# Active Reconnaissance

- **URL:** https://hackindex.io/services/hosts/reconnaissance/active-reconnaissance
- **Path:** Hosts > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/services/hosts/reconnaissance.md)
- **Published:** 2025-12-29
- **Updated:** 2026-03-30

Active reconnaissance is where you **intentionally interact with the target** to discover **open ports, running services, versions, and OS fingerprints**.

This phase:

- generates **detectable traffic**
- builds the **technical attack surface**
- feeds directly into **service enumeration & exploitation**

Use active recon **after host discovery**, when you already know the target is alive.

## Ping sweep and ARP scanning with Nmap

Nmap is the primary tool for active reconnaissance.  
It provides **port discovery, service fingerprinting, OS detection, and scripted checks**.

### Quick TCP Recon (Common Ports)

Fast TCP scan with service version detection and OS fingerprinting

```bash
nmap -sV -O -F --version-light -T3 $TARGET_IP -vv
```

- `-F` scans common ports only
- `--version-light` reduces probe intensity
- `-O` attempts OS fingerprinting

Use when you want **quick visibility** with minimal scan time.

### Aggressive TCP Recon (Default Scripts)

Common ports scan with default scripts, service detection, OS detection, and traceroute

> [!WARNING]
> Loud and easily detectable.

```bash
nmap -sC -sV -A -Pn -T3 --stats-every 30s $TARGET_IP
```

- Includes default NSE scripts
- Enables traceroute and OS detection

### Full TCP Port Recon (1-65535)

Complete TCP port scan with scripts, service detection, and OS fingerprinting

```bash
nmap -sC -sV -A -Pn -p- -T3 --stats-every 30s $TARGET_IP
```

Mandatory to discover:

- non-standard services

### Stealth TCP Scanning

SYN scan of selected ports or ranges

```bash
nmap -sS -T3 $TARGET_IP
```

Full SYN scan of all TCP ports

```bash
nmap -sS -p- -T3 $TARGET_IP
```

Avoids full TCP handshake, but still generates noticeable traffic.

### UDP Reconnaissance

Scan top 200 UDP ports with service detection

```bash
nmap -sU -sV -Pn --top-ports 200 -T3 --stats-every 30s $TARGET_IP
```

Full UDP port scan (very slow)

```bash
nmap -sU -p- -T3 $TARGET_IP
```

> [!WARNING]
> UDP scanning is slow and unreliable: run only when justified.

### Combined TCP and UDP Scan

Single run scanning both TCP and UDP

```bash
nmap -sS -sU -T3 $TARGET_IP
```

Very noisy. Use sparingly.

### Low-Aggression Service Identification

Attempt service detection without aggressive probing

```bash
nmap -sV --version-light -T3 $TARGET_IP
```

Best when:

- stealth matters
- ports are already known

### Output and Result Handling

Save output in normal format

```bash
nmap -A $TARGET_IP -oN ${TARGET_NAME}.txt
```

## RustScan

RustScan focuses on **speed-first TCP port discovery**

### Full TCP Port Sweep

Fast scan of all TCP ports

```bash
rustscan -a $TARGET_IP -p 1-65535
```

Use RustScan for discovery, Nmap for fingerprinting

```bash
rustscan -a $TARGET_IP -p 1-65535 -- -Pn
```

### Performance Tuning

Adjust batch size and timeout for slow networks

```bash
rustscan -a $TARGET_IP -b 500 -u 5000
```

### Targeted Port Scanning

Scan only specific ports

```bash
rustscan -a $TARGET_IP -p 22,80,443
```

### Save RustScan Output

Write results to file

```bash
rustscan -a $TARGET_IP -- -oN ${TARGET_NAME}_rustscan.txt
```

## Netcat

Netcat is useful for **manual probing and validation**.

### TCP Port Check

**Initiate a TCP connection**

```bash
nc $TARGET_IP $TARGET_PORT
```

### UDP Port Probe

Send UDP traffic to a port

```bash
nc -u $TARGET_IP $TARGET_PORT
```

### Scan a Port Range

Quick manual port scan

```bash
nc -nvv -w 1 -z $TARGET_IP $BEGIN_PORT-$END_PORT
```

### Listening for Connections

Listen for inbound connections

```bash
nc -l $TARGET_IP $TARGET_PORT
```

Keep listening after disconnect

```bash
nc -k -l $TARGET_IP $TARGET_PORT
```

## PowerShell

Useful for **Windows-native reconnaissance** and restricted environments.

### Check a Single TCP Port

Test TCP connectivity

```powershell
Test-NetConnection -Port $PORT $TARGET_IP
```

### Simple TCP Port Scanner (1-1024)

Basic PowerShell port scan loop

```powershell
1..1024 % {
    (New-Object Net.Sockets.TcpClient).Connect("$TARGET_IP", $_)
    "TCP port $_ is open"
} 2>$null
```

## Common Pitfalls

- Open ports ≠ exploitable services
- UDP scans produce false negatives
- Overusing `-A` increases noise without added value
- NSE scripts can trigger alerts or outages