A fast desktop recon tool that maps your external footprint, finds what's exposed, and grades your risk — then watches it for changes.
Point it at a domain and it runs the full toolchain — discovery, exposure, and a graded verdict.
Subdomains, ports, TLS, DNS/email posture and web checks rolled into ranked findings with an A–F grade.
Passive OSINT + CT logs, DNS brute force and permutations — de-duplicated and takeover-checked.
Passively fingerprints tech + versions and matches them against a refreshable NVD-derived ruleset.
Scans HTML + first-party JS for leaked keys and probes for .git/.env/dashboards — masked, tuned to cut false-positive noise.
Finds public S3/GCS/Azure buckets and registered typosquat domains before someone else does.
Same-host, GET-only spider maps every page + form so the checks see the whole site, not just the root.
Re-scan on a schedule and get a Slack/Teams/email alert the moment your surface changes.
Replay a session to scan behind a login — credentials encrypted at rest in your OS keychain.
Shareable HTML/CSV, run history with grade trends, and per-product breakdowns for multi-asset orgs.
Findings carry a stable identity across scans, so the ticket you open today re-attaches itself on every rescan — and you never log the same issue twice.
| Sev | Finding | Days open | Ticket |
|---|---|---|---|
| critical | RDP exposed on port 3389 | 90 | — |
| high | Missing HSTS | 90 | SEC-742 · in progress |
| medium | DMARC policy is p=none | 90 | SEC-750 · open |
crow-recon findings --older-than 30 --no-ticket --severity critical --fail-on fails the build when a critical goes a month untracked.Not just a desktop app — a scriptable CLI that drops straight into CI/CD and your own tooling.
# emit JSON for your pipeline $ crow-recon audit example.com --json > surface.json # exits non-zero on a D/F grade — fail the build on a regression $ crow-recon audit example.com && ./deploy.sh # save + diff + alert on any change $ crow-recon audit example.com --save-report nightly --alert
Crow Recon folds the best OSINT & Certificate-Transparency feeds into one de-duplicated result — free sources out of the box, plus your own API keys for the premium ones.
Bring your own keys — stored locally with owner-only permissions, and only ever sent to the service that issued them.
The scanner is free forever. Pro makes it continuous, authenticated, and automation-ready.
| Capability | Free | Pro |
|---|---|---|
| Full audit, CVE, secrets, buckets, typosquat | ✓ | ✓ |
| Reports + diff any two runs (HTML/CSV) | ✓ | ✓ |
| Root domains per scan | 3 | unlimited |
| Site crawler | 25 pages | unlimited |
| Continuous monitoring + change alerts | — | ✓ |
| Scan-diff history + grade trends | last 5 runs | unlimited |
| Authenticated scope (scan behind a login) | — | ✓ |
| Finding tickets + aging board (duplicate-safe) | — | ✓ |
Free, no account required. Signed builds are coming soon for macOS, Windows and Linux.
Authorized use only — scan only assets you own or have explicit permission to test.