<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Active Scanning

Active subdomain enumeration, web content discovery, and network scanning.

## Active Subdomain Enumeration

### Subfinder → dnsx → httpx Pipeline (Canonical)

```bash
# Step 1: passive subdomain discovery
subfinder -d target.com -silent -all -o subs_raw.txt

# Step 2: DNS resolve, filter to live hosts
cat subs_raw.txt | dnsx -silent -a -resp | tee subs_resolved.txt

# Step 3: HTTP probe, tech fingerprint, grab titles
cat subs_resolved.txt | awk '{print $1}' | httpx -silent -sc -title -server -tech-detect -o live_web.txt
```

### Subfinder Key Flags

- `-all` — uses all sources including passive APIs (slower but more complete)
- `-recursive` — recursive enumeration for `sub.sub.target.com`
- `-cs` — include source names in JSON output (shows which provider found what)
- `-pc provider-config.yaml` — configure API keys for Shodan, SecurityTrails, Chaos, etc.

### dnsx Key Flags

- `-recon` — query all record types (A, AAAA, CNAME, NS, TXT, MX, SOA, PTR)
- `-axfr` — attempt zone transfer (noisy, but automatic discovery)
- `-rcode noerror` — filter to only responding hosts
- `-cname -resp` — extract CNAME targets (detect third-party orphans for takeover)
- `-asn` — display ASN info per host
- `-wd target.com` — wildcard detection mode

### DNS Brute-Force with Wordlist

```bash
dnsx -d target.com -w /usr/share/seclists/Discovery/DNS/n0kovo_subdomains.txt -silent
```

### BBOT Subdomain-Enum Profile

```bash
bbot -t target.com -p subdomain-enum          # full active+passive enum
bbot -t target.com -p subdomain-enum -rf passive   # passive-only (no DNS queries to target)
```

### Zone Transfer Check

```bash
dig @ns1.target.com target.com AXFR
```

Succeeds on misconfigured nameservers, dumps entire zone.

### Anti-Pattern

Running subdomain brute-force directly against target nameservers — use public resolvers (dnsx uses its own resolver list). Hammering target NS triggers alerts and may result in blacklisting.

---

## Web Content Discovery

### Feroxbuster Recursive Directory Brute-Force

```bash
# Standard web content discovery
feroxbuster -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-large-files.txt -x php,html,js,txt,bak -r --smart-mode

# Deep recursive with custom depth and extensions
feroxbuster -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt -x php,asp,aspx,jsp -d 3 -t 50

# Filter noise: exclude 404, 403 size-based
feroxbuster -u http://target.com -w raft-medium-dirs.txt --filter-status 404,403

# API-focused discovery
feroxbuster -u http://target.com/api -w /usr/share/seclists/Discovery/Web-Content/api/objects.txt --dont-recurse
```

### Wordlist Selection Strategy

- Quick: `raft-medium-directories.txt` (100K entries)
- Thorough: `directory-list-2.3-big.txt` + `raft-large-files.txt`
- API: `seclists/Discovery/Web-Content/api/`
- Target-specific: generate from JS/HTML with `cewl -d 2 -m 5 http://target.com`

### httpx for URL Probing with Filtering

```bash
# Find admin panels and login pages by title
cat hosts.txt | httpx -silent -title -mc 200 -ms "admin\|login\|dashboard"

# Screenshot all live web apps
cat hosts.txt | httpx -silent -screenshot -srd screenshots/

# Find tech stack across all subdomains
cat subs.txt | httpx -silent -tech-detect -json | jq '.tech[]?.name'
```

### Anti-Pattern

Using `gobuster` recursion flag on large wordlists — gobuster doesn't prune dead branches. Feroxbuster's `--smart-mode` and `--auto-tune` avoid this with adaptive concurrency and dead-end detection.

---

## Network Scanning

### Nmap Scan Patterns

```bash
# Host discovery (no port scan)
nmap -sn 192.168.1.0/24 -oA discovery

# Fast SYN scan top 1000 ports
nmap -sS --top-ports 1000 -T4 -n -Pn -oA fast_scan target

# Service version + default scripts
nmap -sS -sV -sC -O -T4 -oA svc_scan target

# Full port scan (all 65535)
nmap -sS -p- -T4 -n -Pn -oA full_scan target

# UDP top 20 (slow, run selectively)
nmap -sU --top-ports 20 -T4 target

# Stealth timing (slow/bypass IDS)
nmap -sS -T1 --data-length 24 --randomize-hosts target
```

### Nmap NSE Script Categories

- `--script=vuln` — runs all vulnerability scripts (CVE checks, common misconfigs)
- `--script=auth` — checks for default/weak credentials on services
- `--script=discovery` — enumerates service information (SNMP MIBs, SMB shares, DNS)
- `--script=brute` — attempts brute-force on services (noisy — use explicitly, not `--script=default`)
- `--script=safe` — non-intrusive scripts safe for production
- `--script=http-enum` — web path enumeration via HTTP (Nikto-like signatures)
- `--script=smb-vuln-*` — SMB vulnerability checks (EternalBlue, MS17-010)
- `--script=ssl-*` — SSL/TLS configuration and cert enumeration

### Reconftw Active Scan Config

```bash
# Standard active portscan
PORTSCAN_ACTIVE_OPTIONS="--top-ports 200 -sV -n -Pn --open --max-retries 2"
# Deep portscan with vulners NSE
PORTSCAN_DEEP_OPTIONS="--top-ports 1000 -sV -n -Pn --open --max-retries 2 --script vulners"
```

### Masscan for Fast Internet-Scale Scanning

```bash
masscan -p80,443,8080,8443 192.168.0.0/16 --rate=1000 -oL masscan.out
```

### Anti-Pattern

Running `nmap -A` against all targets in scope — `-A` = OS detection + version + scripts + traceroute, extremely noisy. Use `-A` only on confirmed target IPs after scope is established. Flag scope assumptions before scanning.

---
v1.1 | Validated: 2026-03-13
