Active Reconnaissance

Overview

Active reconnaissance begins when you directly interact with the target. This room focuses on low-level but highly useful recon tools: the web browser and its developer tools, ping, traceroute, telnet, and netcat.

Core idea: active recon can leave logs on the target or along the network path, so it should only be done with proper authorization and with a clear reason for every connection you make.

1) Active vs Passive Recon

Unlike passive recon, active recon requires some form of direct contact with the target.

Important: even normal-looking browser activity is still active reconnaissance because you are connecting to the target system.

2) Web Browser Recon

A browser is one of the easiest active recon tools because it naturally blends in with normal user traffic while still giving you direct interaction with the target.

Shortcut: open Developer Tools with Ctrl + Shift + I on Linux/Windows or Option + Command + I on macOS.

3) Browser Extensions for Recon

Some browser add-ons make active recon more efficient without changing the core workflow.

Value: these tools let you inspect technology stacks, route traffic through testing tools, and alter how the site perceives your client.

4) ping

ping sends ICMP Echo requests to check whether a host is reachable and responding.

ping -c 5 MACHINE_IP
ping -c 10 MACHINE_IP

No reply does not always mean down: the host might be offline, but firewalls commonly block ICMP as well. Windows hosts often block ping by default.

5) traceroute

traceroute shows the path packets take to the target by manipulating TTL values and observing ICMP Time Exceeded responses from routers along the way.

traceroute MACHINE_IP

Reading output: each numbered line is a hop. Asterisks usually mean the expected ICMP reply was not received for that probe.

6) telnet for Banner Grabbing

Although Telnet is insecure for administration, the client is still useful as a simple TCP connector for interacting with services manually and grabbing banners.

telnet MACHINE_IP 80

Example HTTP request after connecting:

GET / HTTP/1.1
host: telnet

This can reveal server details such as:

Server: nginx/1.6.2

Why it matters: if a service talks over plain TCP and does not require encryption immediately, Telnet can help you speak enough of the protocol to identify versions and behavior.

7) netcat

netcat or nc is a more flexible TCP/UDP Swiss Army knife. It can act as a client or as a server.

Client mode

nc MACHINE_IP 80

Example HTTP request:

GET / HTTP/1.1
host: netcat

Server mode

nc -vnlp 1234

Use case: banner grabbing, manual protocol interaction, ad-hoc TCP listeners, and quick connectivity testing.

8) Putting the Tools Together

The room’s real point is that these simple tools combine into a practical recon workflow before you ever touch heavier scanners like Nmap.

  1. Use the browser and DevTools to inspect the web app like a normal user.
  2. Use ping to check reachability.
  3. Use traceroute to understand the network path.
  4. Use telnet or nc to check open TCP services and collect banners.

PT1 mindset: these are primitive compared with Nmap and Burp, but they are installed almost everywhere and are excellent for quick checks or quiet manual verification.

Active Recon Cheat Sheet

ping -c 10 MACHINE_IP
traceroute MACHINE_IP
telnet MACHINE_IP PORT_NUMBER
nc MACHINE_IP PORT_NUMBER
nc -lvnp PORT_NUMBER

Exam Notes (PT1)