
You have completed passive reconnaissance and are ready to begin active scanning against an authorized target. Plan the transition carefully.

**Pre-Scan Checklist**
- What authorization documentation should you have before running any active scan?
- How do you define scope boundaries to avoid scanning out-of-scope hosts?
- What is the risk of misconfigured scope in cloud environments? (AWS elastic IPs, CDN edge nodes)

**Scan Cadence & Stealth**
- What is the difference between a discovery scan, a service scan, and a vulnerability scan?
- How do you tune nmap speed (T0-T5) for stealth vs coverage?
- What does `-sS` vs `-sT` vs `-sU` mean in terms of packet types and detection?
- When does slowing down scanning actually reduce detection? When does it not?

**Service Version Detection**
- How does `-sV` work and when does it generate additional traffic that alerts defenders?
- What script categories (`-sC`, `--script=default`) are safe vs aggressive?
- How do you use nmap NSE scripts selectively for high-value services?

**Scanning Large Networks**
- How do you scan a /16 network efficiently without burning time on dead hosts?
- What is masscan's advantage over nmap for large sweeps and when do you switch to nmap?
- How do you handle networks with IDS/IPS that rate-limit or block scanning?

**Web Application Discovery**
- How do you find all web applications in a given IP range?
- What tools identify virtual-hosted sites on shared IP addresses?
- How do you use EyeWitness or Aquatone for screenshot-based web app discovery?

Output:
- Scan phase ordering: discovery → ports → services → scripts → vulns
- nmap command library for each phase
- Network size × stealth tradeoff guide


Active Scanning Methodology


You are a penetration tester preparing an attack surface map before any exploitation begins. This map will drive your entire engagement strategy.

**What Is Attack Surface**
- What are the four dimensions of attack surface? (network, application, human, physical)
- How do you prioritize which surface areas to focus on first?
- What does "attack surface reduction" mean for a defender vs what it means for you as an attacker?

**External Attack Surface**
- How do you enumerate all internet-facing assets of an organization?
- What is the difference between known assets (in scope doc) and discovered assets (found through recon)?
- How do you handle discovered assets that are not in the original scope document?

**Application Layer Surface**
- How do you map all entry points into a web application? (input fields, file uploads, APIs, auth endpoints)
- What does an authentication surface look like vs an authorization surface?
- How do you document session management weaknesses as part of the surface map?

**Human Attack Surface**
- How do you assess social engineering exposure without conducting actual phishing?
- What does employee OSINT reveal about the human attack surface?

**Building the Map**
- What format works best for presenting an attack surface map in a pentest report?
- How do you track which surfaces have been tested vs untested throughout the engagement?
- How do you communicate attack surface findings to both technical and non-technical stakeholders?

Output:
- Attack surface category breakdown
- Documentation template (asset, service, entry point, tested/untested, finding reference)
- Priority scoring framework


Attack Surface Mapping


You are conducting passive reconnaissance on a target organization as part of an authorized penetration test. No active scanning or direct contact with target systems is allowed at this stage.

**Corporate & Infrastructure Footprint**
- What information does the company website, LinkedIn, and job postings reveal about technology stack and internal tools?
- How do job listings expose internal frameworks, software versions, and security gaps?
- What can you find in GitHub repositories, GitLab instances, and code.google.com for the target organization?

**Domain & IP Intelligence**
- How do WHOIS records, passive DNS history, and reverse WHOIS help map the attack surface?
- How do you use certificate transparency logs to discover subdomains and internal naming conventions?
- What does Shodan, Censys, and FOFA reveal about internet-facing assets without scanning them?
- How do you find ASN blocks and IP ranges owned by the target?

**Email & Employee Intelligence**
- How do you find valid email addresses and employee names using LinkedIn, Hunter.io, and breach databases?
- What does the email format (firstname.lastname@company.com) reveal and how do you verify it?
- What does a targeted employee's LinkedIn and social media reveal about internal processes?

**Breach & Credential Databases**
- How do you check for exposed credentials in breach databases ethically?
- What does a leaked credential set tell you beyond just the password?

**Document & Metadata Harvesting**
- What does FOCA/metagoofil extract from publicly indexed documents?
- How do PDF, Word, and Excel metadata reveal usernames, software versions, and internal paths?

Output:
- Passive recon checklist ordered by ease and information value
- Tool list: theHarvester, Maltego, Shodan, amass (passive), SpiderFoot
- Common high-value findings and their exploitation implications


Passive OSINT Strategy


You are authorized to conduct social engineering reconnaissance as part of a red team engagement. Plan the information gathering phase before any social engineering attempt.

**Target Employee Profiling**
- What OSINT sources provide the most valuable employee information? (LinkedIn, Twitter/X, GitHub, company bios)
- How do you build a realistic pretext using information found about specific employees?
- What does an employee's public content reveal about their technical knowledge level?

**Organizational Mapping**
- How do you map the organizational hierarchy using publicly available information?
- How do you identify which employees handle IT, finance, HR, and executive functions?
- What org chart information is typically visible on LinkedIn and how is it useful for pretexts?

**Pretext Development**
- What makes a pretext believable vs obviously suspicious?
- How do you use legitimate company information (email format, tools used, ongoing projects) to build credibility?
- What is a believable pretense for contacting IT helpdesk vs a CEO's assistant?

**Information Security Posture Indicators**
- What does a company's public security policy page, bug bounty program, and security job listings reveal?
- How do security-related job postings expose defensive tooling and monitoring capabilities?
- What does the absence of a security awareness program suggest?

**Scope & Ethics**
- What does explicit authorization for social engineering look like in an engagement contract?
- How do you document social engineering activities for the report?
- What is the difference between authorized vishing/phishing testing and unauthorized manipulation?

Output:
- Employee profiling checklist
- Pretext quality checklist (what makes it believable)
- Social engineering scope documentation requirements


Reconnaissance

Active Scanning Methodology

Attack Surface Mapping

Passive OSINT Strategy

Social Engineering Reconnaissance