/network-recon

name: network-recon
description: "Plans authorized network reconnaissance, checks proposed targets against explicit IP scope, chooses scanning tools by cost, and audits completed scans for coverage. Use when mapping a network, enumerating hosts and services, deciding which scanner to run, or determining whether an empty scan is a finding or a failure."
allowed-tools: Read Grep Glob Bash

Network recon

Running a scanner is not the skill. Anyone can run nmap. The skill is choosing the right tool for the cost you can afford, and knowing when the output is lying to you.

**An empty result and an unanswered question look identical.** Most recon mistakes are made in the gap between those two.

When to Use

• Mapping a network, enumerating hosts and services, deciding which scanner to run, or determining whether an empty scan is a finding or a failure.
• Use only within explicit authorization and the stated rules of engagement.

When NOT to Use

• Do not treat this skill as permission to access, test, or change a target.
• Do not convert missing evidence into a clean result or a stronger claim.

This skill is loud, on purpose

It assumes **penetration test** conditions: an agreed scope, completeness as the deliverable, and noise that nobody is scoring you on. Every recommendation here optimises for *not missing things*.

**Do not apply it to a red team operation.** Red teaming optimises for the opposite thing — reaching an objective without being detected, and testing the security programme itself: people, processes, technology. A 65,535-port sweep is correct practice here and disqualifying there. The tooling overlaps; the optimisation function is reversed, and so is the right answer at almost every decision point.

If stealth is a requirement, you want a quiet-enumeration skill, and this is not it.

Scope first, always

Establish and write down the authorized scope before the first packet. Refuse targets outside it. A scan is an action against someone else's property; the scope statement is the only thing that makes it legitimate, and "it was in the same /16" is not a scope statement.

Treat authorization as a ceiling, not as a target list. When a request names specific proposed targets inside a wider authorized range, admit only those targets that pass the scope check. Do not expand discovery to the rest of the range unless the requested target set explicitly includes it.

Before scanning, record IP/CIDR scope and proposed targets in a manifest and run the deterministic check:

uv run {baseDir}/scripts/check_scope.py scope.json

{
  "authorized": ["10.0.0.0/24"],
  "excluded": ["10.0.0.64/27"],
  "targets": ["10.0.0.12", "10.0.0.128/26"]
}

Exit `0` means every target is wholly contained in authorization and overlaps no exclusion. Exit `1` names targets to refuse. Exit `2` means the manifest is invalid or empty, so no scope decision was measured. The checker accepts IPs and CIDRs only; resolve and authorize hostnames explicitly rather than making the checker contact DNS.

Tool selection

**Two stages, never one.** Fast discovery to find what is alive and listening, then a targeted deep scan only on what answered. A single thorough scan across an undiscovered range is the most common way to burn a day.

**Nmap carries ~99% of the work.** The others earn their place by being faster at discovery, and they hand back to Nmap for fidelity.

| Goal | Tool | Cost | When it is the wrong choice | |---|---|---|---| | Find live hosts, layer 2 / local subnet | `netdiscover` (ARP) | seconds | Useless off-segment — ARP does not route | | Sweep a large subnet for alive hosts | `masscan` | seconds–minutes | Trades precision and fingerprinting for raw speed. **Alive-tracking only**, then drop into Nmap | | Find open TCP ports fast, all 65,535 | `rustscan` | seconds | Slow or lossy links can cost accuracy; it is a front end, not an answer | | Initial TCP discovery | `nmap -sS` + top-ports, tuned `--min-rate` | seconds–minutes | Top-ports alone **will** miss non-standard ports. Never the last scan | | Full TCP coverage | `nmap -p-` on discovered hosts | minutes–hours | Skipping it is how low-hanging fruit on odd ports gets missed | | Service and version fidelity | `nmap -sV -sC` or `--script=safe,default` | minutes | Noisier and slower; without it, service names are guesses from port numbers | | UDP, fast | `rustscan --udp` | seconds–minutes | **Finds only UDP ports that send back a response.** Silent services are invisible — a clean result here proves very little | | UDP, complete | `nmap -sU` | hours to days on a full range | Almost always the wrong *default*. Scope it to the ports you care about and state the cost before starting |

**The standard chain:** `rustscan` or `masscan` for discovery → pipe the open ports into `nmap -sV -sC` for identification → `nmap -p-` to confirm nothing was missed.

**NSE:** `--script=safe,default` is the useful, non-destructive tier — basic service information and versions without launching automated exploits. Treat anything outside `safe,default` as an action requiring its own authorization.

Protocol-specific enumeration

Once ports are known, stop using a network scanner and pivot:

| Service | Tool | |---|---| | Web — configuration and known issues | `nikto` | | Web — content and directory discovery | `gobuster`, `feroxbuster`, `ffuf` | | SMB / Windows — shares, users, null sessions | `enum4linux`, `netexec` (formerly CrackMapExec) |

"Allowed" is context, not a property

Lists of permitted tools belong to the context that issued them. The tiering above reflects what is sanctioned in OffSec exam conditions, which is a useful baseline because it was drawn to exclude automated exploitation. **It is not a permission slip anywhere else.** In an engagement the authority is the client's rules of engagement, and in a lab it is the lab's. Check the authority that actually governs the target in front of you.

Reading result