Rekono : Execute Full Pentesting Processes Combining Multiple Hacking Tools Automatically

Rekono combines other hacking tools and its results to execute complete pentesting processes against a target in an automated way. The findings obtained during the executions will be sent to the user via email or Telegram notifications and also can be imported in Defect-Dojo if an advanced vulnerability management is needed. Moreover, Rekono includes a Telegram bot that can be used to perform executions easily from anywhere and using any device.

Features

• Combine hacking tools to create pentesting processes
• Execute pentesting processes
• Execute pentesting tools
• Review findings and receive them via email or Telegram notifications
• Use Defect-Dojo integration to import the findings detected by Rekono
• Execute tools and processes from Telegram Bot
• Wordlists management

Why Rekono?

Do you ever think about the steps that you follow when start a pentesting? Probably you start performing some OSINT tasks to gather public information about the target. Then, maybe you run hosts discovery and ports enumeration tools. When you know what the target exposes, you can execute more specific tools for each service, to get more information and maybe, some vulnerabilities. And finally, if you find the needed information, you will look for a public exploit to get you into the target machine. I know, I know, this is an utopic scenario, and in the most cases the vulnerabilities are found due to the pentester skills and not by scanning tools. But before using your skills, how many time do you spend trying to get as information as possible with hacking tools? Probably, too much.

Why not automate this process and focus on find vulnerabilities using your skills and the information that Rekono sends you?

Supported tools

• theHarvester
• EmailHarvester
• EmailFinder
• Nmap
• Sslscan
• SSLyze
• SSH Audit
• SMBMap
• Dirsearch
• GitLeaks & GitDumper
• Log4j Scanner
• CMSeeK
• OWASP JoomScan
• OWASP ZAP
• Nikto
• SearchSploit
• Metasploit

Thanks to all the contributors of these amazing tools!

Installation

Docker

Execute the following commands in the root directory of the project:

docker-compose build
docker-compose up -d

If you need more than one tool running at the same time, you can set the number of executions-worker instances:

docker-compose up -d –scale executions-worker=5

Using Rekono CLI

If your system is Linux, you can use rekono-cli to install Rekono in your system

pip3 install rekono-cli
rekono install

Configuration

You can configure Rekono using two main methods: config.yaml file and environemnt variables. The properties will be obtained in the following priority:

1. From environment variables
2. From configuration file. You can use the config.yaml as template
3. Default value

Rekono supports the following properties:

Environment Variable	Configuration Property	Default Value	Description
REKONO_HOME	N/A	/opt/rekono or where the source code lives	Path to the Rekono home
RKN_FRONTEND_URL	frontend.url	http://127.0.0.1:3000	URL used to include links to the Rekono frontend in the notifications
RKN_DB_NAME	database.name	rekono	Database name
RKN_DB_USER	database.user	N/A	Database user
RKN_DB_PASSWORD	database.password	N/A	Database password
RKN_DB_HOST	database.host	127.0.0.1	Database host
RKN_DB_PORT	database.port	5432	Database port
RKN_RQ_HOST	rq.host	127.0.0.1	Redis Queue host
RKN_RQ_PORT	rq.port	6379	Redis Queue port
RKN_EMAIL_HOST	email.host	127.0.0.1	SMTP host
RKN_EMAIL_PORT	email.port	587	SMTP port
RKN_EMAIL_USER	email.user	N/A	SMTP user
RKN_EMAIL_PASSWORD	email.password	N/A	SMTP password
RKN_TELEGRAM_BOT	telegram.bot	Rekono	Telegram Bot name to be included in the frontend
RKN_TELEGRAM_TOKEN	telegram.token	N/A	Telegram Bot token. How to get one?
RKN_DD_URL	defect-dojo.url	http://127.0.0.1:8080	Defect-Dojo URL
RKN_DD_API_KEY	defect-dojo.api-key	N/A	Defect-Dojo API key
N/A	defect-dojo.verify	True	Indicate if Defect-Dojo certificate should be verified
N/A	defect-dojo.tags	[rekono]	Tags included in the items created by Rekono in Defect-Dojo
N/A	defect-dojo.product-type	Rekono Project	Product type naem related to products created by Rekono in Defect-Dojo
N/A	defect-dojo.test-type	Rekono Findings Import	Test type name related to tests created by Rekono in Defect-Dojo
N/A	defect-dojo.test	Rekono Test	Test name related to findings imported by Rekono in Defect-Dojo
RKN_OTP_EXPIRATION_HOURS	security.otp-expiration-hours	24	Expiration time in hours for One Time Passwords created by Rekono
RKN_UPLOAD_FILES_MAX_MB	security.upload-files-max-mb	500	MB limit for files uploaded to Rekono. For example, wordlists files
RKN_TRUSTED_PROXY	N/A	False	Indicate if Rekono is running with a trusted reverse proxy
RKN_ALLOWED_HOSTS	security.allowed-hosts	[localhost, 127.0.0.1, ::1]	Hosts allowed to access Rekono
RKN_SECRET_KEY	security.secret-key	Generated randomly	Security key used to sign JWT tokens

To configure also the Rekono frontend based on the previous properties, you can run the following command:

This command will add this properties to the rekono/frontend/.env file:

• VUE_APP_DEFECTDOJO: Enable or disable Defect-Dojo integration features in the frontend
• VUE_APP_DEFECTDOJO_URL: Defect-Dojo URL
• VUE_APP_TELEGRAM_BOT: Name of the Telegram Bot to be displayed in the UI

Of course, you can also configure this properties in the rekono/frontend/.env file directly