Reconnaissance (recon) is the first phase of any security assessment. It involves gathering information about a target network before launching any actual attack. Think of it as a digital stakeout — you map out the terrain, discover live hosts, open ports, running services, and potential entry points.
Nmap is the industry-standard tool for network discovery. It sends raw packets and analyses responses to discover hosts and services.
The -sS flag sends SYN packets without completing the TCP handshake — harder to detect.
Every open port is a potential entry point. Understanding port states is critical:
Nmap analyses TCP/IP stack behaviour to guess the operating system. Different OSes handle packets differently — TTL values, window sizes, and TCP options give them away.
Read the scan output below and answer:
How many services are running? Which port is filtered? What OS is likely running?
Design a step-by-step recon methodology suitable for a penetration test. Your plan should cover all three phases:
OSINT, DNS enumeration, whois, Shodan — no direct contact with target.
Ping sweeps, port scans, service versioning, OS detection.
Map the network topology, list all discovered services, prioritise targets.
Write your methodology below — be specific about which tools and flags you would use at each stage.
1. What does the -sS flag in Nmap do?
2. Which port state indicates a firewall is blocking probes?
3. What is the main difference between active and passive recon?