NetRecon is a browser-based security toolkit for pentesters, sysadmins, and security researchers. Nmap scanning, DNS recon, WHOIS, SSL inspection, port scanning, CVE lookup, subdomain enumeration, and more — all without leaving your browser.
Every tool stores results in scan history. Copy or export to JSON with one click.
The companion server handles OS-level operations. The extension is the UI. Both run locally.
~/netrecon and avoids macOS sandbox restrictions on the Downloads folder:~/netrecon — the folder you extracted in step 3. This is the folder that contains manifest.json. The NetRecon icon will appear in your Chrome toolbar once loaded.chrome://extensions, then run:node -v
~/netrecon — the folder you extracted in step 3. This is the folder that contains manifest.json. The NetRecon icon will appear in your Chrome toolbar once loaded.chrome://extensions, then run:node -v
nmap --version
netrecon folder somewhere permanent — for example C:\netrecon. Dependencies are pre-bundled, no npm install needed.netrecon folder — wherever you moved it in step 3 (e.g. C:\netrecon). This is the folder that contains manifest.json. The NetRecon icon will appear in your Chrome toolbar once loaded.chrome://extensions. Open Command Prompt as Administrator in your netrecon folder and run:Bugs squashed and fixes shipped. Re-download the zip to get the latest version.
/shutdown endpoint. The stop button now falls back to a native messaging force-kill (lsof -ti tcp:31337 | xargs kill -9) if the server is still alive after the graceful attempt — works against any version.
node install.js <ext-id> re-registers the native host after extracting a new zip. Kill the old process first: pkill -f companion-server.js, then click ▶ Start.
/opt/homebrew/bin/nmap, /usr/local/bin/nmap, /usr/bin/nmap, etc.) at startup and spawns nmap using its absolute path — no longer dependent on PATH inheritance from Chrome.
http://127.0.0.1:31337/health to see which nmap binary the server found, making path issues easier to diagnose.
PATH that omits Homebrew (/opt/homebrew/bin) and /usr/local/bin.
The server now prepends these paths at startup so nmap is found regardless of how the server was launched.
error and close events — the done message was reaching the UI last and wiping the error. Added an errorSent guard to both nmap and port-scan handlers so close is silenced after an error.
/health for up to 4 seconds after spawning the companion server, only reporting success once it gets a 200 response. If the server doesn't come up in time it returns the last few lines of the log file as a hint.
icons/icon16.png, icon48.png, and icon128.png.
node_modules were not included in the zip. Dependencies are now pre-bundled — no npm install step needed.
node install.js.
macOS applies a TCC sandbox restriction on the Downloads folder that blocks Node.js from reading its own working directory. Instructions updated — move the folder to ~/netrecon before running the installer.