
  -o, --outdir TEXT              Directory destination for scan output
  --help                         Show this message and exit.

Copyright (c) 2018 Evyatar Meged

Source: https://github.com/evyatarmeged/


Read more…

Anastasis Vasileiadis

PC Technical || Penetration Tester || Ethical Hacker || Cyber Security Expert || Cyber Security Analyst || Information Security Researcher || Malware analyst || Malware Investigator || Reverse Engineering

Leave a Reply

SC ProDefence SRL - Cyber Security Services