Active reconnaissance collects information by directly interacting with the target. This phase sends packets, requests, and probes to identify open ports, running services, versions, and technologies. Active recon is noisier and detectable, so it must be performed carefully and within scope. The goal is to map the attack surface accurately and identify the services that may contain vulnerabilities.

Port Scanning

Port scanning identifies which ports are open, closed, or filtered on a target system. Open ports reveal active services that can be tested further. Closed ports confirm that the host is reachable. Filtered ports indicate that a firewall is blocking responses.

Purpose of Port Scanning

Port scanning helps pentesters determine:

• Which services are available

• How firewalls behave

• Which ports are reachable externally

• Which internal ports are exposed after pivoting

• What protocols are running on each port

Accurate port scanning creates the base map for deeper enumeration.

Types of Port Scans

Pentesters use different scanning techniques depending on the environment and restrictions.

TCP connect scans perform a full connection. They are reliable but easily detected because they complete the handshake.

TCP SYN scans send only a SYN packet. If the target responds with SYN-ACK, the port is open. This method is faster and stealthier because it does not complete the handshake.

UDP scans send UDP packets to discover services like DNS or SNMP. These scans are slower and often require retries because UDP does not guarantee responses.

ACK scans check how firewalls handle packets. They do not identify open ports but help detect filtering and firewall rules.

Ping sweeps use ICMP to identify live hosts before scanning ports. Many firewalls block ICMP, so pentesters combine multiple discovery techniques.

Interpreting Scan Results

Port states guide the next steps:

• Open ports indicate running services

• Closed ports show reachable hosts

• Filtered ports suggest firewall presence

• Open and filtered together indicate ambiguous filtering

These states influence what techniques to use next.

Service Fingerprinting

Service fingerprinting identifies which service and which version is running behind each open port. Fingerprinting is essential because most exploits target specific versions, misconfigurations, or protocol behaviors.

Banner Grabbing

Banner grabbing retrieves service banners that reveal:

• Software name

• Version number

• Operating system hints

• Configuration details

Pentesters gather banners using tools or direct connections. Some services intentionally hide banners, but small misconfigurations can expose sensitive details.

Version Detection

Version detection sends crafted probes to services to analyze how they respond. Different implementations respond uniquely, allowing tools to match responses to known fingerprints.

This process identifies:

• Web server types

• SSH versions

• FTP servers

• Database engines

• Mail servers

Once versions are known, pentesters compare them with known vulnerabilities and exploitation paths.

Protocol Analysis

Protocol analysis examines how a service communicates. Pentesters observe:

• Response codes

• Headers

• Timing behavior

• Supported features

• Authentication methods

This reveals misconfigurations such as outdated ciphers, weak authentication, or unnecessary services.

Identifying Hidden Services

Some services may not respond normally and require deeper analysis. Pentesters detect these through:

• Custom packet crafting

• Observing inconsistent responses

• Analyzing timing differences

• Checking uncommon port mappings

• Testing protocols on unexpected ports

Hidden services often contain older or less monitored systems.

Combining Scanning and Fingerprinting

Port scanning identifies the entry points. Fingerprinting reveals what each entry point contains. Both steps guide exploitation and vulnerability mapping.

After identifying open ports and service versions, pentesters proceed with:

• Enumerating service features

• Checking misconfigurations

• Mapping potential vulnerabilities

• Planning exploitation attempts

Accurate recon reduces noise during exploitation and helps avoid wasting time on irrelevant ports.

Why Active Recon Matters

Active recon transforms raw network access into actionable intelligence. It reveals the exact services, versions, and behaviors of systems. Without active recon, exploitation becomes unpredictable and inefficient. Proper scanning and fingerprinting create a structured and informed approach to the rest of the assessment.

Intel Dump

• Active recon interacts with the target to gather detailed information

• Port scanning identifies open, closed, and filtered ports

• SYN, connect, UDP, ACK, and ICMP methods serve different purposes

• Service fingerprinting identifies software, versions, and protocol behavior

• Banner grabbing and version detection reveal vulnerabilities

• Active recon builds the foundation for accurate exploitation and enumeration