pentest-recon

name	pentest-recon
description	Reconnaissance and information gathering tool reference. Covers nmap (port scanning, service detection, NSE scripts), whatweb, enum4linux, nbtscan, whois, dig, and on-demand tools (masscan, recon-ng, theHarvester, fierce, dnsenum, amass, subfinder). Use for any recon phase of a penetration test.
version	2.0.0
triggers	["recon","reconnaissance","nmap","port scan","host discovery","service detection","whatweb","enum4linux","whois","dig","masscan","subdomain","enumeration"]

Reconnaissance — Tool Reference

---

Nmap — Network Mapper

Host Discovery

# Ping sweep — find live hosts
nmap -sn <target>/24

# ARP scan (LAN only — fastest)
nmap -PR -sn <target>/24

# TCP SYN + ICMP ping (bypasses ICMP blocking)
nmap -PS22,80,443 -PA80,443 -sn <target>/24

Port Scanning

# Top 1000 ports + service detection (fast default)
nmap -sV <target>

# All 65535 TCP ports + service + OS + scripts
nmap -sV -sC -O -p- <target>

# Stealth SYN scan (no full TCP handshake)
nmap -sS -Pn <target>

# Aggressive scan (OS + version + scripts + traceroute)
nmap -A -T4 <target>

# Specific ports
nmap -sV -p 21,22,80,443,445,3306,8080 <target>

# UDP top 100 (slow — use selectively)
nmap -sU --top-ports 100 <target>

# Fast scan — top 100, skip host discovery
nmap -Pn -F <target>

# Rate-limited stealth scan
nmap -sS -T2 -p- --max-retries 1 --min-rate 100 <target>

NSE Vulnerability Scripts

# All vuln scripts
nmap --script vuln -p <ports> <target>

# Web enumeration
nmap --script http-enum,http-headers,http-methods,http-title -p 80,443 <target>

# SSL/TLS audit
nmap --script ssl-enum-ciphers,ssl-cert -p 443 <target>

# SMB vulnerabilities (EternalBlue, etc.)
nmap --script smb-vuln*,smb-os-discovery,smb-enum-shares -p 445 <target>

# SSH enumeration
nmap --script ssh-auth-methods,ssh2-enum-algos -p 22 <target>

# DNS zone transfer
nmap --script dns-zone-transfer -p 53 --script-args dns-zone-transfer.domain=<domain> <target>

# FTP anonymous check
nmap --script ftp-anon -p 21 <target>

# MySQL enumeration
nmap --script mysql-info,mysql-enum,mysql-empty-password -p 3306 <target>

# All default scripts for discovered services
nmap -sC -sV -p <ports> <target>

Output Formats

# All formats (normal + XML + grepable)
nmap -sV -sC -oA /tmp/scan <target>

# XML for tool integration
nmap -sV -oX /tmp/scan.xml <target>

# Grepable for quick parsing
nmap -sV -oG /tmp/scan.gnmap <target>

Firewall Evasion

# Fragment packets
nmap -sS -f <target>

# Custom MTU
nmap -sS --mtu 24 <target>

# Decoy scan
nmap -sS -D RND:10 <target>

# Spoof MAC
nmap -sS --spoof-mac 0 <target>

# Combine evasion techniques
nmap -sS -f --mtu 24 --data-length 100 -D RND:10 --spoof-mac 0 <target>

---

Whatweb — Web Fingerprinting

# Basic fingerprint
whatweb <target>

# Aggressive mode (more tests)
whatweb -a 3 <target>

# Verbose output
whatweb -v <target>

# Scan multiple targets
whatweb -i targets.txt

# Output to file
whatweb --log-json=/tmp/whatweb.json <target>

---

Enum4linux — SMB/Samba Enumeration

# Full enumeration (users, shares, policies, groups)
enum4linux -a <target>

# User enumeration only
enum4linux -U <target>

# Share enumeration
enum4linux -S <target>

# Password policy
enum4linux -P <target>

# OS info
enum4linux -o <target>

# With credentials
enum4linux -u <user> -p <pass> -a <target>

---

Nbtscan — NetBIOS Scanner

# Scan subnet
nbtscan <target>/24

# Verbose output
nbtscan -v <target>/24

# Human-readable format
nbtscan -h <target>/24

---

WHOIS / DNS

# WHOIS lookup
whois <domain>
whois <ip>

# DNS queries
dig +short <domain> A
dig +short <domain> MX
dig +short <domain> NS
dig +short <domain> TXT
dig +short <domain> ANY
dig +short -x <ip>

# Zone transfer attempt
dig axfr @<nameserver> <domain>

# Full DNS info
dig <domain> ANY +noall +answer

---

On-Demand Recon Tools

Install when needed: apt-get update && apt-get install -y <package>

Masscan — High-Speed Port Scanner

# Install: apt-get install -y masscan
masscan -p1-65535 <target>/24 --rate=1000
masscan -p80,443 <target>/24 --banners -oJ /tmp/masscan.json

Recon-ng — OSINT Framework

# Install: apt-get install -y recon-ng
recon-ng
# Inside: workspaces create target
# modules load recon/domains-hosts/google_site_web
# options set SOURCE <domain>
# run

theHarvester — Email/Subdomain Harvester

# Install: apt-get install -y theharvester
theHarvester -d <domain> -b google,bing,linkedin -l 500
theHarvester -d <domain> -b all -f /tmp/harvest.html

Fierce — DNS Reconnaissance

# Install: apt-get install -y fierce
fierce --domain <domain>
fierce --domain <domain> --subdomains www,mail,ftp,admin

Dnsenum — DNS Enumeration

# Install: apt-get install -y dnsenum
dnsenum <domain>
dnsenum --enum <domain> -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

---

Tool Selection Guide

Situation	Best Tool
Don't know what's running	nmap -sV --top-ports 1000 <target>
Need all ports fast	masscan -p1-65535 <target> --rate=1000
Web server fingerprint	whatweb -a 3 <target>
Windows/SMB target	enum4linux -a <target>
DNS/subdomain recon	fierce --domain <domain> or dnsenum
Email/people OSINT	theHarvester -d <domain> -b all
Full OSINT framework	recon-ng
NetBIOS names on subnet	nbtscan <range>/24