ReconSpectre: A Research-Integrated Hybrid Reconnaissance Framework for Empirical Attack-Surface Measurement

Reconnaissance represents the foundational phase of the cyber attack lifecycle, directly shaping the effectiveness of exploitation, privilege escalation, and persistence. Despite its strategic importance, reconnaissance is rarely treated as a scientifically measurable process. Most existing tools prioritize operational efficiency over methodological transparency, making them unsuitable for empirical cybersecurity research. This paper presents ReconSpectre, a research-integrated hybrid reconnaissance framework designed to transform reconnaissance into a repeatable, observable, and experiment-driven process. ReconSpectre unifies passive intelligence acquisition, active DNS enumeration, infrastructure analysis, network scanning, and attack-surface inference within a controlled execution lifecycle. The framework introduces structured telemetry, configurable experimentation parameters, and standardized JSON outputs to enable systematic analysis of reconnaissance techniques. By emphasizing lifecycle transparency, metric generation, and experimental control, ReconSpectre bridges the gap between practitioner-focused reconnaissance tools and academic research requirements. The framework demonstrates how reconnaissance itself can be studied as a scientific artifact rather than treated as a black-box preliminary step.