a fast, repeatable recon flow in Kali Linux

why every attacker starts here

before anyone touches an exploit, they map the terrain. that's what this four step flow does: find what's alive, figure out what it's running, id the web stack, then check if any of it has known holes. it's boring, it's fast, and it's the reason "nobody's gonna bother scanning my stuff" is wishful thinking. if you run this against your own network with permission, you'll see your infrastructure the same way an attacker would, which is exactly the point.

step 1: find what's actually alive

nmap -sn 192.168.1.0/24

this is a ping sweep. no port scanning yet, just "is anything answering at this ip." -sn means "no port scan," so it's quiet and quick. on your own network this is the fastest way to build an inventory of every device that's actually online right now, including that smart plug you forgot you bought in 2021.

step 2: fingerprint services and versions

nmap -sV -F 192.168.1.15

-sV grabs service and version banners (apache 2.4.41, openssh 8.2, that kind of thing). -F limits the scan to the 100 most common ports instead of all 65,535, which keeps things fast for a first pass. version info is gold for defenders too, because outdated versions are basically a public list of "check cve databases for me."

step 3: id the web stack

whatweb 192.168.1.15

whatweb fingerprints what's actually running a web app: cms, framework, javascript libraries, server software, sometimes even plugin versions. if you're running wordpress with a plugin from three years ago, whatweb will happily point that out. this is the step most people skip on their own sites and it's the step that finds the most low hanging fruit.

step 4: check for known issues

searchsploit apache 2.4.41

searchsploit is a local, offline database of publicly known exploits. you feed it a service name and version, it tells you if there's a documented issue for it. no internet connection needed, no noisy traffic to a third party site. for a defender, this is a free vulnerability check: run your own software versions through it before an attacker does.

what this looks like from the other side of the fence

every step above generates traffic that your own monitoring should be able to see. ping sweeps show up as a burst of icmp or arp traffic across a subnet. port scans show up as connection attempts across a range of ports from a single source in a short window. whatweb and searchsploit are local tools, but the http requests whatweb makes will land in your web server logs looking like a normal browser visit with an odd user agent string. if none of this shows up in your logs when you test it against your own network, that's not good news, that means you have no visibility.

how to actually lock this down

you can't stop someone from scanning ip space that isn't yours, but you can make your own environment a lot less useful to scan. patch management is the biggest lever here: if searchsploit finds nothing on your services because your versions are current, the whole recon chain hits a dead end. turn off banner grabbing where you can, or at least don't advertise exact version numbers in headers. put a network intrusion detection system in place (suricata and snort both have solid free rulesets) so a ping sweep or port scan actually triggers an alert instead of sailing through silently. segment your network so a compromised device on one vlan can't just nmap its way into everything else. and run this exact flow against yourself on a schedule, quarterly at minimum, because your own recon results are a report card on how easy your network is to map.

the takeaway

recon is the reconnaissance equivalent of casing a house before a break in, and it works the same way for defenders as it does for attackers. run this flow against your own environment, see what it reveals, patch what's outdated, and make sure your logging would actually catch someone doing this to you without permission. the goal isn't to memorize commands, it's to know what your network looks like from the outside before someone else finds out first.