active-recon

Active Reconnaissance Knowledge Base

Active reconnaissance directly interacts with target systems. Every packet sent may be logged, detected, or trigger alerts. Use active techniques only after passive reconnaissance has identified specific targets that warrant further investigation.

Quick Reference — Common Scan Patterns

# Stealth SYN scan with version detection (recommended starting point)
nmap -sS -sV -p 22,80,443,8080,8443 <TARGET> -oN nmap_<TARGET>.txt -oX nmap_<TARGET>.xml

# Full top-1000 port scan
nmap -sS -sV --top-ports 1000 -T2 <TARGET> -oN nmap_full_<TARGET>.txt

# Script enumeration on discovered ports
nmap -sC -sV -p <PORTS> <TARGET> -oN nmap_scripts_<TARGET>.txt

# UDP scan (DNS, SNMP, NTP)
nmap -sU -p 53,161,123 <TARGET> -oN nmap_udp_<TARGET>.txt

# Web directory fuzzing
ffuf -u https://<TARGET>/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,301,302,403 -o ffuf_<TARGET>.json

# Vulnerability scan
nuclei -u https://<TARGET> -severity critical,high -o nuclei_<TARGET>.txt

1. OPSEC Principles for Active Scanning

Detection Avoidance

• Never scan entire ranges blindly — target specific IPs/ports identified during passive recon
• Rate limiting: Slow scans blend with normal traffic; fast scans trigger IDS/IPS
• Timing: Scan during business hours when traffic volume provides cover
• Source management: Be aware your sandbox IP is the scan origin
• User-Agent rotation: Vary HTTP user agents for web scanning tools

Scan Justification

Before every active scan, document:

1. What you're scanning and why
2. What passive intel led to this decision
3. Expected noise level and detection risk

2. Port Scanning with Nmap

Stealth SYN Scan (Default for Recon)

# Targeted port scan — specific ports from passive findings
nmap -sS -p 22,80,443,8080,8443 <target_ip>

# Top 1000 ports with service detection
nmap -sS -sV --top-ports 1000 <target_ip>

# Full 65535 port scan (slow, use only when justified)
nmap -sS -p- --min-rate 1000 <target_ip>

# Save results
nmap -sS -sV -p 22,80,443 <target_ip> -oN nmap_scan.txt -oX nmap_scan.xml