# Windows Network Reconnaissance Post-Exploitation

> Covers post-exploitation network reconnaissance on Windows systems, including enumeration of hosts, shares, active sessions, and domain topology using native tools.

- **URL:** https://hackindex.io/platforms/windows/post-exploitation/windows-network-reconnaissance-post-exploitation
- **Path:** Windows > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/windows/post-exploitation.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

After landing on a Windows target, map the internal network before attempting lateral movement. Focus on:

- Network interfaces and routing tables (identify pivot points between segments)
- Active connections and listening ports on the current host
- Internal host discovery via ARP, ping sweeps, or DNS
- Port scanning from the target to find internal services
- Domain and Active Directory recon for trust relationships

All of this runs from the compromised host using built-in Windows tools and lightweight binaries, with no need to route traffic through your attack box.

## Network interfaces and routing

Establish your network position first. Multiple interfaces often indicate a pivot point between network segments.

**Network interface and routing information**

```powershell
# All interfaces, IPs, and DNS servers
ipconfig /all

# Routing table (identify other reachable subnets)
route print
netstat -r

# ARP cache (recently contacted hosts: free host discovery)
arp -a

# Active DNS cache (shows recently resolved hostnames)
ipconfig /displaydns
```

The ARP cache is one of the fastest ways to find live hosts without scanning: it shows every host the target has communicated with recently. The routing table reveals subnets the target can reach directly, which are your pivot targets. Multiple routes to different subnets means this host is multi-homed and likely a useful pivot point.

## Active connections and listening ports

**Active connections and open ports**

```powershell
# All active connections with process IDs
netstat -ano

# Listening ports only (local services)
netstat -ano | findstr LISTENING

# Match PIDs to process names
netstat -anob

# PowerShell equivalent
Get-NetTCPConnection | Where-Object {$_.State -eq 'Listen'} | Select-Object LocalAddress, LocalPort, OwningProcess
Get-NetUDPEndpoint | Select-Object LocalAddress, LocalPort, OwningProcess
```

Listening ports that are not exposed externally (not visible in your initial nmap scan) are internal services. These are prime targets: they may be administration interfaces, databases, or legacy services with weaker security than the externally-facing attack surface.

## Internal host discovery

Use the target host to scan the internal network. Native tools are slower but generate less noise and require no file transfer.

**Host discovery from target**

```powershell
# Ping sweep: slow but reliable
1..254 | ForEach-Object {$ip = "192.168.1.$_"; if (Test-Connection -ComputerName $ip -Count 1 -Quiet -TimeoutSeconds 1) {Write-Host "$ip is up"}}

# SMB host discovery via NetBIOS (fast)
net view
net view /domain

# DNS enumeration of domain computers (AD environments)
nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN
nslookup -type=SRV _kerberos._tcp.$DOMAIN

# List domain computers via net (requires domain access)
net group "Domain Computers" /domain

# ARP scan: fastest for local subnet
arp -a
```

## Port scanning from the target

When you need to scan internal hosts for specific services, use a lightweight static binary transferred to the target rather than PowerShell-based scanners, which are slow and noisy.

**Port scanning: native and with tools**

```powershell
# PowerShell port scanner (slow: use for targeted checks only)
$ports = @(22,80,135,139,443,445,1433,3306,3389,5985,5986,8080)
foreach ($port in $ports) {
    $conn = New-Object System.Net.Sockets.TcpClient
    $async = $conn.BeginConnect('192.168.1.10', $port, $null, $null)
    $wait = $async.AsyncWaitHandle.WaitOne(200, $false)
    if ($conn.Connected) { Write-Host "$port open" }
    $conn.Close()
}

# Nmap static binary (transfer to target first)
C:\Windows\Temp\nmap.exe -p 22,80,135,139,443,445,1433,3389,5985 192.168.1.0/24 --open

# Specific host targeted scan
C:\Windows\Temp\nmap.exe -sV -p- 192.168.1.10
```

## Domain and Active Directory recon

In domain environments, built-in commands expose the full domain structure without any additional tools.

**Active Directory environment recon**

```powershell
# Domain controller discovery
nltest /dclist:$DOMAIN
nslookup -type=SRV _ldap._tcp.dc._msdcs.$DOMAIN

# Current domain info
net accounts /domain
nltest /domain_trusts

# Domain admins
net group "Domain Admins" /domain

# Domain controllers
net group "Domain Controllers" /domain

# Full domain user list
net user /domain

# Trust relationships
nltest /domain_trusts /all_trusts
```

## SMB shares and accessible resources

**SMB share enumeration**

```powershell
# Shares on current host
net share

# Shares on a remote host
net view \\192.168.1.10
net view \\192.168.1.10 /all

# Mount and inspect a share
net use Z: \\192.168.1.10\SHARE
dir Z:\
net use Z: /delete

# PowerShell
Get-SmbShare
Get-SmbConnection
```

Accessible SMB shares on domain systems often contain scripts, deployment files, and configuration data with credentials. Pay particular attention to `SYSVOL` and `NETLOGON` shares on domain controllers: group policy scripts and login scripts frequently contain hardcoded credentials.

With your internal network mapped and target hosts identified, the next step is lateral movement. See [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/windows/lateral-movement/pass-the-hash-and-pass-the-ticket), [PsExec and SMB Lateral Movement](https://hackindex.io/platforms/windows/lateral-movement/psexec-and-smb-lateral-movement), and [WinRM and PowerShell Remoting](https://hackindex.io/platforms/windows/lateral-movement/winrm-and-powershell-remoting).