Reconnaissance

---
name: Network Reconnaissance
description: |
  This skill should be used when the user asks about "nmap", "port scanning",
  "network reconnaissance", "service discovery", "masscan", "host discovery",
  "banner grabbing", or needs guidance on network enumeration techniques.
version: 1.0.0
---

# Network Reconnaissance Skill

## Overview
Comprehensive network reconnaissance techniques for identifying open ports, running services, and potential attack vectors on target systems.

## Port Scanning with Nmap

### Quick Discovery Scans
```bash
# Top 1000 ports with version detection
nmap -sC -sV -T4 <TARGET>

# Fast scan top 100 ports
nmap -F <TARGET>

# Ping sweep for network
nmap -sn 10.10.10.0/24
```

### Comprehensive Scans
```bash
# All TCP ports
nmap -p- -T4 --min-rate=1000 <TARGET>

# All TCP with version detection (slower but thorough)
nmap -p- -sC -sV <TARGET>

# UDP top 20 ports (requires root)
sudo nmap -sU --top-ports 20 <TARGET>
```

### Stealth Options
```bash
# SYN scan (default, requires root)
sudo nmap -sS <TARGET>

# Connect scan (no root required)
nmap -sT <TARGET>

# Slow scan to evade IDS
nmap -T2 --scan-delay 1s <TARGET>
```

## Nmap Script Engine (NSE)

### Categories
```bash
# Vulnerability detection
nmap --script vuln <TARGET>

# Safe scripts (won't crash services)
nmap --script safe <TARGET>

# Default scripts (-sC equivalent)
nmap --script default <TARGET>

# Discovery scripts
nmap --script discovery <TARGET>
```

### Service-Specific Scripts
```bash
# HTTP enumeration
nmap --script http-enum -p80,443 <TARGET>

# SMB enumeration
nmap --script smb-enum* -p445 <TARGET>

# SMB vulnerabilities
nmap --script smb-vuln* -p445 <TARGET>

# FTP checks
nmap --script ftp-anon,ftp-bounce -p21 <TARGET>

# SSH enumeration
nmap --script ssh-* -p22 <TARGET>
```

## Alternative Tools

### Masscan (Faster than Nmap)
```bash
# Scan all ports quickly
masscan -p1-65535 <TARGET> --rate=1000

# Top ports
masscan -p80,443,22,21,25,3389 <TARGET> --rate=1000
```

### Rustscan (Fastest)
```bash
# Quick scan, pipe to nmap
rustscan -a <TARGET> -- -sC -sV
```

## Service Identification

### Banner Grabbing
```bash
# Netcat
nc -nv <TARGET> <PORT>

# Telnet
telnet <TARGET> <PORT>

# Curl for HTTP
curl -I http://<TARGET>
```

### Version Detection
```bash
# Aggressive version detection
nmap -sV --version-intensity 5 -p<PORT> <TARGET>
```

## Common Ports Reference

| Port | Service | Notes |
|------|---------|-------|
| 21 | FTP | Check anonymous login |
| 22 | SSH | Version, auth methods |
| 23 | Telnet | Often unencrypted creds |
| 25 | SMTP | User enum, relay |
| 53 | DNS | Zone transfer |
| 80/443 | HTTP/S | Web testing |
| 88 | Kerberos | AD environment |
| 110/143 | POP3/IMAP | Mail access |
| 135 | MSRPC | Windows services |
| 139/445 | SMB | Shares, vulns |
| 389/636 | LDAP | AD enumeration |
| 1433 | MSSQL | xp_cmdshell |
| 3306 | MySQL | Default creds |
| 3389 | RDP | BlueKeep, brute |
| 5432 | PostgreSQL | Default creds |
| 5985/5986 | WinRM | PowerShell remote |
| 6379 | Redis | Unauth access |
| 8080 | HTTP-Alt | Web apps |
| 27017 | MongoDB | NoSQL |

## Output Management

### Save Results
```bash
# All formats
nmap -oA scan_results <TARGET>

# Grepable output
nmap -oG scan.gnmap <TARGET>

# XML for parsing
nmap -oX scan.xml <TARGET>
```

### Parse Results
```bash
# Extract open ports from grepable
grep "open" scan.gnmap | cut -d' ' -f2

# Convert XML to HTML
xsltproc scan.xml -o scan.html
```

## Troubleshooting

### Host Appears Down
```bash
# Skip host discovery
nmap -Pn <TARGET>
```

### Slow Scans
```bash
# Increase speed
nmap -T4 --min-rate=5000 <TARGET>
```

### Firewall Detected
```bash
# Fragment packets
nmap -f <TARGET>

# Use decoys
nmap -D RND:10 <TARGET>
```