Network Reconnaissance Playbook

A systematic approach to network discovery and enumeration. You must complete all phases when doing recon.

When to Use This Skill

Activate this skill when the user needs to:

Discover live hosts on a network
Find open ports on a target
Identify running services and versions
Enumerate web services
Perform a full network assessment

Decision Tree

Task → What does the user need?
    │
    ├─ Find live hosts on a network?
    │   └─ Phase 1: Host Discovery
    │
    ├─ Find open ports on a known host?
    │   └─ Phase 2: Port Scanning
    │
    ├─ Identify what services are running?
    │   └─ Phase 3: Service Detection
    │
    ├─ Explore web services in detail?
    │   └─ Phase 4: Web Enumeration
    │
    └─ Full network assessment?
        └─ Run all phases in sequence

Phase 1: Host Discovery

Goal: Find live hosts on the target network.

# Ping sweep - fastest method
nmap -sn 192.168.1.0/24

# ARP scan - more reliable on local networks (requires root)
nmap -sn -PR 192.168.1.0/24

# Skip ping, assume hosts are up (for filtered networks)
nmap -Pn 192.168.1.0/24

Output parsing: Look for lines containing "Nmap scan report for" - these are your live hosts.

Next step: Record all discovered IPs, then proceed to Phase 2 for each host.

Phase 2: Port Scanning

Goal: Find open ports on discovered hosts.

Scan Type	Command	Use When
Quick (top 100)	`nmap -Pn -F <ips>`	Initial fast scan
Standard (top 1000)	`nmap -Pn <ips>`	Default reconnaissance
Full (all 65535)	`nmap -Pn -p- <ips>`	Thorough assessment
Specific ports	`nmap -Pn -p 22,80,443 <ips>`	Known services
UDP scan	`nmap -sU --top-ports 20 <ips>`	Check UDP services

Speed options:

# Faster scanning (less accurate)
nmap -T4 -F 192.168.1.1

# Aggressive timing
nmap -T5 192.168.1.1

Output parsing: Note all ports showing "open" state.

Next step: For each host with open ports, proceed to Phase 3.

Phase 3: Service Detection

Goal: Identify services and versions running on open ports.

# Version detection on all open ports
nmap -sV 192.168.1.1

# Version detection on specific ports (faster)
nmap -sV -p 22,80,443,3306 192.168.1.1

# Aggressive version detection
nmap -sV --version-intensity 5 192.168.1.1

# Include OS detection
nmap -sV -O 192.168.1.1

Combined scan (recommended for full assessment):

# Version + default scripts + OS detection
nmap -A 192.168.1.1

# Same but on specific ports
nmap -A -p 22,80,443 192.168.1.1

Output parsing: Record service names, versions, and any additional info from scripts.

Next step: For hosts with web ports (80, 443, 8080, 8443), proceed to Phase 4.

Phase 4: Web Enumeration

Goal: Gather details about web services.

Check HTTP headers:

# HTTP
curl -I http://192.168.1.1
curl -I http://192.168.1.1:8080

# HTTPS (ignore cert errors)
curl -Ik https://192.168.1.1

# Follow redirects
curl -ILk http://192.168.1.1

Grab page title and content:

# Get page content
curl -s http://192.168.1.1 | head -50

# Just the title
curl -s http://192.168.1.1 | grep -i '<title>'

Check common paths:

# Robots.txt
curl -s http://192.168.1.1/robots.txt

# Common admin paths
curl -I http://192.168.1.1/admin
curl -I http://192.168.1.1/login
curl -I http://192.168.1.1/wp-admin

Nmap HTTP scripts:

# HTTP enumeration
nmap --script http-enum -p 80 192.168.1.1

# HTTP headers
nmap --script http-headers -p 80 192.168.1.1

# HTTP methods
nmap --script http-methods -p 80 192.168.1.1

# All HTTP scripts
nmap --script "http-*" -p 80,443 192.168.1.1

Phase 5: Vulnerability Scanning (Optional)

Goal: Check for known vulnerabilities.

# Run vulnerability scripts
nmap --script vuln 192.168.1.1

# Check specific vulnerabilities
nmap --script smb-vuln-* -p 445 192.168.1.1
nmap --script ssl-heartbleed -p 443 192.168.1.1

Quick Reference Commands

Task	Command
Discover hosts	`nmap -sn 192.168.1.0/24`
Quick port scan	`nmap -Pn -F <ips>`
Full port scan	`nmap -Pn -p- <ips>`
Service versions	`nmap -Pn -sV <ips>`
Full assessment	`nmap -Pn -A <ips>`
Web headers	`curl -Ik https://192.168.1.1`
Vuln scan	`nmap --script vuln <ips>`

Output Format

After completing reconnaissance, summarize findings:

## Network Recon Summary

### Target: 192.168.1.0/24
### Hosts Discovered: 5

### Host: 192.168.1.1 (Gateway)
- Open Ports: 22, 80, 443
- Services:
  - 22/tcp: OpenSSH 8.2
  - 80/tcp: nginx 1.18.0
  - 443/tcp: nginx 1.18.0 (SSL)
- Web: Router admin panel, requires auth
- Notes: Default credentials may apply

### Host: 192.168.1.10 (Web Server)
- Open Ports: 22, 80, 3306
- Services:
  - 22/tcp: OpenSSH 8.4
  - 80/tcp: Apache 2.4.41
  - 3306/tcp: MySQL 8.0.27
- Web: WordPress site detected
- Notes: /wp-admin accessible, MySQL exposed

Constraints

Confirm target scope with user before scanning
Large network scans may take significant time
UDP scans are slower than TCP
Some scans require root/sudo privileges
Always note authorization status

network-recon