What's in the box #2: Eclipse-Recon

As in our earlier installation in the series "What's in the box !?” we are looking into tools and techniques genuine Chinese pen-testers and red-teamers are using in real life scenarios. Although in China the usual tools like Burp, Recon-Ng, Xray etc. are all very much in use as well, sometimes we come across professional or interesting tooling that we haven't seen before and might also be novel to our audience.

Originally we found this system on an unsecured web directory via Hunt.io which held material used by an pen-test operation against ‘buyeast.com’. The IP was associated with the domain ‘cyberxhack.top’. This could be a reference to to this 'hacker for hire’ platform, but seems a stretch. Judging by the files we found on the directory, this was a deliberate pen-test, most likely authorized. How did the material end on the unsecured web directory !? We don't really know. But it held some other interesting elements.

One entity that immediately caught our attention was the source code for a software named ‘Eclipse-Recon’. Mainly programmed in Go it is a web vulnerability scanner and tracking platform. On first glance it seemed like a common web vulnerability scanner ( of which there are dozens these days ), but by closer inspection it has much more under the hood. The project consists of a back-end and a React/Vite front-end, with an SQL database and Redis support.

It combines task orchestration, asset management, HTTP/S response, service fingerprint and PoC-libraries, proxy pools, mapping API configuration, and MCP capabilities and many more features in a single solution.