iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Active Recon

By · Reviewed & last updated · Part of Ethical Hacking Tutorial

Active recon = packets actually touch the target. Always inside the agreed scope, time window, and rate limits. The point is to confirm what passive recon hinted at and find what passive can’t see.

A staged active-recon workflow

EXAMPLE
# Pre-flight checklist (every time):
#   [ ] Authorisation in writing covers TODAY + this asset
#   [ ] Contact + escalation path saved nearby
#   [ ] Logging on (script, asciinema, tmux logging)
#   [ ] Identifiable User-Agent / source IP (so blue can correlate if needed)

# 1) Host discovery (within scope)
nmap -sn -PE -PA80,443 -PS22,80,443 -T3 \
    --excludefile out_of_scope.txt \
    10.0.0.0/24 -oA discovery

# 2) Service discovery — start narrow, expand if quiet
nmap -sV --top-ports 1000 -T3 --reason \
    -iL live_hosts.txt -oA top1000

# Then full port scan on the interesting hosts
nmap -p- -sV -sC -T3 --min-rate 500 \
    10.0.0.5 -oA host-5-full

# 3) Web enumeration
ffuf -u https://target.example/FUZZ \
    -w seclists/Discovery/Web-Content/common.txt \
    -mc 200,204,301,302,401,403 -ac \
    -H 'User-Agent: PentestRunner/1.0' \
    -t 20 -p 0.1

# 4) Subdomain takeover hunting (passive list → active probe)
amass enum -d example.com -o subs.txt
httpx -l subs.txt -title -tech-detect -status-code \
    -threads 50 -timeout 5 -rate-limit 50

# 5) Auth + form testing — through Burp / ZAP, not blind tooling
#    Use the issued credentials; respect rate limits.

# 6) Vulnerability validation
#    nuclei -l targets.txt -severity critical,high \
#        -rl 10 -c 10 -etags intrusive

# 7) Cap blast radius
#    --rate / --min-rate / -T2/3 on nmap
#    -p 0.1 on ffuf — 100ms between requests
#    -rate-limit on nuclei / httpx
#    Stop on first signs of service degradation. Tell the client.

# 8) Document everything
#    Every command, host, response code, exact timestamp.
#    Your report needs reproducible steps; the client needs a complete log.

Why it matters

Identifiable User-Agent + a known source IP is the small courtesy that makes you not look like an attacker if the blue team spots you. Saves both sides hours during the engagement debrief.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Active recon = packets hit the target.
# Requires explicit authorisation. Stay inside the agreed time window
# and rate, and log everything you do.
Try it Yourself »

Discussion

Loading…