Internal Reconnaissance
Internal reconnaissance focuses on understanding the network topology, identifying Active Directory structure, and discovering high-value targets before active exploitation begins. Balance stealth with thoroughness.
Information
Danger
tcpdump. The same applies one layer up: the DNS forwarder you query may be the ISP's
resolver, and a trust relationship points at a domain whose owner never signed anything. Stop at the
boundary and report the finding rather than following the path.
Reconnaissance Phases
Passive Reconnaissance
Network traffic analysis, ARP discovery, DHCP/mDNS monitoring, and stealthy enumeration.
Active Discovery
Nmap scanning, host discovery, service enumeration, and OS fingerprinting techniques.
AD Enumeration
Domain discovery, LDAP queries, BloodHound analysis, and trust relationship mapping.
User Hunting
Admin identification, session tracking, high-value target discovery, and logged-on user enumeration.
Reconnaissance Workflow
| Phase | Techniques | Detection Risk | Key Outputs |
|---|---|---|---|
| Passive | Traffic capture, ARP table, broadcast listening | Low | Network layout, active hosts, naming conventions |
| Active | Port scanning, service detection, OS fingerprint | Medium | Open ports, services, vulnerabilities |
| AD Enum | LDAP queries, BloodHound, GPO analysis | Medium | Domain structure, attack paths, privileges |
| User Hunting | Session enumeration, admin locating | Medium-High | Target systems, admin sessions |
Quick Reference
Essential Commands
nmap -sn 10.0.0.0/24bloodhound-python -c AllGet-DomainUser -AdminCount 1
Key Tools
- • Nmap / Masscan
- • BloodHound
- • PowerView / SharpView
Priority Targets
- • Domain Controllers
- • Admin workstations
- • Service accounts
Evidence Collection
Reconnaissance evidence is what the rest of the engagement is planned from, so it has to be reproducible: every host in the inventory should name the method that found it.
Host inventory: One line per address: name, IP, discovery method (ARP, ICMP, SMB, DHCP lease, DNS), first seen and by whom. A list without the method cannot be re-derived and cannot be defended.
Capture files:
The .pcap you drew the names from, with the capture point and timestamp recorded. Keep the capture that names the domain, and note the filter you applied so a reviewer can repeat it.
Network parameters: DHCP offer (mask, gateway, DNS servers, domain suffix, WPAD option 252) and the resolver address you queried. These are the scope facts the later phases assume.
Domain and DC list: The SRV lookups that produced it, with the query names as typed. A DC list is only evidence if the reviewer can re-run the same query.
Timeline: When each passive and active step ran. On a client with an IR team, your timeline is what distinguishes your traffic from an actual intrusion in their telemetry.
False Positive Identification
- A silent capture is usually a silent port: A capture interface that sees only its own traffic looks exactly like a quiet network. Check the interface counters and confirm the port is mirrored before concluding the estate has no broadcast traffic.
- "Down" hosts that are filtered: A workstation missing from an ICMP sweep is normally a host firewall dropping echo, not an absent machine. Reconcile with ARP and SMB before writing a host off.
- Your own infrastructure in the inventory: The attack box, its VMs and the jump host appear in ARP and DHCP like anything else. Strip them before the host count reaches the report.
- A trust is not a path: A second domain name in the DNS suffix or SMB output proves a trust exists, not that you can cross it. Direction and SID filtering decide that, and both need a credential to read.
Remediation & Defense
What an internal recon phase cannot do is a property of the estate's design, so these are the controls that shorten the next engagement.
Reduce what a quiet attacker can learn
- • Disable LLMNR and NBT-NS by policy, and turn off WPAD unless a proxy is genuinely in use
- • Segment guest and BYOD traffic away from the server VLANs, with no routed path to management
- • Restrict zone transfers to named secondaries, and keep stale and tombstoned records out of ADIDNS
Make the quiet phases visible
- • Enable DNS server debug or query logging to a central collector, at least on the DCs
- • Retain DHCP and NetFlow data long enough to correlate a multi-day engagement
- • Alert on a single source issuing hundreds of PTR or SRV queries, and on ARP-scan-like patterns at the switch