loading
Loading content
loading
Recon
Discover related domains from Content-Security-Policy headers.
overview
Use csprecon when subdomain tools plateau and you still need sibling properties, CDNs, or vendor hosts named in live CSP directives.
Feed -url for one target or -list for many. Keep results in scope with -domain, sweep a block with -cidr, and emit -json for the rest of the pipeline.
Merge CSP-derived hosts with subfinder output, then probe the combined set with httpx. The managed node writes a file and folder with -json for downstream steps.
use cases
Parse the Content Security Policy of known assets to surface related domains, CDNs, and third-party services that subdomain enumeration alone would miss.
Apply a domain filter so the discovered set keeps only the properties that belong to the organization you are assessing.
Treat the input as CIDR to pull CSP-referenced domains across a network block in one run.
Emit JSON so the new domains merge cleanly into the rest of the attack-surface workflow for probing and scanning.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -url | Target domain whose CSP header csprecon reads. |
| list | FILE | -list | File of domains to read CSPs from in bulk. |
| domain | STRING | -domain | Keep only results inside these comma-separated domains. |
| json | BOOLEAN | -json | Emit results as structured JSON. |
| cidr | BOOLEAN | -cidr | Treat the input as a CIDR range and sweep it. |
| silent | BOOLEAN | -silent | Print only results, with no banner. |
| rate-limit | STRING | -rate-limit | Cap requests sent per second. |
| concurrency | STRING | -concurrency | Parallel workers to run (default 50). |
Showing key inputs. csprecon exposes 11 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -url | Input domain |
| cidr | BOOLEAN | -cidr | Interpret input as CIDR |
| json | BOOLEAN | -json | JSON output |
| list | FILE | -list | File containing input domains |
| proxy | STRING | -proxy | Set a proxy server (URL) |
| domain | STRING | -domain | Filter results belonging to these domains (comma separated) |
| silent | BOOLEAN | -silent | Silent output. Print only results |
| timeout | STRING | -timeout | Connection timeout in seconds (default 10) |
| verbose | BOOLEAN | -verbose | Verbose output |
| rate-limit | STRING | -rate-limit | Set a rate limit (per second) |
| concurrency | STRING | -concurrency | Concurrency level (default 50) |
example
# fetch a target's CSP and list the domains it referencescsprecon -url example.com -silentcdn.example.comstatic.example.comassets.example.netapi.example.commedia.example.orgfonts.example.netuploads.example.comtracking.example.orgguidance
Use csprecon to widen an organization domain footprint from CSP headers, a source passive subdomain tools do not cover. Run it next to subfinder rather than instead of it, then probe the combined set with httpx.
Passive subdomain discovery from many sources. csprecon adds CSP-derived domains it does not see.
Related domains via shared analytics IDs. A different pivot toward the same goal.
Deep OSINT mapping of an organization footprint. Broader than a focused CSP pass.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds csprecon, which parses its CSP header for related domains and passes them to httpx so only live ones land as output.
Facts on this page come from the live Trickest tool library.