Network Reconnaissance

Scope

What this is: Discovering hosts, services, and vulnerabilities on target networks.

Competition relevance: Offensive operations (red team CTF): the essential first step. Recon before exploitation.

Why it matters: Identifying attack surface and vulnerable services for exploitation.

WSOS 2026 alignment: Supports Section 6: Operations and management (network reconnaissance) and Section 7: Intelligence collection and analysis (systematic enumeration).

Competition area: Core to the offensive operations area, discovering network attack surface.

Offline competence: nmap works offline. Use man nmap for NSE script documentation.

---

Competency Matrix

Level	Expectation
Regional	Basic nmap scans. Identify common services (SSH, HTTP, SMB).
National	Service version detection. Script scanning. Network mapping.
Squad/Team Selection	Stealth scanning. Custom NSE scripts. Vulnerability scanning integration.
International	Advanced evasion. Custom scanning logic. Passive reconnaissance.

---

Technical Content

Nmap Basics

Host discovery:

# Ping sweep
nmap -sn 192.168.1.0/24

# Skip ping (assume host is up)
nmap -Pn 192.168.1.100

Port scanning:

# Quick scan (common ports)
nmap 192.168.1.100

# All ports
nmap -p- 192.168.1.100

# Specific ports
nmap -p 22,80,443,3389 192.168.1.100

# TCP SYN scan (default, requires root)
nmap -sS 192.168.1.100

# TCP connect scan (no root required)
nmap -sT 192.168.1.100

# UDP scan (slow)
nmap -sU 192.168.1.100

Service version detection:

# Detect service versions
nmap -sV 192.168.1.100

# OS detection
nmap -O 192.168.1.100

# Aggressive scan (version + OS + scripts + traceroute)
nmap -A 192.168.1.100

Competition context: Start with quick scan of common ports, then deep scan interesting services. Document all findings.

---

NSE Scripts

Default scripts:

# Run default NSE scripts
nmap -sC 192.168.1.100

# Or specific category
nmap --script vuln 192.168.1.100
nmap --script auth 192.168.1.100
nmap --script exploit 192.168.1.100

Useful scripts:

# SMB enumeration
nmap --script smb-enum-shares,smb-enum-users 192.168.1.100

# HTTP enumeration
nmap --script http-enum 192.168.1.100

# SSH brute-force
nmap --script ssh-brute 192.168.1.100

# Vulnerability scanning
nmap --script vuln 192.168.1.100

---

Output Formats

Save output:

# All formats
nmap -oA scan_results 192.168.1.100

# Creates:
# - scan_results.nmap (normal)
# - scan_results.xml (XML)
# - scan_results.gnmap (grepable)

# Specific formats
nmap -oN scan.txt 192.168.1.100  # Normal
nmap -oX scan.xml 192.168.1.100  # XML
nmap -oG scan.grep 192.168.1.100  # Grepable

---

Service Enumeration

SMB (445):

# List shares
smbclient -L //192.168.1.100 -N

# Connect to share
smbclient //192.168.1.100/share -U username

# Enumerate users
enum4linux 192.168.1.100

HTTP (80/443):

# Whatweb
whatweb http://192.168.1.100

# Nikto
nikto -h http://192.168.1.100

SSH (22):

# SSH version
nc 192.168.1.100 22

# Banner grab
telnet 192.168.1.100 22

---

Competition Strategy & Marking

What gets marked:

• All hosts discovered
• All services identified
• Version numbers documented
• Network diagram/topology

Evidence requirements:

• nmap scan output showing all open ports
• Service versions identified
• Screenshot of scan results

Evidence and reporting requirements:

• Screenshot showing nmap scan results (open ports, services, versions)
• Network topology diagram or notes identifying live hosts
• Service banners and version information captured
• For vulnerability scanning: screenshot showing identified vulnerabilities with CVE numbers
• Screenshots showing additional enumeration (SMB shares, HTTP headers, DNS records)
• Written summary of attack surface identified
• Clear file naming: netrecon_nmap_scan.png, netrecon_services.png, netrecon_vulns.png Time allocation:
• Initial host discovery: 5 minutes
• Port scanning: 10-15 minutes
• Service enumeration: 15-20 minutes

Workflow:

1. Host discovery (ping sweep)
2. Quick port scan (top 1000)
3. Full port scan on interesting hosts
4. Service version detection
5. NSE script scanning
6. Document findings

Time-boxed drill suggestion: 30-minute network reconnaissance sprint: Given a network range (e.g., 192.168.1.0/24), perform host discovery, identify all live hosts, scan for open ports and services, enumerate service versions, identify potential vulnerabilities or misconfigurations, and document all findings with screenshots and a summary of the attack surface.

---

False Flags / Wrong Paths

Common Traps

Firewall blocking scans ICMP may be blocked. Use -Pn to skip ping.

Slow UDP scans UDP scanning is very slow. Only scan if required.

Script timeouts NSE scripts can hang. Use --script-timeout 30s.

---

Practice Checklist

• Can perform basic nmap port scan
• Can detect service versions
• Can use NSE scripts for enumeration
• Can interpret nmap output
• Can enumerate SMB shares
• Know common ports (22, 80, 443, 445, 3389)
• Complete network recon in under 30 minutes

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../../00-roadmaps/ for module-specific guidance

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references and tool documentation