Reconnaissance Knowledge

Service Enumeration

• enum4linux - SMB/Samba enumeration
• smbclient - SMB interaction
• showmount - NFS enumeration
• snmpwalk - SNMP enumeration

DNS/Subdomain

• dig - DNS queries
• host - DNS lookups
• nslookup - DNS information

Layered Reconnaissance Strategy

Core Principle: Every reconnaissance task has 3 layers - escalate when previous layer yields insufficient results.

Layer Framework for Each Task:

Layer 1 (Quick & Broad):
  - Fast tools with default parameters
  - Goal: Get initial foothold information
  - Time: 1-5 minutes
  - Example: nmap top 1000 ports, gobuster with small wordlist

Layer 2 (Deep & Intensive):
  - Same tools with aggressive parameters
  - Goal: Extract maximum information from known services
  - Time: 5-30 minutes
  - Example: nmap all ports + version detection, gobuster with large wordlist

Layer 3 (Alternative & Creative):
  - Different tools or manual techniques
  - Goal: Find information that standard tools miss
  - Time: Variable
  - Example: Manual banner grabbing, alternative scanners, custom scripts

Escalation Triggers:

• Layer 1 returns nothing → Escalate to Layer 2
• Layer 2 returns minimal info → Escalate to Layer 3
• Layer 3 still insufficient → Re-evaluate entire approach

Reconnaissance Phases

Phase 1: Port Discovery

Goal: Find all open ports

# Quick scan (top 1000 ports)
nmap -p- --min-rate=1000 -T4 TARGET

# Comprehensive scan (all ports)
nmap -p- -T4 TARGET -oN ports.txt

Output Format:

{
  "ports": [
    {"port": 22, "state": "open", "protocol": "tcp"},
    {"port": 80, "state": "open", "protocol": "tcp"}
  ]
}

Phase 2: Service Detection

Goal: Identify services and versions

# Service version detection
nmap -p22,80,443 -sV -sC -A TARGET -oN services.txt

# Aggressive scan with scripts
nmap -p22,80 -sC -sV --script=default,vuln TARGET

Output Format:

{
  "services": [
    {
      "port": 22,
      "service": "ssh",
      "version": "OpenSSH 7.6p1",
      "os": "Ubuntu Linux"
    },
    {
      "port": 80,
      "service": "http",
      "version": "Apache httpd 2.4.29",
      "technologies": ["PHP/7.2"]
    }
  ]
}

Phase 3: Web Enumeration (if HTTP/HTTPS found)

Goal: Discover hidden files, directories, and web technologies

Layered Web Scanning:

# Layer 1: Quick directory scan
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt -x php,html,txt -t 50

# If Layer 1 finds little/nothing, escalate to Layer 2:
# Layer 2: Deep directory scan with larger wordlist
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt,zip,bak -t 100

# If still insufficient, try Layer 3:
# Layer 3: Alternative tools or techniques
# Option A: Different tool
feroxbuster -u http://TARGET -w /usr/share/wordlists/dirb/common.txt

# Option B: Vulnerability scanner
nikto -h http://TARGET

# Option C: Technology detection
whatweb http://TARGET

# Alternative with larger wordlist
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50

# Technology detection
whatweb http://TARGET

# Vulnerability scan
nikto -h http://TARGET

Output Format:

{
  "web": {
    "url": "http://10.10.10.1",
    "technologies": ["Apache/2.4.29", "PHP/7.2", "WordPress 5.0"],
    "directories": [
      "/admin (Status: 403)",
      "/uploads (Status: 301)",
      "/backup (Status: 200)"
    ],
    "files": [
      "/config.php (Status: 200)",
      "/README.txt (Status: 200)"
    ],
    "vulnerabilities": [
      "Outdated WordPress version",
      "Directory listing enabled on /uploads"
    ]
  }
}

Phase 4: Specific Service Enumeration

SMB (Port 139/445)

# Basic enumeration
enum4linux -a TARGET

# List shares
smbclient -L //TARGET -N

# Check for anonymous access
smbmap -H TARGET

FTP (Port 21)

# Check for anonymous login
ftp TARGET
# Try: anonymous / anonymous

# Banner grab
nc TARGET 21

SSH (Port 22)

# Get SSH version and algorithms
ssh -v TARGET

# Check for user enumeration
ssh user@TARGET 2>&1 | grep -i "invalid\|denied"

MySQL/MSSQL (Port 3306/1433)

# Banner grab
nc TARGET 3306

# Test default credentials
mysql -h TARGET -u root -p
# Try common passwords: root, admin, password, ''

Best Practices

1. Structured Output

Always format discoveries in JSON for easy parsing:

# Example: Parse nmap output to JSON
nmap -p- TARGET -oG - | grep "Ports:" | awk '{print $2, $4}' | sed 's/\/open//' | jq -R -s 'split("\n") | map(select(length > 0) | split(" ") | {port: .[1], service: .[0]})'

2. Stealth vs Speed

• For playground environments: Use aggressive scans (-T4, --min-rate=1000)
• For real environments: Use slower, stealthy scans (-T2)

3. Save All Output

# Always save raw output
nmap ... -oN nmap-full.txt -oX nmap-full.xml

# Save discoveries to state file
cat discovered.json >> .pentest-state.json

4. Comprehensive Coverage

Don't miss:

• UDP ports (slower but important): nmap -sU --top-ports 100 TARGET
• All TCP ports: nmap -p- TARGET
• Web directories with multiple wordlists
• Default credentials for all services found

5. Time Management

• Quick initial scan: 5 minutes max
• Comprehensive scan: 15-20 minutes max
• This is a playground, not real-world - speed matters

Common Wordlists

# Small (fast)
/usr/share/wordlists/dirb/common.txt

# Medium (balanced)
/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

# Large (comprehensive)
/usr/share/wordlists/dirbuster/directory-list-2.3-big.txt

# Specific to web apps
/usr/share/wordlists/wfuzz/general/common.txt

Output Template

After completing reconnaissance, provide summary in this format:

{
  "target": "10.10.10.1",
  "scan_date": "2025-01-15",
  "discovered": {
    "ports": [
      {"port": 22, "service": "ssh", "version": "OpenSSH 7.6p1"},
      {"port": 80, "service": "http", "version": "Apache 2.4.29"}
    ],
    "web": {
      "technologies": ["Apache", "PHP", "WordPress"],
      "interesting_paths": ["/admin", "/uploads", "/wp-admin"],
      "vulnerabilities": ["Outdated WordPress", "Directory listing"]
    },
    "potential_vectors": [
      "File upload via /uploads",
      "WordPress plugin vulnerabilities",
      "SSH password authentication enabled"
    ]
  },
  "recommended_actions": [
    "Test file upload functionality on /uploads",
    "Search for WordPress exploits for version detected",
    "Enumerate WordPress users with wpscan"
  ]
}

Key Principles

1. Thoroughness: Don't miss services or directories
2. Structure: Always output JSON for coordinator to parse
3. Speed: Balance between comprehensive and efficient
4. Context: Provide next-step recommendations
5. No Exploitation: Stay in recon phase, don't test exploits

Handoff to Next Phase

When reconnaissance is complete, provide:

1. Complete service inventory
2. Identified vulnerabilities
3. Recommended exploitation approaches
4. Any discovered credentials/default logins
5. Updated .pentest-state.json

After reconnaissance is sufficient, proceed to the exploitation phase using exploitation knowledge.