Recon — Hub
External: Internal All The Things — Network Discovery
Tools for the first phase — discover hosts, ports, services, hidden web content, and low-hanging vulns before exploitation.
OSCP workflow: netdiscover (lab IP unknown) → RustScan or Nmap all ports → targeted scan → searchsploit → Gobuster / ffuf / Burp Suite → SQLMap after manual confirm.
Install tools: Installation - Kali Setup
📌 Tools in This Folder
| Note | Purpose | Typical port |
|---|---|---|
| Nmap | Port scan, service/version, NSE scripts | All |
| RustScan | Ultra-fast TCP port discovery → pipe to Nmap | All |
| netdiscover | ARP host discovery — find lab VM IP before nmap | LAN |
| Port Knocking - knock | Hidden SSH/services — knock sequence then connect | 22+ |
| Gobuster | Directory, vhost, DNS brute force | 80/443 |
| ffuf | Fast fuzzer — vhost, wildcard filter, params | 80/443 |
| Burp Suite | Manual web — intercept, repeater, SQLMap export | 80/443 |
| searchsploit | Exploit-DB lookup after version scan | — |
| Exploit-DB and searchsploit | EDB ID ↔ URL ↔ local path mapping | — |
| DNS (dig & host) | DNS records, zone transfer, dnsrecon, reverse lookup | 53 |
| Nikto | Web vulnerability scanner | 80/443 |
| WPScan | WordPress enum & vuln scan | 80/443 |
| CMSeeK - cmseek | CMS detect (180+ CMSs) — WP/Joomla/Drupal | 80/443 |
| SQLMap | Automated SQL injection | 80/443 |
| Pidgin | XMPP/Jabber client — user & room enum | 5222/5223 |
| ldapsearch | LDAP / AD queries — users, groups, SPNs | 389/636 |
| snmpwalk | SNMP MIB walk — processes, users, creds | 161/udp |
| Mail (SMTP POP3 IMAP) | SMTP/POP3/IMAP — enum users, read mail for creds | 25/110/143 |
| GraphQL - Bruno | GraphQL introspection, Voyager schema map, API abuse | 80/443 |
| Pidgin | XMPP / Java RMI enum & exploit — port 1099, 9010+ | 1099 |
| nbtscan | NetBIOS names — ports 137/139, SMB prep | 137 |
📌 Standard Recon Flow
0. netdiscover -i eth0 (local lab — find target IP)
1. nmap -p- --min-rate 1000 -oA allports TARGET
2. nmap -sC -sV -p<ports> -oN targeted TARGET
3. searchsploit "service version"
4. gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt
OR ffuf -w wordlist -u http://TARGET/FUZZ -fs BASELINE_SIZE
5. dig axfr domain @NS_IP
6. nikto -h http://TARGET
7. wpscan --url http://TARGET (if WordPress)
8. sqlmap -u "http://TARGET/page?id=1" --batch (after manual SQLi confirm)
Parse nmap ports for step 2
grep "^[0-9]" allports.txt | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//'See Pipelines & Chaining.
📌 Related Tool Suites (Other Folders)
| Need | Go to |
|---|---|
| SMB / Windows enum | SMB |
| AD user enum | Kerbrute in Active Directory |
| LDAP / port 389 | ldapsearch → UseCases for ports |
| SNMP / port 161 | snmpwalk → UseCases for ports |
| XMPP / port 5222 | Pidgin → UseCases for ports |
| Mail / 25, 110, 143 | Mail (SMTP POP3 IMAP) → UseCases for ports |
| Database ports | Database |
| Network concepts | Networking |