reconftw_ai - GitLite

KO | EN

gitlite — search

#javascript #react #ai #go #android #rust #deep-learning #macos #windows #vue #security #mcp #openai #open-source

reconftw_ai

(★ 106)

AI/LLM local model integration for analysis of reconftw results

파일 탐색기

최종 버전 다운로드 (.zip)

LICENSE
prompts.json
README.md
reconftw_ai.py
requirements.txt

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/six2dez/reconftw_ai

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd reconftw_ai

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. 공식 설치 스크립트

쉬움 추천

curl https://ollama.ai/install.sh | sh

공식 설치 스크립트를 다운로드해서 바로 실행합니다. 이 한 줄로 필요한 게 자동으로 설치됩니다.

✅ 설치 후 새 터미널을 열고, 프로그램의 버전 확인 명령(예: --version)으로 정상 설치됐는지 확인하세요.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

3. Python

쉬움

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Python 3 설치 시 'Add Python to PATH' 옵션을 꼭 체크하세요 (Windows).

pip install -r requirements.txt

requirements.txt 등에 명시된 파이썬 라이브러리를 설치합니다.

✅ 에러 메시지 없이 실행되고 터미널에 안내 문구가 출력되면 정상입니다.

이 레포의 README에 적힌 실제 명령어를 그대로 가져왔습니다.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# ReconFTW-AI

Integrate a local LLM with ReconFTW to interpret pentesting results by category (tested with `mistral:7b`, `llama3:8b`, `deepseek-r1:8b`, and `qwen2.5-coder:latest`).

## 🧠 What does it do?

It analyzes ReconFTW outputs (`osint/`, `subdomains/`, `hosts/`, `webs/`) and generates a report using a local LLM, classifying the results based on the type of audience: executive, brief summary, or offensive bug bounty style. Prompts are loaded dynamically from a `prompts.json` file for easy customization.

## 📦 Installation

1. Install Ollama:
```bash
curl https://ollama.ai/install.sh | sh
```

2. Pull a model:
```bash
ollama pull llama3:8b  # or your preferred model
```

3. Install dependencies:
```bash
pip install -r requirements.txt
```

4. Ensure the `prompts.json` file is present in the working directory (included in the repository) or provide a custom prompts file.

## 🧪 Usage

Basic usage:
```bash
python reconftw_ai.py \
  --results-dir /path/to/reconftw_results \
  --output-dir /path/to/output \
  --model llama3:8b \
  --output-format md \
  --report-type bughunter \
  --prompts-file prompts.json
```

### Arguments:
- `--results-dir`: Input directory with `osint/`, `subdomains/`, `hosts/`, `webs/` (default: `./reconftw_output`)
- `--output-dir`: Where to save the report (default: `./reconftw_ai_output`)
- `--model`: Ollama model to use (default: `llama3`)
- `--output-format`: Output format: `txt` or `md` (default: `txt`)
- `--report-type`: Report style: `executive`, `brief`, or `bughunter` (default: `executive`)
- `--prompts-file`: JSON file containing prompt templates (default: `prompts.json`)

### Customizing Prompts
The `prompts.json` file defines the LLM prompts for each report type and category. You can modify it to tailor the output structure, tone, or focus. Example structure:
```json
{
  "executive": {
    "osint": "As a security analyst, create a 200-300 word executive summary...",
    ...
  },
  ...
}
```

## 🖥️ Minimum Hardware Requirements

### CPU-Only (Minimal Setup)
- **RAM**: 8 GB (for quantized 2B–7B models)
- **Processor**: 4-core or better
- **Storage**: 5–10 GB

### Recommended CPU Setup
- **RAM**: 16 GB or more (for LLaMA 3 8B / Mistral 7B)
- **Processor**: 8-core modern CPU
- **Storage**: 10–20 GB

### GPU Setup (Recommended for Speed)
- **RAM**: 8–16 GB system RAM
- **VRAM**:
  - 4 GB: Small models (Gemma 2B)
  - 6–8 GB: LLaMA 3 8B (quantized)
  - 12 GB+: LLaMA 13B
- **GPU**: NVIDIA GPU with CUDA (GTX 1060+)

### Notes
- Quantization (4-bit/8-bit) is highly recommended to save memory
- SSD recommended if ReconFTW output is large
- Works on Linux, macOS, and WSL

## ✅ Supported ReconFTW Categories
- `osint/`: leaks, credentials, GitHub, spoofing, etc.
- `subdomains/`: DNS, takeovers, bruteforce, cloud
- `hosts/`: IPs, ports, WAFs, vulnerabilities
- `webs/`: CMS, endpoints, JS, fuzzing, parameters
- `overview`: Global summary across all categories

## 📊 Report Types

### `--report-type executive`
> Tailored for CISOs, managers, and non-technical stakeholders. Provides 200-400 word summaries with 3-7 bullet points per category, focusing on business risks (e.g., financial, reputational).
```markdown
## SUBDOMAINS

**Summary**: The subdomain scan identified exposures that could lead to brand damage or data leaks.
- **Dangling DNS**: `admin-test.company.com` points to a non-existent S3 bucket, risking subdomain takeover.
- **CORS Misconfiguration**: `dev-api.company.com` allows any origin, potentially exposing sensitive data.
- **Impact**: Malicious actors could hijack assets or breach data.
- **Recommendation**: Remove unused DNS records, enforce strict CORS policies.
```

### `--report-type brief`
> A compact summary with exactly 5 bullet points per category, each 1-2 sentences, ranked by severity.
```markdown
## SUBDOMAINS

- **[1] S3 Takeover**: `admin-test.company.com` is vulnerable to takeover.
- **[2] CORS Misconfig**: `dev-api.company.com` allows `*` origins.
- **[3] Deprecated Subdomain**: Exposed outdated systems.
- **[4] Staging Exposure**: Unprotected staging environment detected.
- **[5] Recommendation**: Clean up DNS and monitor subdomains.
```

### `--report-type bughunter`
> Offensive-style output for pentesters or bug bounty hunters, with 300-500 word responses and 3-7 prioritized attack paths per category.
```markdown
## SUBDOMAINS

**Analysis**: The subdomain scan revealed exploitable misconfigurations.
- **Takeover**: `admin-test.company.com` (S3 bucket missing). Claim the bucket to host malicious content.
- **CORS**: `dev-api.company.com` allows `*`. Test for token leaks via `fetch()`.
- **Staging Endpoint**: Exposed admin interface; attempt auth bypass or XSS.
```

## 🤝 Contributions
Pull requests and issues are welcome! To contribute new prompts, update the `prompts.json` file and test with various ReconFTW outputs.