Network Reconnaissance Playbook

A systematic approach to network discovery and enumeration. You must complete all phases when doing recon.

When to Use This Skill

Activate this skill when the user needs to:

• Discover live hosts on a network
• Find open ports on a target
• Identify running services and versions
• Enumerate web services
• Perform a full network assessment

Decision Tree

Task → What does the user need?
    │
    ├─ Find live hosts on a network?
    │   └─ Phase 1: Host Discovery
    │
    ├─ Find open ports on a known host?
    │   └─ Phase 2: Port Scanning
    │
    ├─ Identify what services are running?
    │   └─ Phase 3: Service Detection
    │
    ├─ Explore web services in detail?
    │   └─ Phase 4: Web Enumeration
    │
    └─ Full network assessment?
        └─ Run all phases in sequence

Phase 1: Host Discovery

Goal: Find live hosts on the target network.

# Ping sweep - fastest method
nmap -sn 192.168.1.0/24

# ARP scan - more reliable on local networks (requires root)
nmap -sn -PR 192.168.1.0/24

# Skip ping, assume hosts are up (for filtered networks)
nmap -Pn 192.168.1.0/24

Output parsing: Look for lines containing "Nmap scan report for" - these are your live hosts.

Next step: Record all discovered IPs, then proceed to Phase 2 for each host.

Phase 2: Port Scanning

Goal: Find open ports on discovered hosts.

Scan Type	Command	Use When
Quick (top 100)	nmap -Pn -F <ips>	Initial fast scan
Standard (top 1000)	nmap -Pn <ips>	Default reconnaissance
Full (all 65535)	nmap -Pn -p- <ips>	Thorough assessment
Specific ports	nmap -Pn -p 22,80,443 <ips>	Known services
UDP scan	nmap -sU --top-ports 20 <ips>	Check UDP services

Speed options:

# Faster scanning (less accurate)
nmap -T4 -F 192.168.1.1

# Aggressive timing
nmap -T5 192.168.1.1

Output parsing: Note all ports showing "open" state.

Next step: For each host with open ports, proceed to Phase 3.

Phase 3: Service Detection

Goal: Identify services and versions running on open ports.

# Version detection on all open ports
nmap -sV 192.168.1.1

# Version detection on specific ports (faster)
nmap -sV -p 22,80,443,3306 192.168.1.1

# Aggressive version detection
nmap -sV --version-intensity 5 192.168.1.1

# Include OS detection
nmap -sV -O 192.168.1.1

Combined scan (recommended for full assessment):

# Version + default scripts + OS detection
nmap -A 192.168.1.1

# Same but on specific ports
nmap -A -p 22,80,443 192.168.1.1

Output parsing: Record service names, versions, and any additional info from scripts.

Next step: For hosts with web ports (80, 443, 8080, 8443), proceed to Phase 4.

Phase 4: Web Enumeration

Goal: Gather details about web services.

Check HTTP headers:

# HTTP
curl -I http://192.168.1.1
curl -I http://192.168.1.1:8080

# HTTPS (ignore cert errors)
curl -Ik https://192.168.1.1

# Follow redirects
curl -ILk http://192.168.1.1

Grab page title and content:

# Get page content
curl -s http://192.168.1.1 | head -50

# Just the title
curl -s http://192.168.1.1 | grep -i '<title>'

Check common paths:

# Robots.txt
curl -s http://192.168.1.1/robots.txt

# Common admin paths
curl -I http://192.168.1.1/admin
curl -I http://192.168.1.1/login
curl -I http://192.168.1.1/wp-admin

Nmap HTTP scripts:

# HTTP enumeration
nmap --script http-enum -p 80 192.168.1.1

# HTTP headers
nmap --script http-headers -p 80 192.168.1.1

# HTTP methods
nmap --script http-methods -p 80 192.168.1.1

# All HTTP scripts
nmap --script "http-*" -p 80,443 192.168.1.1

Phase 5: Vulnerability Scanning (Optional)

Goal: Check for known vulnerabilities.

# Run vulnerability scripts
nmap --script vuln 192.168.1.1

# Check specific vulnerabilities
nmap --script smb-vuln-* -p 445 192.168.1.1
nmap --script ssl-heartbleed -p 443 192.168.1.1

Quick Reference Commands

Task	Command
Discover hosts	nmap -sn 192.168.1.0/24
Quick port scan	nmap -Pn -F <ips>
Full port scan	nmap -Pn -p- <ips>
Service versions	nmap -Pn -sV <ips>
Full assessment	nmap -Pn -A <ips>
Web headers	curl -Ik https://192.168.1.1
Vuln scan	nmap --script vuln <ips>

Output Format

After completing reconnaissance, summarize findings:

## Network Recon Summary

### Target: 192.168.1.0/24
### Hosts Discovered: 5

### Host: 192.168.1.1 (Gateway)
- Open Ports: 22, 80, 443
- Services:
  - 22/tcp: OpenSSH 8.2
  - 80/tcp: nginx 1.18.0
  - 443/tcp: nginx 1.18.0 (SSL)
- Web: Router admin panel, requires auth
- Notes: Default credentials may apply

### Host: 192.168.1.10 (Web Server)
- Open Ports: 22, 80, 3306
- Services:
  - 22/tcp: OpenSSH 8.4
  - 80/tcp: Apache 2.4.41
  - 3306/tcp: MySQL 8.0.27
- Web: WordPress site detected
- Notes: /wp-admin accessible, MySQL exposed

Constraints

• Confirm target scope with user before scanning
• Large network scans may take significant time
• UDP scans are slower than TCP
• Some scans require root/sudo privileges
• Always note authorization status