Skip to content
Cyber KB

CEH Domain 3.A: Reconnaissance & Scanning

CEH Domain 3.A: Reconnaissance & Scanning

Section titled “CEH Domain 3.A: Reconnaissance & Scanning”

Reconnaissance is the first and longest phase of an ethical-hacking engagement. EC-Council splits it into four sub-domains - footprinting, scanning, enumeration, and vulnerability analysis - each producing a more granular picture of the target than the last. Footprinting answers “what is the target’s internet footprint?”, scanning answers “which hosts and ports are alive?”, enumeration answers “what can I pull off each open service?”, and vulnerability analysis answers “which of those findings is actually exploitable?”. The notes below map directly to the CEH v12/v13 blueprint.

Key takeaway: Recon is the phase where cost is lowest and signal is highest. A well-run passive-recon + selective active-scan pass is what separates a pentest report from a port-scan dump.

3.A.1 Footprinting / Reconnaissance

Section titled “3.A.1 Footprinting / Reconnaissance”

Footprinting is the systematic collection of public information about a target before any packet is sent to it directly. It is split into passive (no contact with target infrastructure - search engines, WHOIS, Shodan, CT logs, breach corpora) and active (light contact - DNS queries, traceroute, job-posting harvesting). Active footprinting crosses the line into scanning for some authors, but in CEH terminology the content is still OSINT, just gathered with a direct query.

OSINT core stack

Tool What it does Key flag / example
theHarvester Aggregates e-mails, subdomains, hosts from many engines (Bing, crt.sh, Shodan, VirusTotal, Hunter) theHarvester -d example.com -b bing,crtsh -l 500
recon-ng Modular Python framework with a workspace DB that accumulates entities (domains, hosts, contacts) across modules recon-ng; workspaces create target; modules load recon/domains-hosts/hackertarget; run
Maltego GUI link-analysis tool; turns a domain into a graph of subdomains, MX, e-mails, breach hits, ASN ownership Drop example.com entity → run transforms → pivot on new e-mail/IP entities
Shodan / Censys Search engines for banners and certificates. Filter by port:, vuln:CVE-…, org:, parsed.subject.common_name: port:3389 country:"US" / parsed.subject.common_name: example.com
Google dorking Uses advanced search operators to surface unintentional exposure indexed by crawlers site:example.com filetype:env intext:"AWS_SECRET"

Key takeaway: Modern OSINT is breadth + depth + visualization. Use theHarvester / recon-ng for breadth, Google dorks + CT logs for depth, and Maltego to turn a flat list into a relationship map you can pivot through.

Google dorking reference operators (curated from the Google Hacking Database): site:, inurl:, intitle:, intext:, filetype:, ext:, cache: (deprecated 2024 - use Wayback), related:, link:. The five highest-yield security dorks are filetype:env intext:"DB_PASSWORD", intitle:"index of" inurl:backup, inurl:phpinfo.php, site:pastebin.com "<domain>" password, and site:github.com "<domain>" token OR secret. Source: https://cybelangel.com/blog/google-dorks-for-osint-security-teams-guide/

DNS and domain footprinting uses whois, dig, nslookup, host, dnsenum, fierce, dnsrecon, subfinder, and amass. A canonical DNS workflow is: query NS records → attempt AXFR (dig axfr @ns1.example.com example.com) → enumerate SRV records (nmap --script dns-srv-enum) → brute-force subdomains with a wordlist. dnsenum --enum automates most of this in one threaded pass. Source: https://www.kali.org/tools/dnsenum/

Website footprinting uses Netcraft (hosting history), the Wayback Machine (deleted pages), BuiltWith and Wappalyzer (technology fingerprinting), and hunter.io / LinkedIn (people and e-mails). All of these are passive - they query third-party indexes, never the target.

Competitive intelligence is the business-layer equivalent: SEC filings, job postings, M&A news, patent filings, conference talks. Job postings are disproportionately high-signal because they reveal stack, internal hostnames, and sometimes exact software versions.

Source: https://yunolay.com/osint-introduction/, https://thecybermind.co/osint-cheat-sheet/

3.A.2 Scanning

Section titled “3.A.2 Scanning”

Scanning moves from public sources to direct interaction with target networks. The first step is host discovery (which IPs are alive), then port scanning (which services are listening), then service/OS detection, then stealth/evasion work.

Host discovery (ping sweep). Nmap uses ICMP echo by default, but a host can block ICMP and still answer on TCP/UDP. The relevant Nmap options are -sn (no port scan, just discovery), -PS/PA/PU/PY (SYN/ACK/UDP/SCTP discovery to a port list), -Pn (skip discovery, treat all hosts as up), and --disable-arp-ping. For IPv4 LANs the ARP ping is effectively mandatory because routers do not forward ARP.

Port scanning - the Nmap cheat sheet. All flags below are current per the nmap.org reference guide and the nmap.1 man page (Source: https://nmap.org/book/man-port-scanning-techniques.html, https://github.com/nmap/nmap/blob/master/docs/nmap.1).

Switch Purpose Example use case
-sS TCP SYN scan (half-open). Default if you have root. Stealthy, fast, reliable. First-pass sweep: nmap -sS -p- 10.0.0.0/24
-sT TCP connect() scan. Completes the 3-way handshake. No raw packets needed. Unprivileged user, or when raw sockets are blocked
-sU UDP scan. Slower, often shows `open filteredbecause UDP has no SYN/ACK. Combine with-sV` to disambiguate.
-sN TCP NULL scan - no flags set. Exploits RFC 793 loophole: closed → RST, open → no response. Stateless-firewall bypass
-sF TCP FIN scan - only FIN flag set. Same logic as NULL. Stateless-firewall bypass on *nix targets
-sX TCP XMAS scan - FIN+PSH+URG set (“packet lit up like a tree”). Same logic. Stateless-firewall bypass
-sA TCP ACK scan. Cannot determine open/closed; only filtered vs unfiltered. Map firewall rulesets and stateful vs stateless filters
-sI zombie[:port] Idle (zombie) scan. Truly blind - uses IP-ID side-channel on a third-party host. The target never sees your IP. When attribution to your address must be hidden; needs a suitable idle zombie host
-sM Maimon scan (FIN/ACK). Edge-case firewall evasion; works on fewer systems. Research / niche bypass
-sW TCP Window scan. Like ACK but inspects TCP window field of RST for open vs closed. Same as -sA, marginally more info
-sO IP protocol scan. Which IP protocols (ICMP, TCP, UDP, GRE, OSPF…) the host supports. OS fingerprinting, finding weird services
-b FTP bounce scan. Use an FTP server as a proxy. Deprecated, mostly historical. Legacy exam question
--scanflags Custom TCP flag combination. Specify URG,ACK,PSH,RST,SYN,FIN and a base scan type. Bespoke IDS evasion
-sV Version detection - probes open ports and matches banners. Service identification for vuln mapping
-O OS fingerprinting - uses TCP/IP stack idiosyncrasies (window size, options, ICMP, etc.). Identify target OS for exploit selection
-A Aggressive: -sV -O --traceroute --script=default. Quick all-in-one profile
--script / -sC NSE scripts - hundreds of Lua scripts for vuln, brute, discovery, malware backdoor checks. nmap --script smb-vuln* -p 445 target

Key takeaway: -sS is the default for a reason - fast, stealthy, and works against any compliant stack. Use -sN/-sF/-sX only against stateless filters; use -sI when you need true attribution blindness; use -sV and -O as soon as you have an open port.

Stealth / IDS-evasion options (Source: https://nmap.org/book/man-briefoptions.html):

  • Timing templates -T0 paranoid, -T1 sneaky, -T2 polite, -T3 normal (default), -T4 aggressive, -T5 insane. -T1 adds 5-15 minutes of jitter between probes to slip past detection windows.
  • Fragmentation -f / --mtu <val> splits probes into 8-byte (or custom-MTU) fragments so stateless packet filters may reassemble incorrectly.
  • Decoy scan -D decoy1,decoy2,ME,decoy4 mixes your real probe with spoofed-source decoys so the target’s IDS sees multiple attackers.
  • Source-port spoof -g 53 / --source-port 53 makes probes appear to come from DNS, making them eligible for allow-listed outbound traffic.
  • Source IP spoof -S <ip> forges the source address; works only when Nmap can see the response (typically idle scan).
  • MAC spoof --spoof-mac 0 (random), Cisco, or full MAC.
  • Bogus checksum --badsum - every real OS drops these, so a response tells the attacker the packet was crafted by a tool that ignores RFC checksums.
  • Proxies --proxies http://... chains HTTP/SOCKS4 relays.
  • Custom payload --data-length <n> appends random bytes to change packet signature and confuse signature-based detection.

Beyond-IDS scanning combines the above with IP spoofing (in idlescan or UDP/ICMP unreachable-triggered scans), proxy chains (Tor, SOCKS), and anonymizer networks. CEH exam weights the conceptual trade-off (speed vs stealth vs attribution) more than the tool name.

Source: https://nmap.org/book/man-port-scanning-techniques.html, https://nmap.org/book/scan-methods-null-fin-xmas-scan.html, https://nmap.org/book/port-scanning-options.html

Other scanners: Masscan (asynchronous, internet-scale - claims 10M packets/sec), Zmap (research-focused internet-wide scanner, single-packet per host), Unicornscan (asynchronous stateless scanner with sophisticated TCP/IP stack manipulation). All three are appropriate for the “scan beyond IDS” objective; Nmap remains the per-host detail tool.

3.A.3 Enumeration

Section titled “3.A.3 Enumeration”

Enumeration is active protocol-level interrogation of services identified during scanning. It is noisy and only legitimate inside an authorized engagement. For each protocol the goal is the same: extract usernames, group memberships, share lists, software versions, banner strings, and configuration that can seed credential attacks.

NetBIOS / SMB enumeration (TCP 137-139, 445). The workhorse tool is enum4linux -a <target> (CiscoCXSecurity fork), which wraps RPC, SAMR, and LSA queries. Useful flags: -U users, -S shares, -G groups, -P password policy, -n NetBIOS. rpcclient -U "" -N <target> opens a null session and accepts commands like enumdomusers, queryuser 0x1f4, enumdomgroups. smbclient -L //<target> -N lists shares anonymously. nbtscan 192.168.1.0/24 sweeps the subnet. Source: https://github.com/SNGWN/CEH-Notes/blob/main/Module%2004%20-%20Enumeration.md

SNMP enumeration (UDP 161). Default community strings public (read) and private (read-write) are still catastrophic when present. snmpwalk -v2c -c public <target> walks the entire MIB tree; snmp-check <target> produces a tidy human-readable report. Useful OIDs: 1.3.6.1.2.1.1.5.0 (sysName), 1.3.6.1.4.1.77.1.2.25 (user table on Windows), 1.3.6.1.2.1.4.21.1.1 (IP route table).

LDAP enumeration (TCP/UDP 389, 636 LDAPS). ldapsearch -x -h <target> -p 389 -b "dc=domain,dc=com" performs an anonymous bind and dumps the directory. -s base queries rootDSE (naming contexts, server info). nmap -p 389 --script ldap-rootdse and --script ldap-search script the same. Active Directory-specific tools: AD Explorer (Sysinternals), Jxplorer, Softerra LDAP Administrator.

DNS enumeration (covered in 3.A.1 but counts here too): zone transfers via dig axfr @ns1.example.com example.com, SRV record sweeps with nmap --script dns-srv-enum, brute-force with dnsenum --enum or fierce -dns example.com.

SMTP enumeration (TCP 25). VRFY, EXPN, and RCPT-TO tricks confirm valid mailboxes. smtp-user-enum -M VRFY -U users.txt -t <target> automates the technique. Open relays are tested with nmap --script smtp-open-relay.

FTP / TFTP enumeration (TCP 21, UDP 69). Banner grabbing with nc -v <target> 21. nmap --script ftp-anon detects anonymous logins. tftp is often unauthenticated on network gear.

Banner grabbing is the universal technique - nc -v <target> 80, then HEAD / HTTP/1.0, or use nmap -sV. HTTP headers (Server:, X-Powered-By:) and SSH protocol string (SSH-2.0-OpenSSH_9.6p1 Ubuntu) immediately feed CVE lookups.

Key takeaway: Enumeration is where scanning turns into a target list. Every user name, share, and community string is a credential-attack seed.

Source: https://simeononsecurity.com/ceh/enumeration/, https://github.com/SNGWN/CEH-Notes/blob/main/Module%2004%20-%20Enumeration.md

3.A.4 Vulnerability Analysis

Section titled “3.A.4 Vulnerability Analysis”

Vulnerability analysis maps enumeration output to known weaknesses and assigns severity. Categories per CEH: network (unpatched router IOS, default SNMP community), host (missing OS patch, local privilege escalation), application (OWASP Top 10 - XSS, SQLi, SSRF), wireless (WEP, KRACK, WPA3 downgrade), and password (weak, default, reused, breached).

Standards. CVE (Common Vulnerabilities and Exposures) is the unique identifier; NVD (National Vulnerability Database) enriches CVEs with CVSS scores, CPE ranges, and references. CVSS (Common Vulnerability Scoring System) v3.1 is the scoring standard. It has three metric groups: Base (intrinsic, time-independent), Temporal (changes over time - exploit maturity, remediation level, report confidence), and Environmental (relevance to a specific deployment).

CVSS 3.1 base metrics (eight values, each producing a numeric weight): AV Attack Vector (N/A/L/P), AC Attack Complexity (L/H), PR Privileges Required (N/L/H), UI User Interaction (N/R), S Scope (U/C), C Confidentiality impact (N/L/H), I Integrity impact (N/L/H), A Availability impact (N/L/H). Severity bands: 0.0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical. Source: https://www.first.org/cvss/specification-document, https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator/v31/equations

Worked example - CVE-2024-3094 (XZ Utils backdoor). Discovered March 2024, malicious code in xz 5.6.0/5.6.1 allowed SSH pre-auth RCE on glibc-based Linux distributions running sshd linked against the compromised liblzma. NVD CVSS 3.1 vector and score:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H → Base Score 10.0 CRITICAL

Reading the vector: Network-attackable, low complexity, no privileges, no user interaction, scope changed (vulnerable liblzma, impacted sshd - different security authorities), high impact on all three of confidentiality, integrity, availability. This is the textbook 10.0 - the only metric that would lower it is moving any of C/I/A off High. Source: https://nvd.nist.gov/vuln/detail/cve-2024-3094, https://nvd.nist.gov/vuln/detail/CVE-2024-3094

Automated scanners compare: Nessus (Tenable, ~99.7 % CVE coverage, low false-positive rate, agent + agentless, paid) is the gold-standard infrastructure scanner. OpenVAS / Greenbone is the open-source alternative (GPL-3, ~98 % CVE coverage, slower, requires tuning, ideal for air-gapped or cost-sensitive deployments). Qualys VMDR is the cloud-native SaaS leader (highest coverage, GraphQL API, integrated CSPM and Kubernetes, highest TCO). Source: https://cyber-tools.net/blog/greenbone-openvas-vs-tenable-nessus-vs-qualys-vmdr-2026

Web application scanners: Burp Suite Pro is the manual-plus-automated DAST standard (proxy, repeater, intruder, scanner, extensions - used for real web pentesting including business-logic flaws). OWASP ZAP is the open-source man-in-the-middle proxy (intercept, fuzz, scripted scans, Docker-friendly). Nikto is a baseline web-server scanner (dangerous files, misconfigs, outdated software - loud, no auth handling). Acunetix is a high-automation commercial DAST.

Manual vs automated. Automated scanners are exhaustive but shallow; they miss business logic, chained bugs, and access-control issues. Manual testing is required for true web application pentest depth. The CEH answer: combine both - automated for breadth and baseline, manual for depth and chaining.

Key takeaway: The scanner finds candidates; the analyst confirms exploitability. Always validate with a manual repro and a CVSS sanity check before reporting.

Source: https://www.first.org/cvss/v3.1/examples, https://sourceforge.net/software/compare/Nessus-vs-OWASP-Zed-Attack-Proxy-ZAP-vs-OpenVAS/

Sources

Section titled “Sources”