Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Recon

Expand scope from Content-Security-Policy headers

Discover related domains from Content-Security-Policy headers.

Agent
Expand scope from CSP headersFilter results to in-scope domainsSweep a CIDR for policies

overview

What csprecon does

Use csprecon when subdomain tools plateau and you still need sibling properties, CDNs, or vendor hosts named in live CSP directives.

Feed -url for one target or -list for many. Keep results in scope with -domain, sweep a block with -cidr, and emit -json for the rest of the pipeline.

Merge CSP-derived hosts with subfinder output, then probe the combined set with httpx. The managed node writes a file and folder with -json for downstream steps.

source github.com/edoardottt/csprecon

use cases

Where csprecon fits

Expand scope from CSP headers

Parse the Content Security Policy of known assets to surface related domains, CDNs, and third-party services that subdomain enumeration alone would miss.

Filter results to in-scope domains

Apply a domain filter so the discovered set keeps only the properties that belong to the organization you are assessing.

Sweep a CIDR for policies

Treat the input as CIDR to pull CSP-referenced domains across a network block in one run.

Feed structured results downstream

Emit JSON so the new domains merge cleanly into the rest of the attack-surface workflow for probing and scanning.

reference

csprecon inputs and flags

11 inputs
NameTypeFlagDescription
urlSTRING-urlTarget domain whose CSP header csprecon reads.
listFILE-listFile of domains to read CSPs from in bulk.
domainSTRING-domainKeep only results inside these comma-separated domains.
jsonBOOLEAN-jsonEmit results as structured JSON.
cidrBOOLEAN-cidrTreat the input as a CIDR range and sweep it.
silentBOOLEAN-silentPrint only results, with no banner.
rate-limitSTRING-rate-limitCap requests sent per second.
concurrencySTRING-concurrencyParallel workers to run (default 50).

Showing key inputs. csprecon exposes 11 inputs in total.

Full flag reference (11 inputs)
NameTypeFlagDescription
urlSTRING-urlInput domain
cidrBOOLEAN-cidrInterpret input as CIDR
jsonBOOLEAN-jsonJSON output
listFILE-listFile containing input domains
proxySTRING-proxySet a proxy server (URL)
domainSTRING-domainFilter results belonging to these domains (comma separated)
silentBOOLEAN-silentSilent output. Print only results
timeoutSTRING-timeoutConnection timeout in seconds (default 10)
verboseBOOLEAN-verboseVerbose output
rate-limitSTRING-rate-limitSet a rate limit (per second)
concurrencySTRING-concurrencyConcurrency level (default 50)

example

Run csprecon

csprecon · command
# fetch a target's CSP and list the domains it referencescsprecon -url example.com -silent
sample output
cdn.example.comstatic.example.comassets.example.netapi.example.commedia.example.orgfonts.example.netuploads.example.comtracking.example.org

guidance

Choosing csprecon

Use csprecon to widen an organization domain footprint from CSP headers, a source passive subdomain tools do not cover. Run it next to subfinder rather than instead of it, then probe the combined set with httpx.

subfinder

Passive subdomain discovery from many sources. csprecon adds CSP-derived domains it does not see.

analyticsrelationships

Related domains via shared analytics IDs. A different pivot toward the same goal.

amass

Deep OSINT mapping of an organization footprint. Broader than a focused CSP pass.

faq

csprecon questions

It requests the target over HTTP, reads the Content-Security-Policy header, and extracts hosts from directives such as script-src, connect-src, and frame-src. Each unique host becomes a result. Pass -url for one target or -list for many.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run csprecon yourself

A domain feeds csprecon, which parses its CSP header for related domains and passes them to httpx so only live ones land as output.

Open csprecon in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.