/network-recon

name: network-recon
description: |
  Activate this skill whenever the user mentions port scan, port scanning, nmap, nmap scan,
  masscan, rustscan, service detection, service enumeration, service fingerprinting,
  network scan, network scanning, network mapping, network discovery, network topology,
  open ports, closed ports, filtered ports, banner grabbing, banner grab,
  host discovery, live hosts, ping sweep, ARP scan, ARP discovery,
  OS fingerprinting, OS detection, operating system detection, TCP fingerprinting,
  SYN scan, TCP scan, UDP scan, ACK scan, FIN scan, XMAS scan, NULL scan,
  stealth scan, half-open scan, connect scan, idle scan,
  timing template, scan evasion, IDS evasion, IPS bypass, firewall evasion,
  fragmentation scan, decoy scan, source port manipulation,
  DNS reconnaissance, DNS recon, zone transfer, subdomain enumeration,
  subdomain discovery, amass, subfinder, dnsx, dnsenum, fierce,
  DNS brute force, DNS cache snooping, DNSSEC walking,
  network pivoting, SSH tunnel, SOCKS proxy, port forwarding,
  chisel, ligolo, ligolo-ng, double pivot, pivot chain,
  vulnerability scanning, vulnerability scan, Nessus, OpenVAS, nuclei network,
  vulnerability correlation, CVE mapping, service vulnerability,
  autorecon, comprehensive scan, full port scan, top ports,
  SNMP enumeration, SMB enumeration, LDAP enumeration,
  network segmentation, VLAN discovery, subnet scanning,
  internal network scan, external network scan, perimeter scan.
version: 2.0.0

Network Reconnaissance

Network reconnaissance is the systematic process of discovering hosts, mapping open ports, fingerprinting services and operating systems, and identifying vulnerabilities across target networks. It is the foundation of every penetration test -- everything downstream (web testing, exploitation, lateral movement) depends on the quality of your initial network recon.

Reconnaissance Methodology

Follow this sequence. Each phase feeds the next. Skip phases only when scope explicitly restricts them.

Phase 1 -- Passive Reconnaissance

Gather intelligence without sending a single packet to the target. This phase has zero detection risk.

**Objectives**: Identify IP ranges, ASNs, known services, historical scan data, DNS records.

# Passive subdomain enumeration
subfinder -d target.com -silent -o subdomains.txt

# OSINT-based port data (Shodan, Censys)
# Use ctx_execute or Hexstrike MCP tools for API queries

**Integration**: Store discovered targets immediately.

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" network "passive-subdomains" "$(wc -l < subdomains.txt) subdomains found" --source "subfinder"

Phase 2 -- Host Discovery

Determine which hosts are alive before port scanning. Scanning dead hosts wastes time and generates noise.

**Tool Selection**:

• **Same LAN**: ARP scan (most reliable, cannot be firewalled)
• **Remote targets**: TCP SYN ping + ICMP + UDP combined
• **Firewall-heavy**: TCP ping on known-open ports (80, 443)

Load: `ToolSearch` -> `select:mcp__hexstrike-ai__arp_scan_discovery` (LAN targets)

# ARP discovery (local network only)
arp-scan --localnet --interface eth0

# Nmap host discovery combinations
nmap -sn -PE -PP -PS80,443,22 -PU53,161 -T3 10.0.0.0/24    # Standard
nmap -sn -PS80,443,8080,22,25 10.0.0.0/24                    # TCP-only (ICMP blocked)
nmap -sn -PR 10.0.0.0/24                                      # ARP only (local subnet)

See `references/host-discovery.md` for complete host discovery methodology.

Phase 3 -- Port Scanning

Discover open ports on live hosts. Tool selection depends on scope size and OPSEC requirements.

**Tool Ladder** (select based on scenario):

| Scenario | Tool | Speed | Accuracy | Stealth | |----------|------|-------|----------|---------| | Quick triage / CTF | RustScan | Fastest | Ports only | None | | Large scope (>256 hosts) | Masscan | Fast | Ports only | Low | | Standard engagement | Nmap SYN | Moderate | Good | Moderate | | Stealth required | Nmap with evasion | Slow | Good | High | | Maximum accuracy | Nmap TCP connect | Slow | Best | Low |

Load: `ToolSearch` -> `select:mcp__hexstrike-ai__rustscan_fast_scan` (quick discovery) Load: `ToolSearch` -> `select:mcp__hexstrike-ai__masscan_high_speed` (large scope) Load: `ToolSearch` -> `select:mcp__hexstrike-ai__nmap_scan` (standard) Load: `ToolSearch` -> `select:mcp__hexstrike-ai__nmap_advanced_scan` (deep)

# Standard SYN scan -- all ports
nmap -sS -p- -T4 --open --reason -oA full-syn target.com

# Masscan for speed, then nmap for accuracy
masscan -p1-65535 --rate=1000 -oL masscan-results.txt 10.0.0.0/24
nmap -sV -sC -p$(cat masscan-results.txt | grep open | cut -d' ' -f4 | sort -u | tr '\n' ',') target

See `references/port-scanning.md` for scan types, timing, and evasion techniques.

Phase 4 -- Service Enumeration

Identify service versions, technologies, and configurations on discovered ports.

# Version detection + default scripts on discovered ports
nmap -sV -sC -p22,80,443,445,3389 -oA service-enum target.com

# Aggressive service detection with OS guess
nmap -sV --version-intensity 9 -A -p- target.com

**Post-enumeration**: Log every discovered service to target-intel.

node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" service "22/tcp" "OpenSSH 8.9p1 Ubuntu" --source "nmap"
node ${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js add "target.com" service "443/tcp" "nginx 1.18.0" --source "nmap"

See `references/service-enum.md` for per-service enumeration tools and techniques.

Phase 5 -- OS Fingerprinting

Determine operating systems to prioritize exploits and understand the target environment.

# Active OS detection
nmap -O --osscan-guess target.com

# Combined with service version for best accuracy
nmap -O -sV --version-intensity 5 target.com

See `references/os-fingerprinting.md` for active and passive fingerprinting methods.

Ph