pi-recon

Pi extension for red-team recon and asset discovery. 14 tools: ICP lookup, subdomain enum, DNS/cert/ASN, asset search (Shodan/FOFA/Hunter/Quake), port scan, web probe, dir brute, backup finder, 403 bypass, vuln check, JS analysis.

Packages

Package details

extension

Install pi-recon from npm and Pi will load the resources declared by the package manifest.

npm repohome report
$ pi install npm:pi-recon
Package
pi-recon
Version
1.0.5
Published
Aug 12, 2026
Downloads
294/mo · 68/wk
Author
xxxxkkka
License
MIT
Types
extension
Size
1.2 MB
Dependencies
0 dependencies · 4 peers
Pi manifest JSON
{
  "extensions": [
    "./index.ts"
  ]
}

Security note

Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.

README

pi-recon

Red-team recon & asset discovery plugin for Pi Coding Agent — 14 pure Node.js tools, zero external dependencies.

中文文档

Tools (14)

Tool Description Phase
icp_lookup ICP备案 + Tianyancha + Baidu → domains Target Resolution
subdomain_enum Subdomain enumeration (DNS brute + cert transparency / crt.sh) Domain Discovery
dns_enum DNS record enumeration (A / AAAA / CNAME / MX / NS / TXT / SOA) Domain Discovery
whois_lookup WHOIS lookup Domain Discovery
cert_search SSL certificate transparency search (crt.sh) Domain Discovery
asn_lookup ASN / IP range lookup Domain Discovery
asset_search Shodan + FOFA + Hunter + Quake asset search Asset Mapping
port_scan Web port scan (pure net.connect) Service Discovery
web_probe HTTP/HTTPS service probe + fingerprinting (10,000+ rules) Service Discovery
dir_brute Directory brute force Deep Probing
backup_finder Backup file discovery (.bak / .zip / .git / .svn / .env) Deep Probing
bypass_403 403 bypass (path normalization attacks) Deep Probing
vuln_check Vuln checks — shortname / log4shell / viewstate / sharepoint / apidocs / aclbypass Vuln Checks
js_analyzer JavaScript static analysis (endpoints / secrets / hidden paths) Analysis

Install

# npm (recommended)
pi install npm:pi-recon

# Git
pi install git:github.com/Xaaaa-bip/pi-recon

# Local
pi install ./pi-recon

# Temp run
pi --extensions ./pi-recon

Config

Create ~/.pi/recon-config.json:

{
  "shodanKey": "your-shodan-key",
  "fofaEmail": "your-fofa-email",
  "fofaKey": "your-fofa-key",
  "hunterKey": "your-hunter-key",
  "quakeKey": "your-quake-key",
  "otxKey": "your-otx-key",
  "tianyanchaToken": "your-tianyancha-token",
  "callbackServer": "dns://xxx.callback.red"
}

Or via env vars: SHODAN_KEY FOFA_EMAIL FOFA_KEY HUNTER_KEY QUAKE_KEY OTX_KEY TIANYANCHA_TOKEN CALLBACK_SERVER

Usage

/recon <company|domain|IP>

Activates the FastTortoise pipeline:

  1. Company → icp_lookup (parallel)
  2. All domains → subdomain_enum + asset_search (parallel)
  3. Discovered IPs → asset_search(host) (parallel)
  4. Live hosts → port_scan + web_probe
  5. All web servers → vuln_check (parallel)
  6. High-value targets → dir_brute + backup_finder + js_analyzer

Tech Stack

  • Pure Node.js, zero npm dependencies
  • 10,000+ fingerprint rules (finger-data.json)
  • Chrome 131 User-Agent
  • Auto wildcard DNS detection
  • Aggressive concurrency defaults for red-team speed

Links