Reconnaissance and Scanning
This page focuses on active reconnaissance and scanning during authorized offensive testing. Passive OSINT, breach lookups, reputation checks, and general domain intelligence are maintained under Cyber Intelligence.
OSINTFor multi-tool recon suites and attack surface management platforms, use the Recon Frameworks page.
Recon FrameworksWeb application scanning has its own section so web tooling does not get mixed into general network reconnaissance.
Web App Scanning UtilitiesAttack Surface Mapping
Attack surface mapping identifies exposed assets, services, and technologies that may be in scope for testing. Some tools combine passive discovery with active probing, so validate each tool against the engagement rules before running it.
Frameworthy - Collection of attack surface management tooling.
Amass - Network mapping and external asset discovery using open source information gathering and active reconnaissance techniques.
ProjectDiscovery - Open source tools often chained for bug bounty and external recon workflows.
AttackSurfaceMapper - Expands a target seed into related domains, hosts, and exposed services.
IVRE - Network recon framework built around Nmap, Masscan, ZGrab2, ZDNS, and Zeek.
Goby - Network security assessment tool for asset and vulnerability discovery.
Legacy or Caution
Intrigue Core - Historical attack surface discovery framework. The open source component has not been actively maintained on GitHub since 2021 and has license caveats.
CloudFrontier - Cloud attack surface monitor with stale open issues and limited recent activity.
eReKon - Web reconnaissance tool that appears incomplete or under active development; validate before relying on it.
RiskIQ is now part of Microsoft. Treat older RiskIQ links as legacy branding and prefer current Microsoft Defender External Attack Surface Management references when needed.
Host and Asset Discovery
Host discovery identifies live systems and services before deeper enumeration or exploitation.
fierce - Locates non-contiguous IP space and hostnames before running heavier scanners.
hosthunter - Maps IP addresses to virtual hostnames using OSINT-style techniques.
arp-scan - Sends ARP requests on local networks.
netdiscover - Active/passive ARP reconnaissance.
Quick Commands
Active Directory DNS SRV Discovery
Wake-on-LAN
Wake-on-LAN magic packets are usually sent as Ethernet type 0x0842 or UDP port 9. Verify this is in scope before testing it on a real network.
Responder Analyze Mode
Responder belongs with network poisoning and MITM techniques, but its analyze mode can be useful during discovery.
Network Attacks /Harvesting/MITMPort Scanning
Port scanning identifies exposed services and helps prioritize enumeration. Tune rate, timing, and scan type to the rules of engagement.
NMAPCommon Tools
Masscan - Internet-scale TCP port scanner.
RustScan - Fast port scanner that can hand results to Nmap.
naabu - Fast ProjectDiscovery port scanner.
Unicornscan - User-land distributed TCP/IP stack scanner.
Scantron - Distributed Nmap/Masscan scanning platform.
Scanless - Uses third-party websites to perform port scans.
unimap - Reduces duplicate scans across large target sets.
AMAP - Identifies applications running on non-standard ports.
Probe Response Cheat Sheet
Open:
SYN -> SYN/ACK -> RSTClosed:
SYN -> RST/ACKFiltered: no response or ICMP unreachable message.
Active DNS Recon
Use this section for DNS queries, brute forcing, and active resolution tied to an authorized target. Passive DNS history and domain investigation belong under Cyber Intelligence.
DomainSubdomain screenshot and flyover tools overlap with web application recon. Keep the detailed workflow in Web App Hacking.
Web App Scanning UtilitiesVulnerability Scanning
Vulnerability scanners identify known weaknesses, exposed versions, misconfigurations, and risky defaults. They can be noisy, so validate scope, rate limits, and maintenance windows before running them.
Example Commands
Nessus commonly listens on https://localhost:8834. Greenbone/GVM web UI ports vary by package and configuration, so check the local service output instead of relying on old OpenVAS port references.
TLS and Service Configuration Checks
For HTTPS-specific testing, use the Web Technologies SSL/TLS page. The tools below are also useful for non-HTTP TLS services.
SSL/TLS and CertificatesHoneypot and Filtering Awareness
These tools can help identify defensive traps or filtering behavior during authorized testing. Use them carefully and document assumptions; a honeypot score is not proof.
Default Credential Checks
changeme - Default credential scanner for HTTP(S), MSSQL, MySQL, PostgreSQL, SSH, and SSH keys.
For deeper password attacks, use the Password Attacks page.
Password AttacksTraining
Training rooms and labs for passive recon, active recon, RustScan, OpenVAS, and Sublist3r live in Training.
Training and ResourcesLast updated