Active Scanning Methodology

You have completed passive reconnaissance and are ready to begin active scanning against an authorized target. Plan the transition carefully.

**Pre-Scan Checklist**
- What authorization documentation should you have before running any active scan?
- How do you define scope boundaries to avoid scanning out-of-scope hosts?
- What is the risk of misconfigured scope in cloud environments? (AWS elastic IPs, CDN edge nodes)

**Scan Cadence & Stealth**
- What is the difference between a discovery scan, a service scan, and a vulnerability scan?
- How do you tune nmap speed (T0-T5) for stealth vs coverage?
- What does `-sS` vs `-sT` vs `-sU` mean in terms of packet types and detection?
- When does slowing down scanning actually reduce detection? When does it not?

**Service Version Detection**
- How does `-sV` work and when does it generate additional traffic that alerts defenders?
- What script categories (`-sC`, `--script=default`) are safe vs aggressive?
- How do you use nmap NSE scripts selectively for high-value services?

**Scanning Large Networks**
- How do you scan a /16 network efficiently without burning time on dead hosts?
- What is masscan's advantage over nmap for large sweeps and when do you switch to nmap?
- How do you handle networks with IDS/IPS that rate-limit or block scanning?

**Web Application Discovery**
- How do you find all web applications in a given IP range?
- What tools identify virtual-hosted sites on shared IP addresses?
- How do you use EyeWitness or Aquatone for screenshot-based web app discovery?

Output:
- Scan phase ordering: discovery → ports → services → scripts → vulns
- nmap command library for each phase
- Network size × stealth tradeoff guide