Parametrised CLI generator for 30+ pentest tools across 9 categories - pick the tool, fill the target, copy the command or download a runnable shell script.
Recon Command Builder turns the wall-of-flags problem into a one-pick / copy-paste workflow. Choose a tool from 30+ standards across subdomain discovery, port scanning, HTTP probing, web crawling, fuzzing, vulnerability scanning, exploitation, brute force, hash cracking, secret hunting and TLS - and the tool emits the canonical command for the task with your inputs already substituted into the placeholders.
Every tool ships with a curated recipe library (passive scan, bulk-from-list, recursive, through-proxy, with-auth-cookie, rate-limited, JSON output, etc.) so the right invocation for what you’re actually doing is one click away. Wordlist paths are pre-populated with SecLists defaults, the proxy field is wired for Burp at 127.0.0.1:8080, and a polite X-Bug-Bounty header field is right there as a reminder.
Output options: copy a single recipe, copy all visible recipes (filterable by keyword), or download the whole tool’s recipe set as a runnable .sh script with comments. Every command runs locally on your machine - no traffic ever leaves our servers.
{URL}, {DOMAIN}, {TARGET}, {WORDLIST}, {THREADS}, {RATE}, {OUTFILE}, {PROXY}, {COOKIE}, {HEADER} - all substituted live as you edit.set -euo pipefail and a comment per recipe.No - this is a client-side generator. Every command is built in your browser. You then run it on a machine you control, against targets you are explicitly authorised to test (bug-bounty scope or signed pentest engagement).
Defensive scripting default: -e aborts on the first non-zero exit, -u errors on unset variables, and pipefail makes a failure anywhere in a pipe break the whole chain. Comment it out if you want individual recipes to keep going on failure.
SecLists installed at the canonical /usr/share/seclists/... Kali / Debian path. Replace with your own paths if you keep wordlists elsewhere.
Anything that runs shell on the target (sqlmap --os-shell, hashcat against captured creds, hydra password sprays). These are flagged in the UI; only run them against systems you have explicit authorisation to test.