network-recon

Network Reconnaissance

Network reconnaissance is the systematic process of discovering hosts, mapping open ports, fingerprinting services and operating systems, and identifying vulnerabilities across target networks. It is the foundation of every penetration test -- everything downstream (web testing, exploitation, lateral movement) depends on the quality of your initial network recon.

Reconnaissance Methodology

Follow this sequence. Each phase feeds the next. Skip phases only when scope explicitly restricts them.

Phase 1 -- Passive Reconnaissance

Gather intelligence without sending a single packet to the target. This phase has zero detection risk.

Objectives: Identify IP ranges, ASNs, known services, historical scan data, DNS records.

# Passive subdomain enumeration
subfinder -d target.com -silent -o subdomains.txt

# OSINT-based port data (Shodan, Censys)
# Use ctx_execute or Hexstrike MCP tools for API queries

Integration: Store discovered targets immediately.

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" network "passive-subdomains" "$(wc -l < subdomains.txt) subdomains found" --source "subfinder"

Phase 2 -- Host Discovery

Determine which hosts are alive before port scanning. Scanning dead hosts wastes time and generates noise.

Tool Selection:

• Same LAN: ARP scan (most reliable, cannot be firewalled)
• Remote targets: TCP SYN ping + ICMP + UDP combined
• Firewall-heavy: TCP ping on known-open ports (80, 443)

Load: ToolSearch -> select:mcp__hexstrike-ai__arp_scan_discovery (LAN targets)

# ARP discovery (local network only)
arp-scan --localnet --interface eth0

# Nmap host discovery combinations
nmap -sn -PE -PP -PS80,443,22 -PU53,161 -T3 10.0.0.0/24    # Standard
nmap -sn -PS80,443,8080,22,25 10.0.0.0/24                    # TCP-only (ICMP blocked)
nmap -sn -PR 10.0.0.0/24                                      # ARP only (local subnet)

See references/host-discovery.md for complete host discovery methodology.

Phase 3 -- Port Scanning

Discover open ports on live hosts. Tool selection depends on scope size and OPSEC requirements.

Tool Ladder (select based on scenario):

| Scenario | Tool | Speed | Accuracy | Stealth | |----------|------|-------|----------|---------| | Quick triage / CTF | RustScan | Fastest | Ports only | None | | Large scope (>256 hosts) | Masscan | Fast | Ports only | Low | | Standard engagement | Nmap SYN | Moderate | Good | Moderate | | Stealth required | Nmap with evasion | Slow | Good | High | | Maximum accuracy | Nmap TCP connect | Slow | Best | Low |

Load: ToolSearch -> select:mcp__hexstrike-ai__rustscan_fast_scan (quick discovery) Load: ToolSearch -> select:mcp__hexstrike-ai__masscan_high_speed (large scope) Load: ToolSearch -> select:mcp__hexstrike-ai__nmap_scan (standard) Load: ToolSearch -> select:mcp__hexstrike-ai__nmap_advanced_scan (deep)

# Standard SYN scan -- all ports
nmap -sS -p- -T4 --open --reason -oA full-syn target.com

# Masscan for speed, then nmap for accuracy
masscan -p1-65535 --rate=1000 -oL masscan-results.txt 10.0.0.0/24
nmap -sV -sC -p$(cat masscan-results.txt | grep open | cut -d' ' -f4 | sort -u | tr '\n' ',') target

See references/port-scanning.md for scan types, timing, and evasion techniques.

Phase 4 -- Service Enumeration

Identify service versions, technologies, and configurations on discovered ports.

# Version detection + default scripts on discovered ports
nmap -sV -sC -p22,80,443,445,3389 -oA service-enum target.com

# Aggressive service detection with OS guess
nmap -sV --version-intensity 9 -A -p- target.com

Post-enumeration: Log every discovered service to target-intel.

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" service "22/tcp" "OpenSSH 8.9p1 Ubuntu" --source "nmap"
node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" service "443/tcp" "nginx 1.18.0" --source "nmap"

See references/service-enum.md for per-service enumeration tools and techniques.

Phase 5 -- OS Fingerprinting

Determine operating systems to prioritize exploits and understand the target environment.

# Active OS detection
nmap -O --osscan-guess target.com

# Combined with service version for best accuracy
nmap -O -sV --version-intensity 5 target.com

See references/os-fingerprinting.md for active and passive fingerprinting methods.

Phase 6 -- DNS Reconnaissance

Map the target's DNS infrastructure. Zone transfers, subdomain enumeration, and record analysis.

# Comprehensive subdomain enumeration
amass enum -d target.com -active -o amass-results.txt

# DNS record types
dig target.com ANY +noall +answer
dig target.com AXFR @ns1.target.com    # Zone transfer attempt

See references/dns-recon.md for DNS enumeration methodology.

Phase 7 -- Vulnerability Correlation

Cross-reference discovered services with known vulnerabilities. Map CVEs to exploit potential.

# Nmap vuln scripts
nmap --script vuln -p22,80,443 target.com

# Nuclei network templates
nuclei -t network/ -target target.com:443

See references/vulnerability-scanning.md for vulnerability scanning and correlation.

Phase 8 -- Network Pivoting

When you compromise a host, use it to reach previously inaccessible networks.

See references/network-pivoting.md for tunneling, port forwarding, and multi-hop pivot chains.

OPSEC Profiles and Scan Timing

Every scan decision must account for the active OPSEC profile. Check the current profile before scanning:

node ${CLAUDE_PLUGIN_ROOT}/scripts/scan-profile.js get

Profile Matrix

| Profile | Nmap Timing | Masscan Rate | Scan Type | Parallelism | Notes | |---------|-------------|--------------|-----------|-------------|-------| | loud | -T5 | --rate=10000 | -sS full range | Max parallel | Lab/CTF only. Fastest. No evasion. | | normal | -T3 | --rate=1000 | -sS with -sV | Moderate | Standard authorized tests. Default scripts. | | stealth | -T2 | --rate=100 | -sS with fragmentation | Sequential | IDS present. Fragment packets. Randomize hosts. | | paranoid | -T1 or -T0 | --rate=10 | -sS with full evasion | Single host | Active monitoring. Full evasion suite. |

Evasion Techniques by Profile

stealth profile additions:

nmap -sS -T2 -f --data-length 24 --randomize-hosts -D RND:5 target

paranoid profile additions:

nmap -sS -T1 -f -f --mtu 16 --data-length 48 --randomize-hosts \
  --scan-delay 5s --max-retries 1 --source-port 53 \
  -D RND:10,ME --spoof-mac 0 target

See references/port-scanning.md for complete evasion flag reference.

Decision Trees

Scan Strategy by Engagement Type

External Pentest:
  -> Start with passive DNS/OSINT (Phase 1)
  -> Subdomain enumeration (Phase 6)
  -> Port scan discovered hosts (Phase 3)
  -> Service enum on open ports (Phase 4)
  -> Vuln correlation (Phase 7)

Internal Pentest:
  -> ARP scan for host discovery (Phase 2)
  -> Full port scan all live hosts (Phase 3)
  -> Service enum + OS fingerprint (Phase 4-5)
  -> SMB/LDAP/Kerberos enumeration
  -> Vuln scan + lateral movement planning

Red Team:
  -> Passive only initially (Phase 1)
  -> Targeted port scans on high-value hosts (Phase 3, paranoid profile)
  -> Minimal service probes (Phase 4, specific ports only)
  -> Pivot planning (Phase 8)

Bug Bounty:
  -> Subdomain enumeration (Phase 6)
  -> Port scan on in-scope assets (Phase 3)
  -> Web service identification (Phase 4, HTTP/HTTPS focus)
  -> Skip OS fingerprinting unless relevant

Tool Selection by Target Count

1 host         -> Nmap full (-p- -sV -sC -A) or AutoRecon
2-10 hosts     -> Nmap with parallelism (--min-hostgroup 4)
11-50 hosts    -> Nmap phased (discovery -> targeted service enum)
51-256 hosts   -> Masscan discovery -> Nmap service enum on hits
256+ hosts     ->