--- title: "Recon Tooling — Operator Reference · VORNAC Research" description: "nmap scan templates by goal, transform-driven entity discovery in Maltego, and the timing-vs-stealth tradeoffs that decide when to use what." url: https://www.vornac.com/en/research/offensive-tradecraft/recon-tooling lang: en published: 2026-06-02 updated: 2026-06-02 alternate_de: https://www.vornac.com/research/offensive-tradecraft/recon-tooling --- [Research Index](https://www.vornac.com/en/research) / [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) / Recon Tooling — Operator Reference Reference · [1 Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) # Recon Tooling — Operator Reference. nmap scan templates by goal, transform-driven entity discovery in Maltego, and the timing-vs-stealth tradeoffs that decide when to use what. ## nmap — scan templates by goal - **Breadth (find live hosts in /24).** `nmap -sn -PE -PP -PS80,443,22 -PA80,443 10.0.0.0/24`. ICMP echo + timestamp + TCP-SYN + TCP-ACK probes to defeat host-level firewalls that drop one. - **Depth (full TCP enumeration on a target).** `nmap -p- -sS -sV -sC --min-rate=1000 -oN out.txt target`. All 65535 ports, syn-scan, version detection, default scripts. Plan for 10–20 min per target. - **Stealth (assume monitored network).** `nmap -sS -T2 -f --data-length 24 --top-ports 100 target`. Slow timing, fragment packets, randomized payload length, top 100 ports only. - **Version-pinning a service.** `nmap -sV --version-intensity 9 -p 443 target`. Forces every probe, useful when default version detection returns "tcpwrapped" or blank. - **NSE for a specific service.** `nmap --script "smb-vuln*" -p 445 target` (or `http-*`, `ssl-*`, `ldap-*`). Filter NSE categories — never run `--script all` against production. - **UDP, when you must.** `nmap -sU --top-ports 30 -T4 target`. UDP is slow and unreliable; scope to known interesting ports (53, 161, 500, 4500, 5353). ## Per-phase nmap recipes - **Initial recon.** `masscan -p1-65535 --rate 10000` to find open ports across the range, then `nmap -sV -sC` against the discovered set. Two-stage scan saves hours. - **Authenticated context (post-foothold).** `nmap -sn 10.0.0.0/8` for adjacent-segment discovery. Run from the pivot host, not from external. ICMP-only to stay quiet. - **Post-exploitation enum.** `nmap --script smb-enum-shares,smb-enum-users --script-args smbusername=u,smbpassword=p target`. Authenticated NSE produces enumeration that anonymous scans miss. ## Maltego — transform chains - **People → infrastructure.** Domain → DNS A records → IP → ASN → all other domains in that ASN. Surfaces hidden second-brand and acquired-company assets. - **People → social graph.** Name → LinkedIn profile → coworkers → emails (via Hunter/Apollo transform) → password-spray candidate list. - **Email → breach data.** Email → HaveIBeenPwned breach list → password patterns from public dumps (legal scope only). Critical for password-spray realism. - **Infrastructure → certificate-transparency.** Domain → CT log entries → all historical certs → all subdomains ever issued. Catches assets that DNS-bruteforce misses. ## Curation discipline - **Triage before report.** Maltego graphs grow unbounded; the deliverable is the trimmed subgraph that supports a specific finding, not the raw output. - **Confidence per entity.** Mark guessed vs. confirmed in node metadata. Without this, reviewers later can't separate fact from inference. - **Re-run before each engagement phase.** Recon outputs go stale fast. CT logs from last week miss this week's new certs. **Rule of thumb**If a nmap scan takes longer than you budgeted, kill it and run with `--top-ports` first. You can always go deeper after you've seen the top-port output. Long blind full-port scans burn detection time without yielding new information. Domain [1 · Offensive Tradecraft](https://www.vornac.com/en/research/offensive-tradecraft) Tier Reference Engagement phases ReconFingerprintingAuthentication Published 2 June 2026 Looking up an acronym? [Open the Glossary](https://www.vornac.com/en/glossary) ## Related notes in this domain - [Featured Comprehensive Pentest Reference](https://www.vornac.com/en/research/offensive-tradecraft/comprehensive-pentest-reference) - [Featured Pentest Methodology — Canonical Reference](https://www.vornac.com/en/research/offensive-tradecraft/pentest-methodology-canon) - [Featured Advanced Penetration Testing & Red Team](https://www.vornac.com/en/research/offensive-tradecraft/advanced-pentest-and-redteam) - [Featured Recon & Discovery](https://www.vornac.com/en/research/offensive-tradecraft/recon-and-discovery) - [Featured Web Server — Attack & Defense](https://www.vornac.com/en/research/offensive-tradecraft/web-server-attack-defense) - [Featured Active Directory Pentest](https://www.vornac.com/en/research/offensive-tradecraft/active-directory-pentest) - [Featured Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) - [Reference Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) - [Reference Automation vs. Manual Testing](https://www.vornac.com/en/research/offensive-tradecraft/automation-vs-manual) - [Background Social Engineering & Phishing](https://www.vornac.com/en/research/offensive-tradecraft/social-engineering-phishing) - [Background Pentester Foundations & CTF Practice](https://www.vornac.com/en/research/offensive-tradecraft/pentester-foundations) [Previous note Internal Pivoting & Lateral Movement](https://www.vornac.com/en/research/offensive-tradecraft/internal-pivoting) [Back to domain](https://www.vornac.com/en/research/offensive-tradecraft) [Next note Operator Toolkits — Catalog & Reference](https://www.vornac.com/en/research/offensive-tradecraft/operator-toolkits) From reference to evidence ## Run this against your own environment.