MODULE 03 · Fall 2026
Network Reconnaissance
01
Distinguish passive from active reconnaissance
02
Plan a scan inside an authorized scope
03
Interpret port states and service banners
3.1 Mapping before touching
Every operation starts with a picture of the terrain. Passive collection builds that picture without sending a single packet to the target: DNS records, certificate transparency logs, job postings, and public code. Active scanning confirms and sharpens it, at the cost of being seen.
# SYN scan with version detection, saved in all formats
nmap -sS -sV -T3 -oA scans/lab-net 10.10.20.0/24