otlite · Web and records

Install FinalRecon on Linux or macOS in one command

FinalRecon runs a set of web recon checks against a URL in one go: headers, SSL certificate, WHOIS, crawler, DNS, subdomains, directory search, and a port scan. The --full flag runs everything.

FinalRecon in three lines

pipx install otlite
otlite install finalrecon
otlite run finalrecon -- url:https://example.com

Runs thewhiteh4t/FinalRecon (MIT, ★ 3k, otlite 1.2.1, catalog updated Oct 23, 2026). otlite installs and runs it at a tested version; it does not change or verify the tool itself.

What FinalRecon is for

A first look at a site before deeper tools.
A single report with the basics for a case.

Typed inputs for FinalRecon

otlite translates these prefixes into FinalRecon's own flags. Anything else after -- is passed through unchanged, so every original flag still works.

url:: URL · otlite run finalrecon -- url:https://example.com

Run every installed tool that takes the same input at once: otlite run --all url:https://example.com

Where the results go

Every run lands under ./results/finalrecon/<target>/ as a timestamped output file, a .meta.json sidecar (the exact command, start and end time, exit code, and the SHA-256 of the output), and a .envelope.json with the entities found, in the same shape for every tool. List runs with otlite results, group them with --case, compare the last two with otlite diff finalrecon <target>, and pull indicators out with otlite extract finalrecon.

Before you run it

Directory search and port scan are active. Use the passive modules on targets you do not own.
Some modules take API keys in its own config.

Update, remove, inspect

otlite info finalrecon      # inputs, keys, an example command
otlite example finalrecon   # sample output, where there is one
otlite update finalrecon    # move to the next tested version
otlite remove finalrecon    # delete its virtualenv

Full reference: the otlite docs, and the tool's own README on GitHub.

Pairs with

SpiderFoot

SpiderFoot runs two hundred-odd modules against a domain, IP, email, or username and links what they return into one graph.

BBOT

BBOT is a recursive scanner that starts from a domain or IP, discovers subdomains, hosts, and services, and feeds each finding back in as a new target.

ctfr

ctfr lists the subdomains of a domain by reading Certificate Transparency logs through crt.sh.

FAQ

FinalRecon with otlite, answered

How do I install FinalRecon on Kali, Ubuntu, or macOS?

Install otlite once with pipx install otlite (or the one-line installer on the otlite page), run otlite init, then otlite install finalrecon. The tool lands in its own virtualenv under ~/.otlite/, pinned to a version that was tested, so nothing touches your system Python. otlite doctor prints the command that fixes a missing git or venv module.

Which inputs does FinalRecon take through otlite?

url: (url). otlite maps each prefix to FinalRecon's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.

Where does otlite save FinalRecon results?

Under ./results/finalrecon/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar (the exact command, timing, exit code, and SHA-256) and a .envelope.json with the entities found. Add --case <name> to group runs, otlite results to list them, and otlite diff finalrecon <target> to compare the last two.

Does FinalRecon need an API key or a login?

No key is required for the basic run. Some modules take API keys in its own config.

Can I run FinalRecon together with other tools?

Yes. otlite run --all url:https://example.com runs every installed tool that takes url input, in parallel, including FinalRecon. Save the combination as a playbook to repeat it.