Arsenly
Tools
Free Tools
Pricing
Resources
Sign in Get started
← All tools

Recon Command Builder

Payloads & Wordlists

Parametrised CLI generator for 30+ pentest tools across 9 categories - pick the tool, fill the target, copy the command or download a runnable shell script.

What is Recon Command Builder?

Recon Command Builder turns the wall-of-flags problem into a one-pick / copy-paste workflow. Choose a tool from 30+ standards across subdomain discovery, port scanning, HTTP probing, web crawling, fuzzing, vulnerability scanning, exploitation, brute force, hash cracking, secret hunting and TLS - and the tool emits the canonical command for the task with your inputs already substituted into the placeholders.

Every tool ships with a curated recipe library (passive scan, bulk-from-list, recursive, through-proxy, with-auth-cookie, rate-limited, JSON output, etc.) so the right invocation for what you’re actually doing is one click away. Wordlist paths are pre-populated with SecLists defaults, the proxy field is wired for Burp at 127.0.0.1:8080, and a polite X-Bug-Bounty header field is right there as a reminder.

Output options: copy a single recipe, copy all visible recipes (filterable by keyword), or download the whole tool’s recipe set as a runnable .sh script with comments. Every command runs locally on your machine - no traffic ever leaves our servers.

Tool catalog

  • Subdomain discovery - subfinder, amass, assetfinder, shuffledns, dnsx.
  • Port / network - nmap (top-1000, all-TCP, vuln NSE, http-enum), naabu, rustscan, masscan.
  • HTTP probing - httpx with status / title / tech / screenshot recipes.
  • URL discovery / crawling - gau, waybackurls, katana (incl. headless), hakrawler, gospider.
  • Fuzzing - ffuf, gobuster, dirsearch, feroxbuster - dir, vhost, param, POST login, proxied, rate-limited.
  • Vulnerability scanning - nuclei (CVE / exposure / misconfig / bulk / JSON), nikto, wpscan, joomscan.
  • Exploitation - sqlmap (10 recipes incl. tamper / JSON body / cookie / OS shell), dalfox, kxss.
  • Auth brute force - hydra (SSH, FTP, HTTP form, RDP), medusa.
  • Hash cracking - hashcat (dict, rules, mask, hybrid, bcrypt, JWT, WPA), john.
  • Secrets - gitleaks, trufflehog (org / S3 / git).
  • TLS / SSL - testssl.sh, sslscan.
  • Pipeline utilities - qsreplace, anew, gf (sqli/xss/ssrf patterns), arjun, paramspider.
  • Placeholders - {URL}, {DOMAIN}, {TARGET}, {WORDLIST}, {THREADS}, {RATE}, {OUTFILE}, {PROXY}, {COOKIE}, {HEADER} - all substituted live as you edit.
  • Download as .sh - a runnable script with set -euo pipefail and a comment per recipe.

Where it fits in your workflow

  • Skip flag-hunting and ship the canonical command for whatever recon stage you’re at.
  • Standardise commands across a team or engagement and stash the .sh output as project artefacts.
  • Pipeline recipes (`subs.txt | httpx | gau | gf xss`) glue the tools together exactly the way bug bounty automation does.
Use Recon Command Builder

Sign in to access this tool.

Create free account Sign in

At a glance

CategoryPayloads & Wordlists
RunsIn your browser
Token cost Free - no tokens
Access Free
Status● Live

Frequently asked questions

Does it run the commands?

No - this is a client-side generator. Every command is built in your browser. You then run it on a machine you control, against targets you are explicitly authorised to test (bug-bounty scope or signed pentest engagement).

Why a <code>set -euo pipefail</code> header on the .sh download?

Defensive scripting default: -e aborts on the first non-zero exit, -u errors on unset variables, and pipefail makes a failure anywhere in a pipe break the whole chain. Comment it out if you want individual recipes to keep going on failure.

Where do the wordlist paths come from?

SecLists installed at the canonical /usr/share/seclists/... Kali / Debian path. Replace with your own paths if you keep wordlists elsewhere.

Is there a recipe that needs special caution?

Anything that runs shell on the target (sqlmap --os-shell, hashcat against captured creds, hydra password sprays). These are flagged in the UI; only run them against systems you have explicit authorisation to test.

Explore more tools →