Active Reconnaissance

Active reconnaissance starts with a direct connection to the target. Unlike passive recon, it makes contact — a phone call, a visit, browsing the website, or connecting to a port. Such connections may leave traces in logs (your IP, time, duration). But not all connections are suspicious: web browsing, for example, looks like normal client activity among thousands of legitimate users, so active recon can be disguised as regular traffic.

Simple active-recon toolsSearch on YouTubeBookmarkSaved

Web browsingSearch on YouTubeBookmarkSaved

During active recon you can use the browser's DevTools to inspect cookies, discover API endpoints and review client-side scripts. Session cookies without the HttpOnly flag, or JavaScript files exposing API paths, hint at gaps like XSS. This client-side exploration builds attack strategies before you run automated scans. Add-ons help: Wappalyzer shows the technologies used on a visited site. A common practice target is http://testphp.vulnweb.com/login.php.

PingSearch on YouTubeBookmarkSaved

ping <TARGET_IP>

ping checks whether you can reach the target and it can reach you back, using ICMP Echo. No reply usually means the target is off, booting, crashed, unplugged, behind a firewall that blocks ICMP, or you have no connectivity.

TracerouteSearch on YouTubeBookmarkSaved

traceroute <TARGET_IP>

traceroute reveals the routers (hops) on the path to the target. It sends packets with an increasing Time To Live (TTL) header; each router decrements the TTL by one, and the router where TTL hits 0 drops the packet and reveals its IP. On Linux, traceroute sends UDP datagrams: TTL 1 is dropped at the first router (revealing it), TTL 2 at the second, and so on until the target is reached.

Telnet and netcatSearch on YouTubeBookmarkSaved

telnet <TARGET_IP> <PORT>      # connect to any TCP service, read/send raw data
nc <TARGET_IP> <PORT>          # netcat: collect a service banner

Telnet (TELetype NETwork, 1969) was built for remote administration but sends everything, including credentials, in clear text. It is still used to connect to any TCP service and grab information: connect to an HTTP port and send a HEAD request to get just the response headers, which reveal the server's details.

Netcat (nc) supports TCP and UDP and works as both a listener and a connector. Connect to a service to collect its banner.

NmapSearch on YouTubeBookmarkSaved

Nmap is the network-mapping tool used across phases.

nmap -V                       # print the Nmap version

Host discoverySearch on YouTubeBookmarkSaved

Host discovery finds which hosts are alive. -sn disables the port scan (ping scan only).

nmap -sn <TARGET_IP>          # ping scan, no port scan
nmap -PE -sn <TARGET_IP>      # ICMP echo
nmap -PP -sn <TARGET_IP>      # ICMP timestamp
nmap -PM -sn <TARGET_IP>      # ICMP address mask
nmap -PR -sn <TARGET_IP>      # ARP scan only
nmap -PS -sn <TARGET_IP>      # TCP SYN discovery
nmap -PU -sn <TARGET_IP>      # UDP discovery
nmap -PR -sn 10.10.10.10/24   # ARP scan a whole subnet
nmap -sn -n 8.8.8.8           # -n = no DNS resolution

ARP scanning: before communicating with a computer you need its MAC address. The OS sends an ARP query; any computer that replies is up and on the same subnet. -PR -sn does an ARP scan only — reliable on the local Ethernet/WiFi, and it cannot be blocked like ICMP.

Target specificationSearch on YouTubeBookmarkSaved

nmap -sL 192.168.56.0/24      # list scan: just list targets, send no packets
nmap 192.168.56.1-10          # a range
nmap -iL targets.txt          # input targets from a file
nmap 192.168.56.0/30          # a subnet (/30 = 4 addresses)
# exclude hosts with --exclude

Port statesSearch on YouTubeBookmarkSaved

Common optionsSearch on YouTubeBookmarkSaved

nmap -v <TARGET_IP>           # verbose
nmap -vv <TARGET_IP>          # very verbose
nmap -r <TARGET_IP>           # scan ports in consecutive order
nmap -O <TARGET_IP>           # OS detection
sudo nmap -sV 192.168.56.107  # service / version detection
nmap --reason <TARGET_IP>     # why a port is in a given state
nmap --open <TARGET_IP>       # show only open ports
nmap -Pn <TARGET_IP>          # treat all hosts as online, skip host discovery

-n means no DNS resolution. -Pn skips the host-discovery phase and is used when the host is already known to be up or blocks ping.

Port selectionSearch on YouTubeBookmarkSaved

nmap -F <TARGET_IP>           # fast scan: top 100 ports
nmap -p 80 <TARGET_IP>        # a single port
nmap -p 22,80,443 <TARGET_IP> # a set of ports
nmap -p- <TARGET_IP>          # all 65535 ports

By default (no -p) Nmap scans the top 1000 commonly used ports from the nmap-services database. -F reduces that to 100.

Scan techniquesSearch on YouTubeBookmarkSaved

nmap -sT <TARGET_IP>          # TCP connect scan
nmap -sS <TARGET_IP>          # TCP SYN (stealth / half-open)
nmap -sU <TARGET_IP>          # UDP scan
nmap -sN <TARGET_IP>          # Null scan (no flags set)
nmap -sF <TARGET_IP>          # FIN scan
nmap -sX <TARGET_IP>          # Xmas scan (FIN + PSH + URG)
nmap -sM <TARGET_IP>          # Maimon scan (FIN + ACK)
nmap -sA <TARGET_IP>          # ACK scan
nmap -sW <TARGET_IP>          # Window scan
sudo nmap -sU -p- 192.168.56.107   # all UDP ports (very slow)

There are many scan types because targets behave differently, firewalls/IDS block some scans but not others, privilege level (root vs non-root) limits the packets you can send, and stealth-vs-speed trade-offs matter.

• -sT (TCP Connect) completes the full 3-way handshake (SYN → SYN-ACK → ACK). Reliable but logged.
• -sS (TCP SYN, stealth) is the half-open scan: SYN → reads SYN-ACK as open → sends RST instead of the final ACK. Stealthier than -sT because the handshake never completes.
• Null (-sN), FIN (-sF), Xmas (-sX) behave identically except for the TCP flags: Null sets none, FIN sets FIN, Xmas sets FIN+PSH+URG. A RST reply means closed; no response means open|filtered; an ICMP unreachable error means filtered.
• Maimon (-sM) sends FIN+ACK.

TimingSearch on YouTubeBookmarkSaved

sudo nmap -T4 -sS 192.168.56.107

Use -T0/-T1 for fragile legacy systems (minimal load, low disruption risk) and -T4 on stable networks.

Aggressive scanSearch on YouTubeBookmarkSaved

nmap -A <TARGET_IP>

-A combines OS detection (-O), version detection (-sV), default NSE scripts (-sC) and --traceroute in one scan.

Output formatsSearch on YouTubeBookmarkSaved

nmap [options] target | tee output.txt   # show on screen and save
nmap -oN scan.txt <target>    # normal (human-readable)
nmap -oG scan.gnmap <target>  # grepable (easy to parse with grep/awk/cut)
nmap -oX scan.xml <target>    # XML (import into Metasploit, Zenmap, reports)
nmap -oA myscan <target>      # all three formats at once

Nmap Scripting Engine (NSE)Search on YouTubeBookmarkSaved

The NSE automates networking tasks with scripts. Every Nmap install ships with scripts in /usr/share/nmap/scripts (file extension .nse, written in Lua), executed in parallel.

sudo nmap --script-updatedb                      # rebuild the script database (script.db)
ls -al /usr/share/nmap/scripts | grep "http"     # find scripts by keyword
ls -al /usr/share/nmap/scripts/ | grep "ftp"
vim /usr/share/nmap/scripts/http-enum.nse        # inspect a script

nmap --script <name> <TARGET_IP>                 # run one script (no .nse needed)
nmap -p 21 --script ftp-anon 192.168.56.107      # is FTP anonymous login allowed?
nmap -p 21 --script "ftp-*" 192.168.10.149       # all ftp scripts (noisy/slow)
nmap --script name1,name2 <TARGET_IP>            # several scripts, comma-separated

Banner grabbingSearch on YouTubeBookmarkSaved

sudo nmap -p22,80 --script banner <TARGET_IP>

Banner grabbing collects the initial message a service returns on connection. The banner gives the exact service name and version (e.g. OpenSSH on port 22), which is very useful for matching vulnerabilities.

Vulnerability scanningSearch on YouTubeBookmarkSaved

nmap --script vulners <TARGET_IP>               # check services vs the Vulners.com DB
nmap --script ssl-heartbleed <TARGET_IP>        # Heartbleed (CVE-2014-0160)

The vulners script checks the detected service (e.g. vsftpd 2.3.4) against the Vulners.com database. Each result gives a reference ID (CVE, Exploit-DB, etc.), a CVSS score (10.0 = critical), a link, and may be marked *EXPLOIT* when a working exploit is public. Other tools: searchsploit and Nikto.

NSE script categoriesSearch on YouTubeBookmarkSaved

Quick self-testSearch on YouTubeBookmarkSaved