Active Reconnaissance

Active recon is the kind that does touch the target’s infrastructure: you scan its ports, interrogate its services, identify versions, and map its network. Unlike passive, this leaves traces in its logs and can trigger alerts, so it’s done with permission (scope) and judgment. It’s the bridge between “I know what exists” (passive) and “I know what’s exposed and exploitable” (enumeration).

Model

From passive you already have a list of domains, IPs, and ranges. Active recon interrogates them directly to discover: which hosts are alive, which ports/services are open, which versions run, and which OS they use. The list of services to enumerate in depth comes from here.

Host discovery

# what's alive in a range
nmap -sn 10.0.0.0/24               # ping sweep
fping -a -g 10.0.0.0/24 2>/dev/null
# if ICMP is blocked, discover by common ports
nmap -sn -PS22,80,443 10.0.0.0/24  # TCP SYN discovery

Port scanning (nmap, the central tool)

# fast: top ports + service discovery
nmap -sV -sC -oA scan target.com
# all TCP ports (slow but complete)
nmap -p- -T4 target.com
# UDP (slow; only key ports)
nmap -sU --top-ports 20 target.com
# scan types
-sS   SYN scan (stealthy, doesn't complete the connection)   -sT  TCP connect (no privileges)
-sV   version detection    -O  OS detection    -sC  default scripts (NSE)

Fast alternatives for large ranges: masscan / rustscan (find open ports at high speed) then nmap -sV over those ports.

rustscan -a target.com -- -sV -sC
masscan -p1-65535 10.0.0.0/24 --rate 10000

Identify services and versions

Each open port is a question: what runs and which version?

nmap -sV target             # versions
nmap --script=banner target # banners
# NSE: service-specific scripts (vuln, enum, auth)
nmap --script smb-enum-shares,smb-os-discovery -p445 target
nmap --script http-enum -p80,443 target

Web and service fingerprinting

whatweb https://target        # web technologies (see recon-fingerprint)
httpx -title -tech-detect -status-code -l hosts.txt
nikto -h https://target       # fast web scanner of known issues

OPSEC: noise and evasion

Active recon is detectable. To reduce noise/evade:

-T2 / -T1        slower timing (less detectable)
--max-rate       limit packets per second
-D decoy1,decoy2 decoys (obfuscate the origin)
-f               fragment packets
--source-port 53 origin from a "trusted" port

An IDS/IPS will spot a -T5 -p- instantly; a slow, segmented scan slips by more.

For the defense

Detection: spikes of connections to many ports from one source (scan signature), SYN without completing the handshake, known NSE. Mitigation: segmentation, firewall limiting exposure, IDS/IPS (Suricata/Snort), rate-limiting, and not exposing unnecessary services.

Testing checklist

Discover live hosts in the range (ping sweep / SYN discovery)
TCP port scan (top then -p-)
Key UDP ports (DNS, SNMP, etc.)
Version and OS detection (-sV -O)
NSE per service (smb, http, etc.)
Web fingerprinting (whatweb/httpx)
List of services to enumerate in depth
Apply evasion/timing if stealth matters