06. Reconnaissance — Centered on nmap 🔍¶

Before you attack, know your target first. Don't fire blindly — recon first, then pick your target. That's the fundamental principle.

Scanning the network to find out "what's where"

Reconnaissance isn't only nmap¶

Reconnaissance comes in three broad types, and nmap is just one part of it (active reconnaissance).

flowchart TD
    R["Reconnaissance"] --> P["Passive recon<br>Gather info without touching the target<br>OSINT (WHOIS/DNS/GitHub/social media)"]
    R --> A["Active recon<br>Actually touch the target<br>nmap / banner grabbing"]
    R --> S["People & physical<br>Social engineering<br>Phishing / physical recon"]
    style R fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3
    style P fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3
    style A fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
    style S fill:#2d333b,stroke:#bc8cff,stroke-width:2px,color:#e6edf3

Real-world intrusions often start with reconnaissance that targets people — for example, "use OSINT to figure out the company's email format, then phish to steal credentials." This guide focuses on hands-on nmap (active reconnaissance), but keep in mind that reconnaissance is much broader than that.

nmap in practice — 3 steps¶

For reconnaissance, it's enough to learn "this software is running on this port."

STEP 1: Which ports are open¶

nmap -p 8088 localhost

PORT     STATE SERVICE
8088/tcp open  http

open = the door is open. Something is running here.

STEP 2: What's running (version)¶

nmap -sV -p 8088 localhost

PORT     STATE SERVICE VERSION
8088/tcp open  http    Jetty 9.2.11.v20150529

We've identified Jetty 9.2.11. Once you know the version, you can look into whether there are any known vulnerabilities.

STEP 3: Dig into the details (NSE scripts)¶

nmap -p 8088 --script http-title,http-headers localhost

|_http-title: Struts2 Showcase - Fileupload sample
|   Set-Cookie: JSESSIONID=...;Path=/
|   Server: Jetty(9.2.11.v20150529)

Here we get the decisive clues.

Clue	What it tells us
`http-title: Struts2 Showcase`	Might be Struts2 (self-reported, so weak evidence)
`Set-Cookie: JSESSIONID`	Built with Java (strong evidence)
URL ends in `.action`	Specific to Struts2 (strong evidence)

💡 Don't trust the title alone. Self-reported information can be a lie. Make your judgment by stacking up objective clues such as JSESSIONID (Java) or .action (specific to Struts2). This is the skill of "reading the results."

From reconnaissance to attack¶

A Struts2 app running on Jetty (URL: /showcase.action)
   ↓ therefore
"Let's try whether a known Struts2 vulnerability (S2-045) lands"
   ↓
→ On to Metasploit

That said, at this point it's still a guess. Whether it's "actually vulnerable" gets turned into certainty with Metasploit's check (next chapter).

Investigate the tech stack with multiple tools¶

To learn "what the target is built with, and which version," you use not only nmap but also quick, lightweight tools.

Tool	How it investigates
`nmap -sV`	Service and version over the port (comprehensive)
`whatweb http://...`	Hit the URL and identify the tech in one shot
Wappalyzer	Browser extension. Just open the site (the easiest)
`curl -I http://...`	Look at response headers (`Server:`, `Set-Cookie:`)

💡 In practice, the efficient order is "get a rough idea with lightweight tools (whatweb / Wappalyzer / curl) → dig deeper with nmap."

curl -sI http://localhost:8088/showcase.action
# Set-Cookie: JSESSIONID=...   ← evidence of Java
# Server: Jetty(9.2.11...)      ← the server is Jetty

Even without waiting for an nmap scan, a single look at the headers tells you a lot.

A full list of nmap options is collected in Appendix A. Reference. ⚠️ The only things you may point nmap at are your own property and scanme.nmap.org. Watch out for accidents where a typo in the range specification hits someone else.

Next: 07. Exploitation (Metasploit).