Active reconnaissance

Active vs passive

Active recon sends traffic to the target and watches the replies. Unlike passive recon, the target can see and log your activity. That is why active recon only happens on systems you are authorised to test and that are in scope. In your lab, everything is authorised, so it is a safe place to practise.

Simple active techniques

A ping checks whether a host is up by sending a small packet and waiting for a reply. Looking at a site's pages, headers and robots.txt tells you what technology it runs. Checking which services answer on which ports is the first step of scanning, covered fully in the next module.

ping -c 4 192.168.56.102     # is the lab target up? (4 packets)
curl -I http://192.168.56.102/ # show the HTTP response headers
curl http://192.168.56.102/robots.txt # a file that lists paths

Reading what a server tells you

Servers often reveal useful details in their responses: the web server name and version in a header, the technology in a cookie name, or error pages that mention a framework. This is called banner grabbing or fingerprinting. It tells a tester what to focus on — and tells a defender what to hide.

Detection and defence

Detection: active recon shows up in logs — many requests from one address, hits to odd paths, repeated pings. Defenders spot it with their web server logs, an intrusion detection system, or a SIEM (all covered in security courses). Defence: remove version banners, return plain error pages, and rate-limit or block noisy sources. None of this stops an authorised tester, but it slows a real attacker and makes their recon noisy and visible.