# Recon Arsenal

> One line: port/host/service discovery tool arsenal for authorized engagements. Pack in trigger signals so it auto-loads: "new target", "enumerate", "scan", an in-scope target, open-port lists needing deeper enum. Authorized, in-scope targets only.

- Skill: `noorqureshi/recon-arsenal` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/recon-arsenal`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/recon-arsenal/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/recon-arsenal

---


# Recon / enumeration arsenal

Tool selection for port/host/service discovery on **authorized lab targets only**
(in-scope hosts recorded in `scope.txt`). Pick the tool, run the exact command,
log the reasoning in `notes.md`.

## 1. Port / service scanning

**nmap** — the workhorse; scriptable, accurate service/version detection, keeps you honest.
- `nmap -sC -sV -oA recon/nmap-tcp $TARGET` — `-sC` default NSE scripts, `-sV` version detection, `-oA` writes .nmap/.gnmap/.xml (feed later tools).
- `nmap -p- --min-rate 5000 -oA recon/nmap-allports $TARGET` — `-p-` all 65535 ports, `--min-rate` forces pace so it finishes.
- `nmap -sC -sV -p 22,80,445 -oA recon/nmap-targeted $TARGET` — re-scan only the ports `-p-` found, deeply.
- `nmap -sU --top-ports 100 -oA recon/nmap-udp $TARGET` — `-sU` UDP; slow, so cap to top ports.
- `nmap -sV --version-intensity 9 -p 4444 $TARGET` — max probe effort on a stubborn/unknown service port.
- `nmap -Pn -sC -sV $TARGET` — `-Pn` skip host-discovery ping (hardened hosts often drop ICMP → "host down").
- `nmap --script "smb-enum-shares,smb-os-discovery" -p445 $TARGET` — targeted NSE; `--script vuln` for a vuln sweep.
- Gotcha: run the fast `-p-` sweep FIRST, then `-sC -sV` only the open ports — scripts on all 65535 ports wastes minutes.

**rustscan** — sweeps all ports in seconds, then hands off to nmap; use it to find the open set fast.
- `rustscan -a $TARGET --range 1-65535 -- -sC -sV` — everything after `--` is passed straight to nmap.
- Gotcha: on flaky VPN, add `--ulimit 5000` and lower `-b` (batch) or it drops ports.

**masscan** — asynchronous, fastest for wide ranges; prefer it over rustscan/nmap for whole /24 subnet sweeps.
- `masscan -p1-65535 10.129.0.0/24 --rate 1000 -oL recon/masscan.txt` — `--rate` packets/sec (keep modest on VPN).
- Gotcha: no version detection — always re-scan the hits with `nmap -sV`.

## 2. Host discovery / ping sweep

**nmap -sn** — quick liveness map of a subnet without port-scanning.
- `nmap -sn 10.129.0.0/24 -oA recon/hosts` — `-sn` ping-only, no ports.

**fping** — faster mass-ping alternative; good in a script loop.
- `fping -a -g 10.129.0.0/24 2>/dev/null` — `-a` show alive only, `-g` generate range.

## 3. DNS & vhost discovery

**dig** — first check for a zone transfer, the easy win.
- `dig axfr @$TARGET domain.local` — AXFR full zone dump if the DNS server allows it.
- `dig any domain.local @$TARGET` — pull all records.

**dnsenum** — automated brute + AXFR + record enum in one shot.
- `dnsenum --dnsserver $TARGET domain.local`

**gobuster dns** — subdomain brute-force against a DNS server.
- `gobuster dns -d domain.local -r $TARGET -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt`

**ffuf (vhost fuzzing)** — find name-based virtual hosts behind one IP via the `Host:` header.
- `ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://$TARGET -H "Host: FUZZ.domain.local" -fs 0` — `-fs` filter by size; set it to the wildcard/default page size to hide noise.

**gobuster vhost** — same idea, gobuster syntax.
- `gobuster vhost -u http://domain.local --append-domain -w <wordlist>`

**wfuzz** — flexible fallback when you need custom filtering.
- `wfuzz -c -w <wordlist> -H "Host: FUZZ.domain.local" -u http://$TARGET --hh <hide-chars>`
- Gotcha: any hostname you discover must go in `/etc/hosts` (`$TARGET domain.local sub.domain.local`) — `*.local` names don't resolve otherwise, and vhost routing needs the Host header to match.

## 4. SMB / RPC / NetBIOS

**enum4linux-ng** — modern rewrite; one command dumps shares, users, groups, OS, null sessions.
- `enum4linux-ng -A $TARGET` — `-A` all enumeration.

**smbclient** — list and browse shares directly.
- `smbclient -N -L //$TARGET` — `-N` no password (null session), `-L` list shares.
- `smbclient -N //$TARGET/share` — connect to one share.

**rpcclient** — null-session RPC; enumerate users/SIDs when SMB shares are locked down.
- `rpcclient -U "" -N $TARGET` — then `enumdomusers`, `queryuser 0x<rid>`.

**nmblookup** — NetBIOS name/workgroup resolution.
- `nmblookup -A $TARGET` — `-A` query by IP.

**netexec (nxc / crackmapexec)** — fast auth + share sweep, great for spraying/null checks.
- `nxc smb $TARGET -u '' -p '' --shares` — null-session share listing.
- `nxc smb $TARGET -u user -p pass --shares` — authenticated view once you have creds.
- Gotcha: `crackmapexec` is deprecated → use `nxc` (netexec); same flags.

## 5. SNMP

**snmpwalk** — dump the MIB when SNMP (UDP 161) is open; often leaks users, processes, routes.
- `snmpwalk -c public -v2c $TARGET` — `-c public` default community string, `-v2c` version.

**onesixtyone** — brute the community string first if `public` fails.
- `onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt $TARGET`

## 6. NFS

**showmount** — list exported shares before mounting.
- `showmount -e $TARGET` — `-e` show exports; then `mount -t nfs $TARGET:/export /mnt/nfs`.

## 7. Quick service probes

**nc** — grab a raw banner on any TCP port.
- `nc -nv $TARGET 21` — `-n` no DNS, `-v` verbose.

**curl** — inspect HTTP headers/redirects without a browser.
- `curl -sI http://$TARGET` — `-s` silent, `-I` headers only (Server, redirects, cookies).

**ldapsearch** — anonymous bind against LDAP (389) leaks the naming context / users.
- `ldapsearch -x -H ldap://$TARGET -b "dc=corp,dc=local"` — `-x` simple auth, `-b` search base.
- `ldapsearch -x -H ldap://$TARGET -s base namingcontexts` — find the base DN first.

**ftp** — anonymous login check on 21.
- `ftp $TARGET` → login `anonymous` / any password; `ls -la` for readable/writable dirs.

## 8. All-in-one

**autorecon** — fires the whole suite (nmap + per-service enum) and files the output; use as a background first pass while you work leads manually.
- `autorecon $TARGET` — writes structured `results/` per host.
- Gotcha: on real engagements, **manual > automated** — autorecon is a starting map, not a substitute for reading each service yourself.

## Gotchas / discipline
- Hardened hosts frequently show ports `filtered` and drop ICMP → always add `-Pn`, and `--min-rate 5000` so scans don't stall.
- Always run a full `-p-` scan AFTER the top-1000 — the interesting service (WinRM 5985, a dev port, a hidden vhost) is often up in the high ports.
- UDP is slow and unreliable — scan `--top-ports 100` only, don't wait on a full `-sU -p-`.
- Re-scan discovered ports with `-sC -sV`; a fast sweep tells you *what's open*, not *what it is*.
- Golden rule: **when stuck, enumerate more** — a missed service, subdomain, or share is far more likely than a missing exploit.