Techzone/Active OSINT / Active Recon

Active OSINT / Active Recon

2 min readArticle

Active recon involves directly interacting with the target — sending packets, making requests, querying systems. Unlike passive OSINT (public sources only), active recon touches the target and can be detected. Use it when you have authorization or when detection risk is acceptable.

Passive vs Active

Type Target Interaction Detection Risk Examples
Passive None Very low Google, WiGLE, Shodan, LinkedIn
Active Direct Moderate-High Nmap, Nikto, DNS zone transfers

Active Recon Techniques

Network Scanning

bash 
# Host discovery — find live hosts
nmap -sn 192.168.1.0/24
netdiscover -r 192.168.1.0/24

# Port scanning
nmap -sS -T4 -p- 192.168.1.1
nmap -sV -sC target.com

# Service fingerprinting
nmap -A target.com

DNS Enumeration

bash 
# Zone transfer (if allowed)
dig axfr @ns1.target.com target.com

# DNS brute force subdomains
gobuster dns -d target.com -w /usr/share/wordlists/dnsmap.txt

# dnsenum — automated DNS recon
dnsenum target.com

# dnsrecon
dnsrecon -d target.com -t axfr
dnsrecon -d target.com -t brt  # Brute force subdomains

Web Application Recon

bash 
# Directory/file brute force
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt
feroxbuster -u https://target.com

# Technology fingerprinting
whatweb https://target.com
wappalyzer (browser extension)

# Web vulnerability scan
nikto -h https://target.com

SMTP / Email Verification

bash 
# Verify if an email exists (active)
smtp-user-enum -M VRFY -U users.txt -t mail.target.com
smtp-user-enum -M RCPT -U users.txt -t mail.target.com

SNMP Enumeration

bash 
# SNMP walk (if default community strings are set)
snmpwalk -c public -v1 192.168.1.1
snmpwalk -c private -v2c 192.168.1.1

# onesixtyone — SNMP scanner
onesixtyone -c /usr/share/doc/onesixtyone/dict.txt 192.168.1.0/24

SMB Enumeration

bash 
# Enumerate shares, users, sessions
enum4linux -a 192.168.1.1

# Null session
smbclient -L //192.168.1.1 -N

# CrackMapExec
cme smb 192.168.1.0/24 --shares
cme smb 192.168.1.0/24 --users

Tools in This Section

  • shodan.io — IoT/internet device search engine
  • iot-search-engines-censys-zoomeye — Other IoT search tools (Censys, Zoomeye, etc.)

Wireless Active Recon

bash 
# Put card in monitor mode, scan all channels
sudo airodump-ng wlan0mon

# Active probe for specific SSID
sudo aireplay-ng -9 -e "TargetSSID" wlan0mon

# Send probe requests
sudo airodump-ng --essid "TargetSSID" wlan0mon

OPSEC Notes

  • Active recon leaves traces in target logs
  • Always document when you transitioned from passive to active
  • If authorized: Nmap scans often appear in IDS/SIEM
  • Timing matters — T1/T2 Nmap is slower but quieter
  • Some tools (like zone transfers) may trigger DNS alerts

See Also

  • ../index - OSINT overview
  • shodan.io - Passive-ish internet scanning
techzonesite.comUnlock Your IT Potential