Differences between internal reconnaissance and external reconnaissance: internal networks usually have no CDN/WAF protection, but your operational space is limited by the network position of your current foothold. The core objective isquickly map the internal network—which hosts exist, what services they run, and which are high-value targets.
⛔ In-depth reference (required reading)
- Live host detection commands, port→service→value mapping table, domain controller/database location → references/network-mapping.md
- fscan detailed usage (weak password brute force, POC detection, proxy scanning) → load
fscan-scanskill - Tool delivery methods(how to deliver the tools needed for post-exploitation to the target, and why they should be executed on the target rather than locally) → load
tool-deliveryskill
Phase 1: Current Position Analysis
# Linux
ip addr && ip route && cat /etc/resolv.conf && arp -a && cat /etc/hosts
# Windows
ipconfig /all && route print && arp -a && net view /domain
Key judgments: multiple NICs = pivot | DNS→internal IP = domain environment | large ARP table = active subnet
Phase 2: Live Host Discovery (fscan preferred)
# fscan 一把梭（存活+端口+服务+弱口令+漏洞，速度远超 nmap）
fscan -h 10.0.0.0/24 -nopoc # 快速存活+端口
fscan -h 10.0.0.0/24 # 全量（含 POC 检测+弱口令）
# nmap 补充（fscan 不可用时降级）
nmap -sn 10.0.0.0/24 # ICMP ping
nmap -PR -sn 10.0.0.0/24 # ARP（同网段最可靠）
Phase 3: Port Scanning (focus on key ports)
# fscan 指定端口（推荐，速度快且自动识别服务）
fscan -h TARGETS -p 22,80,135,139,443,445,1433,3306,3389,5432,5985,6379,8080,9200
# nmap 深度识别（需要服务版本/NSE 脚本时用）
nmap -sT -sV -p 22,80,445,3389 TARGETS
High-value ports: 88(domain controller) | 445(SMB) | 3389(RDP) | 1433(MSSQL) | 6379(Redis)
→ complete port→service→value mapping table → references/network-mapping.md
Phase 4: Locating Critical Infrastructure
- Domain controller: 88+389+445 = confirmed domain controller | DNS IP is usually the domain controller
- Database: use collected credentials to attempt connection
- Management systems：
httpx -tech-detect/curl -sIdiscover Jenkins/GitLab/Zabbix
Phase 5: Output the Internal Network Map
Network topology + high-value target list (domain controller→database→management system→pivot host) + prioritized attack paths
Notes
- Prioritizepassive discovery(ARP/routing table), then active scanning
- Scan in batches to avoid scanning /16 and causing network issues
Passive Discovery Techniques
- NBNS / LLMNR broadcast listening: NetBIOS Name Service can passively obtain hostnames
- tcpdump packet capture, listening, and sniffing network traffic
- Port 3268 — Active Directory Global Catalog
Multi-NIC Pivot
- Discover dual-NIC hosts (two subnets), which can serve as cross-subnet pivot hosts
- Set up a proxy/forwarding through this machine to access the new subnet
- New attack surface: expand scope and go deeper into the internal network