Skip to content
HackIndex logo

HackIndex

Active Reconnaissance

6 min read Mar 30, 2026

Active reconnaissance is where you intentionally interact with the target to discover open ports, running services, versions, and OS fingerprints.

This phase:

  • generates detectable traffic

  • builds the technical attack surface

  • feeds directly into service enumeration & exploitation

Use active recon after host discovery, when you already know the target is alive.

Nmap

Nmap is the primary tool for active reconnaissance.
It provides port discovery, service fingerprinting, OS detection, and scripted checks.

Quick TCP Recon (Common Ports)

Fast TCP scan with service version detection and OS fingerprinting

┌──(kali㉿kali)-[~]
└─$ nmap -sV -O -F --version-light -T3 $TARGET_IP -vv
Explain command
-sV Probe open ports to determine service and version info.
-O Enable OS detection using TCP/IP stack fingerprinting.
-F Fast scan mode; scans fewer ports than the default scan.
--version-light Limit version detection to most likely probes (intensity 2).
-T3 Set timing template to normal (default aggression level).
$TARGET_IP Placeholder for the target host IP address.
-vv Increase verbosity level to show more detailed output.

  • -F scans common ports only

  • --version-light reduces probe intensity

  • -O attempts OS fingerprinting

Use when you want quick visibility with minimal scan time.

Aggressive TCP Recon (Default Scripts)

Common ports scan with default scripts, service detection, OS detection, and traceroute

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -A -Pn -T3 --stats-every 30s $TARGET_IP
Explain command
-sC Runs default NSE scripts against open ports.
-sV Probes open ports to determine service and version info.
-A Enables OS detection, version detection, scripts, and traceroute.
-Pn Skips host discovery, treats all hosts as online.
-T3 Sets timing template to normal (default) speed.
--stats-every 30s Prints scan progress stats every 30 seconds.
$TARGET_IP Placeholder for the target host IP address.

  • Includes default NSE scripts

  • Enables traceroute and OS detection

Full TCP Port Recon (1–65535)

Complete TCP port scan with scripts, service detection, and OS fingerprinting

┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -A -Pn -p- -T3 --stats-every 30s $TARGET_IP
Explain command
-sC Runs default NSE scripts against open ports.
-sV Probes open ports to detect service and version info.
-A Enables OS detection, version detection, scripts, and traceroute.
-Pn Skips host discovery, treats all hosts as online.
-p- Scans all 65535 TCP ports.
-T3 Sets timing template to normal (default) speed.
--stats-every 30s Prints scan progress statistics every 30 seconds.
$TARGET_IP Placeholder for the target host IP address.

Mandatory to discover:

  • non-standard services

Stealth TCP Scanning

SYN scan of selected ports or ranges

┌──(kali㉿kali)-[~]
└─$ nmap -sS -T3 $TARGET_IP
Explain command
-sS TCP SYN (stealth) scan; sends SYN packets without completing handshake.
-T3 Timing template 3 (normal); balances speed and reliability.
$TARGET_IP Placeholder for the target host IP address to scan.

Full SYN scan of all TCP ports

┌──(kali㉿kali)-[~]
└─$ nmap -sS -p- -T3 $TARGET_IP
Explain command
-sS TCP SYN (stealth) scan; sends SYN packets without completing handshake.
-p- Scan all 65535 TCP ports instead of default top 1000.
-T3 Timing template 3 (normal); balanced speed and reliability.
$TARGET_IP Placeholder for the target host IP address to scan.

Avoids full TCP handshake, but still generates noticeable traffic.

UDP Reconnaissance

Scan top 200 UDP ports with service detection

┌──(kali㉿kali)-[~]
└─$ nmap -sU -sV -Pn --top-ports 200 -T3 --stats-every 30s $TARGET_IP
Explain command
-sU Performs a UDP scan instead of the default TCP scan.
-sV Enables version detection to identify service versions on open ports.
-Pn Skips host discovery, treating all hosts as online.
--top-ports 200 Scans only the 200 most commonly used ports.
-T3 Sets timing template to normal (default) speed for scanning.
--stats-every 30s Prints scan progress statistics every 30 seconds.
$TARGET_IP Placeholder for the target host IP address to scan.

Full UDP port scan (very slow)

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p- -T3 $TARGET_IP
Explain command
-sU Performs a UDP scan instead of the default TCP scan.
-p- Scans all 65535 ports instead of the default top 1000.
-T3 Sets timing template to 'Normal' for balanced speed and reliability.
$TARGET_IP Placeholder for the target host IP address to scan.

Combined TCP and UDP Scan

Single run scanning both TCP and UDP

┌──(kali㉿kali)-[~]
└─$ nmap -sS -sU -T3 $TARGET_IP
Explain command
-sS TCP SYN (stealth) scan; sends SYN packets without completing handshake.
-sU UDP scan; probes open UDP ports on the target.
-T3 Timing template 3 (normal); balances speed and accuracy.
$TARGET_IP Placeholder for the target host IP address.

Very noisy. Use sparingly.

Low-Aggression Service Identification

Attempt service detection without aggressive probing

┌──(kali㉿kali)-[~]
└─$ nmap -sV --version-light -T3 $TARGET_IP
Explain command
-sV Probe open ports to determine service and version info.
--version-light Use lighter intensity version scanning (intensity level 2).
-T3 Set timing template to normal (default speed, balanced aggressiveness).
$TARGET_IP Placeholder for the target host IP address to scan.

Best when:

  • stealth matters

  • ports are already known

Output and Result Handling

Save output in normal format

┌──(kali㉿kali)-[~]
└─$ nmap -A $TARGET_IP -oN ${TARGET_NAME}.txt
Explain command
-A Enables OS detection, version detection, script scanning, and traceroute.
$TARGET_IP Placeholder for the target host IP address or hostname.
-oN Outputs scan results in normal human-readable format to a file.
${TARGET_NAME}.txt Placeholder defining the output filename using the target's name.

RustScan

RustScan focuses on speed-first TCP port discovery

Full TCP Port Sweep

Fast scan of all TCP ports

┌──(kali㉿kali)-[~]
└─$ rustscan -a $TARGET_IP -p 1-65535
Explain command
-a $TARGET_IP Specifies the target IP address to scan.
-p 1-65535 Defines the port range to scan, covering all 65535 ports.

Use RustScan for discovery, Nmap for fingerprinting

┌──(kali㉿kali)-[~]
└─$ rustscan -a $TARGET_IP -p 1-65535 -- -Pn
Explain command
-a $TARGET_IP Specifies the target IP address to scan.
-p 1-65535 Defines the port range to scan, covering all 65535 ports.
-Pn Skips host discovery, treating the target as always online.

Performance Tuning

Adjust batch size and timeout for slow networks

┌──(kali㉿kali)-[~]
└─$ rustscan -a $TARGET_IP -b 500 -u 5000
Explain command
-a $TARGET_IP Specifies the target IP address to scan.
-b 500 Sets batch size to 500 simultaneous socket connections.
-u 5000 Sets the timeout in milliseconds for each socket connection attempt.

Targeted Port Scanning

Scan only specific ports

┌──(kali㉿kali)-[~]
└─$ rustscan -a $TARGET_IP -p 22,80,443
Explain command
-a $TARGET_IP Specifies the target IP address to scan.
-p 22,80,443 Limits the scan to the specified comma-separated port list.

Save RustScan Output

Write results to file

┌──(kali㉿kali)-[~]
└─$ rustscan -a $TARGET_IP -- -oN ${TARGET_NAME}_rustscan.txt
Explain command
-a $TARGET_IP Specifies the target IP address to scan.
-- Passes subsequent arguments directly to Nmap.
-oN ${TARGET_NAME}_rustscan.txt Saves Nmap output in normal format to the specified file.

Netcat

Netcat is useful for manual probing and validation.

TCP Port Check

Initiate a TCP connection

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP $TARGET_PORT

UDP Port Probe

Send UDP traffic to a port

┌──(kali㉿kali)-[~]
└─$ nc -u $TARGET_IP $TARGET_PORT
Explain command
-u Use UDP instead of the default TCP protocol.
$TARGET_IP Placeholder for the target host IP address.
$TARGET_PORT Placeholder for the target port number to connect to.

Scan a Port Range

Quick manual port scan

┌──(kali㉿kali)-[~]
└─$ nc -nvv -w 1 -z $TARGET_IP $BEGIN_PORT-$END_PORT
Explain command
-n Skip DNS resolution; use numeric IPs only.
-vv Enable extra verbose output for detailed connection info.
-w 1 Set connection timeout to 1 second.
-z Zero-I/O mode; scan for open ports without sending data.
$TARGET_IP Target host IP address to scan.
$BEGIN_PORT-$END_PORT Port range to scan from BEGIN_PORT to END_PORT.

Listening for Connections

Listen for inbound connections

┌──(kali㉿kali)-[~]
└─$ nc -l $TARGET_IP $TARGET_PORT
Explain command
-l Listen mode; waits for an incoming connection instead of initiating one.
$TARGET_IP Placeholder for the target IP address to bind and listen on.
$TARGET_PORT Placeholder for the TCP port number to listen on.

Keep listening after disconnect

┌──(kali㉿kali)-[~]
└─$ nc -k -l $TARGET_IP $TARGET_PORT
Explain command
-k Keep the listener open after a client disconnects (persistent mode).
-l Enable listen mode to accept incoming connections.
$TARGET_IP Placeholder for the target IP address to bind the listener to.
$TARGET_PORT Placeholder for the target port number to listen on.

PowerShell

Useful for Windows-native reconnaissance and restricted environments.

Check a Single TCP Port

Test TCP connectivity

Test-NetConnection -Port $PORT $TARGET_IP

Simple TCP Port Scanner (1–1024)

Basic PowerShell port scan loop

1..1024 % {
    (New-Object Net.Sockets.TcpClient).Connect("$TARGET_IP", $_)
    "TCP port $_ is open"
} 2>$null

Common Pitfalls

  • Open ports ≠ exploitable services

  • UDP scans produce false negatives

  • Overusing -A increases noise without added value

  • NSE scripts can trigger alerts or outages