Reconnaissance is the foundation of any serious network engagement. Whether you're doing a CTF, a lab exercise, or an authorised pentest, the quality of your recon determines everything that comes after.

Here are the tools I use regularly, and how I actually use them.

Passive Recon: Before You Touch Anything

Passive recon means gathering information without sending a single packet to the target.

Shodan

Shodan indexes internet-connected devices. Before even running Nmap, I'll search for the target organisation:

shodan search org:"Target Organisation" port:22

You'd be surprised how much is exposed.

WHOIS + DNS

whois targetdomain.com
dig targetdomain.com ANY

WHOIS gives you registrar info, registration dates, and sometimes real contact info. dig ANY dumps all DNS records — look for subdomains, mail servers, and nameservers.

Active Recon: Talking to the Target

Active recon involves sending packets. Only do this on systems you have explicit permission to test.

Nmap — the workhorse

My standard scan order:

# 1. Quick host discovery
nmap -sn 192.168.1.0/24

# 2. Port scan on live hosts
nmap -sS -p- --min-rate 5000 <target>

# 3. Service/version detection on open ports
nmap -sV -sC -p 22,80,443,8080 <target>

# 4. OS detection
nmap -O <target>

The -sS flag (SYN scan) is quieter than a full TCP connect. The --min-rate 5000 keeps it fast.

Wireshark for Traffic Analysis

Once I'm on a network, Wireshark is indispensable. I filter aggressively:

http.request.method == "POST"
dns
arp

The ARP filter is especially useful for mapping a network segment — every device doing ARP will announce itself.

My CTF Workflow

For CTF challenges, I've settled into a consistent flow:

  1. nmap -sV -sC on the target
  2. If web — check robots.txt, run gobuster dir
  3. Check service versions against searchsploit
  4. Enumerate users/shares if SMB is open

The goal is to cover the basics before diving into rabbit holes. Speed matters in CTFs but thoroughness matters more.

These tools have a learning curve, but once they're in your muscle memory, recon becomes the most satisfying part of the process. You're building a picture of a system before anyone knows you're looking.