ReconX-Astra

ReconX-Astra is a browser-based passive reconnaissance and OSINT intelligence extension built to analyze the website you are currently visiting and organize the results into a structured, category-based view. Instead of presenting raw technical data in an unfiltered stream, it separates findings into focused sections covering infrastructure, DNS intelligence, WHOIS details, JavaScript exposure, technology fingerprints, subdomain patterns, passive template matches, and overall risk. Based on the provided package description, the extension operates as an autonomous passive analysis suite inside the browser, helping users review how a site is built and what signals it exposes during normal browsing.

After page navigation is complete, ReconX-Astra automatically observes the current site and gathers a passive snapshot of available indicators. This includes the current URL, hostname, page title, a limited portion of the HTML for pattern matching, meta tags, JavaScript global objects, inline scripts, selected external JavaScript content, cookies, linked resource URLs, iframe sources, and response headers for the main page request. These signals are sent through a background analysis pipeline that processes the collected data through multiple specialized modules. The result is a broad but passive overview of a site’s structure, technologies, and publicly exposed clues without active scanning, fuzzing, or exploitation.

The infrastructure-focused analysis looks for indicators related to IP context, ASN-related information, CDN and WAF presence, cloud hosting hints, and TLS-related signals. The DNS module performs DNS-over-HTTPS lookups for common record types such as A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, and PTR, while also identifying security-relevant TXT entries including SPF, DMARC, and DKIM indicators. When a WhoisXMLAPI key is configured, the WHOIS module can retrieve domain registration details and calculate domain age from creation dates. Together, these components help users understand who may operate a domain, how long it has existed, and what infrastructure or protection layers may be associated with it.

A central strength of the extension is its JavaScript intelligence capability. ReconX-Astra examines inline and selected external JavaScript for patterns that may reveal operational details, such as emails, developer references, repository links, API endpoints, GraphQL endpoints, internal paths, and possible key-like values including AWS, GCP, Azure-related, and generic API key patterns. It also fingerprints technologies by analyzing headers, HTML, cookies, meta tags, and JavaScript globals to identify likely frameworks, CMS platforms, libraries, analytics tools, payment-related SDKs, and other integrations. In addition, it performs passive template matching inspired by Nuclei-style fingerprints and extracts likely subdomains from JavaScript text, content security policy data, certificate subject alternative names, linked resource hosts, iframe sources, and CNAME chains.

Key Features:
- Passive collection of current-page signals including HTML snippets, meta tags, cookies, scripts, linked resources, iframe sources, and response headers.
- Multi-module analysis covering infrastructure clues, DNS records, WHOIS details, JavaScript intelligence, technology fingerprinting, subdomain patterns, and risk scoring.
- JavaScript inspection for publicly exposed indicators such as emails, repository references, API endpoints, GraphQL endpoints, internal paths, and possible key patterns.
- DNS-over-HTTPS support for common record types, with visibility into security-related TXT data such as SPF, DMARC, and DKIM indicators.
- Optional integrations with VirusTotal, Shodan, and WhoisXMLAPI when users provide their own API keys in settings.
- Structured popup interface with categorized tabs including Overview, Infra, DNS, WHOIS, JS Intel, Tech, VirusTotal, Shodan, Nuclei, Subdomains, Risk, and Export.
- Export support for structured reports in JSON, Markdown, or clipboard-ready format for documentation and sharing.

How It Works:
1. After a page finishes loading, the extension captures passive information from the current site, including selected page content, scripts, cookies, resources, iframes, and main-frame response headers.
2. The collected snapshot is sent to a background pipeline that stores and processes the data locally through multiple analysis stages.
3. Core modules review infrastructure hints, perform DNS-over-HTTPS lookups, and optionally retrieve WHOIS details when a supported API key is available.
4. The extension analyzes inline and selected external JavaScript, fingerprints visible technologies, and applies passive pattern matching against existing response data.
5. It extracts likely subdomain clues from available sources such as JavaScript text, CSP data, linked hosts, iframe sources, and related records.
6. Findings from all modules are combined into a structured report with categorized tabs, summary cards, a risk score, and severity labeling.
7. Users can refresh the analysis, manage settings, clear cached results, and export the final report in supported output formats.

Privacy: - This extension collects browsing data to improve user experience. Based on the package description, it reads the current page’s URL, HTML snippet, meta tags, cookies, scripts, resource URLs, iframe URLs, and response headers to perform analysis. Results are stored locally using chrome.storage.local, and API keys for optional services are stored locally and sent only to their respective providers when those integrations are used.