Active Reconnaissance: Scanning and Service Enumeration

Prerequisites

• PEN-K002: Passive Reconnaissance

Why This Lesson Matters

Active recon is the first time you touch the target's systems. Every probe gets logged. You need to be methodical, stay within scope, and extract maximum signal from minimum noise. Done well, active recon produces a complete service inventory that drives every subsequent test. Done carelessly, it triggers IDS alerts, burns the engagement, or crashes production systems.

1. The Active Recon Mindset

Slow is smooth, smooth is fast. Aggressive scanning gets you flagged and may crash vulnerable services. A measured approach finds everything while generating a defensible evidence trail.

Active recon produces:
  - Open ports and running services
  - Service version numbers (for CVE matching)
  - OS fingerprint
  - Web application tech stack (confirmed)
  - Live hosts in the IP range

2. Nmap: The Essential Port Scanner

Nmap is the industry standard. Understanding its scan types is not optional — the wrong type can trigger IDS or produce false results.

2.1 Scan Types

2.2 Practical Nmap Workflow

# Step 1: Fast host discovery (which IPs are alive?)
nmap -sn 10.0.0.0/24 -oG host_discovery.txt
grep "Up" host_discovery.txt | awk '{print $2}' > live_hosts.txt

# Step 2: Full port scan on live hosts (all 65535 ports)
nmap -sS -p- --min-rate 1000 -oN full_portscan.txt -iL live_hosts.txt

# Step 3: Service version + default scripts on open ports only
# (extract open ports from step 2 output first)
PORTS=$(grep "open" full_portscan.txt | grep -oP 'd+/tcp' | cut -d/ -f1 | tr '
' ',')
nmap -sV -sC -p $PORTS -oN service_enum.txt -iL live_hosts.txt

# Step 4: UDP scan on key ports
nmap -sU -p 53,67,68,69,123,161,500,4500 -oN udp_scan.txt -iL live_hosts.txt

2.3 Reading Nmap Output

Nmap scan report for app.corp.local (185.220.101.10)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 20.04
80/tcp   open  http    nginx 1.18.0
443/tcp  open  https   nginx 1.18.0
3306/tcp open  mysql   MySQL 8.0.32
8080/tcp open  http    Apache Tomcat 9.0.65

Each open port is a potential attack surface. MySQL on port 3306 reachable from outside = misconfiguration finding without even testing it.

3. Web Application Enumeration

3.1 Directory and File Discovery

# Gobuster — brute-force directories and files
gobuster dir 
  -u https://app.corp.local 
  -w /wordlists/directory-list-2.3-medium.txt 
  -x php,html,txt,bak,zip,sql 
  -o gobuster_results.txt 
  -t 20           # 20 threads — moderate, not aggressive

# Feroxbuster — recursive directory buster
feroxbuster -u https://app.corp.local -w /wordlists/raft-large-directories.txt

# Common valuable finds:
# /admin/, /backup/, /.git/, /api/v1/, /swagger, /phpinfo.php, /.env

3.2 Technology-Specific Probes

# WordPress
wpscan --url https://app.corp.local --enumerate u,p,t --api-token YOUR_TOKEN

# Nikto — general web server misconfiguration scan
nikto -h https://app.corp.local -output nikto_results.txt
# Note: Nikto is loud — generates many HTTP requests. Confirm with client.

# Check for exposed .git repository
curl -s https://app.corp.local/.git/HEAD
# Response: "ref: refs/heads/main" → .git is exposed → git-dumper to extract source
git-dumper https://app.corp.local/.git /cases/git_dump/

4. Service-Specific Enumeration

4.1 SMB (port 445)

# List shares
smbclient -L //10.0.0.1/ -N      # -N = no password (anonymous)
nmap --script smb-enum-shares -p 445 10.0.0.1

# Check for EternalBlue (MS17-010)
nmap --script smb-vuln-ms17-010 -p 445 10.0.0.1

4.2 SSH (port 22)

# Check supported authentication methods
ssh -v -o "PreferredAuthentications=none" user@target 2>&1 | grep "Authentications"

# Check for old weak algorithms
nmap --script ssh2-enum-algos -p 22 target
# Weak: diffie-hellman-group1-sha1, arcfour → noteworthy finding

4.3 LDAP (port 389/636)

# Anonymous LDAP enumeration
ldapsearch -x -H ldap://target -b "dc=corp,dc=local" "(objectClass=*)" "*"
# -x = simple auth (anonymous)
# If this works, it is a misconfiguration finding

5. Building the Service Inventory

After active recon, update the target surface summary:

SERVICE INVENTORY — corp.local

185.220.101.10 (app.corp.local):
  22/tcp   OpenSSH 8.2p1       Key-only auth; no banner showing version → good
  80/tcp   nginx 1.18.0        Redirects to HTTPS; HTTP HSTS present
  443/tcp  nginx 1.18.0        Laravel app; PHP 8.1; MySQL backend
  3306/tcp MySQL 8.0.32        !! INTERNET-FACING — misconfiguration finding F001

185.220.101.30 (vpn.corp.local):
  443/tcp  Cisco ASA 9.8.2     CVE-2020-3452 (path traversal) — check if patched
  4443/tcp Cisco AnyConnect    Version fingerprinted; update available

Notable:
  .git/ exposed on app.corp.local — source code potentially extractable
  /swagger/index.html on api.corp.local — API documentation exposed

6. Common Mistakes

Mistake 1: Using -A (aggressive) scan on production systems. The OS detection and script scanning in -A can crash fragile services. Use -sV -sC separately and deliberately.

Mistake 2: Only scanning common ports. Many interesting services run on non-standard ports. Always do a full 65535-port scan (-p-), then follow up with version detection on open ports only.

Mistake 3: Not correlating active recon findings with passive recon. The Cisco ASA version found by Nmap combined with the CVE found during passive recon research = a high-priority finding to test. The value is in correlation, not in either source alone.

7. Practice Exercises

1. An Nmap scan returns: 3306/tcp open mysql MySQL 8.0.32. Explain the finding, its severity, and what you test next.

2. Gobuster discovers /backup/db_2026-06-01.sql.gz on the web server. It returns HTTP 200 with a 4.2 MB response body. What do you do? Write it up as a finding title and one-sentence description.

3. Write the Nmap command to detect whether SMB on 10.0.0.1 is vulnerable to MS17-010 (EternalBlue).

8. Lab

Assessment mode: quiz

6 questions: select the correct Nmap flag for described requirements, interpret provided Nmap output, and identify three misconfiguration findings from a provided service inventory.

9. Framework Alignment

10. Further Reading

• Nmap book — https://nmap.org/book/ — Free online; the authoritative Nmap reference
• SecLists — https://github.com/danielmiessler/SecLists — Wordlists for directory busting
• HackTricks — https://book.hacktricks.xyz — Service-by-service enumeration cheatsheets

["Execute a four-phase Nmap workflow (host discovery, full port scan, service version scan, UDP scan) and produce a service inventory for a target IP range", "Use gobuster to discover hidden paths on a web application and identify three findings from the results (exposed admin panel, backup file, API documentation)", "Correlate a service version found by Nmap with a CVE discovered during passive recon and determine whether the target is likely vulnerable"]

Prerequisites → Why this matters → Active recon mindset → Nmap scan types (table) → Nmap workflow (4 steps) → Web application enumeration (gobuster, nikto, .git exposure) → Service-specific enumeration (SMB, SSH, LDAP) → Service inventory template → Common mistakes → Practice exercises → Quiz lab → Framework alignment → Further reading