■ LINUX FOR HACKERS
Reconnaissance & Scanning
MODULE 4 OF 5 · INFORMATION GATHERING
The Hacker Methodology
Professional penetration testers follow a structured methodology. Jumping straight to
exploitation without recon is like breaking into a house without knowing the floor plan.
Information gathering is often 60-70% of the total engagement time.
Phase Description Tools
1. Recon Gather info without touching target whois, Google, Shodan
2. Scanning Probe target for open ports/services nmap, masscan
3. Enumeration Extract detailed service info enum4linux, gobuster
4. Exploitation Exploit found vulnerabilities Metasploit, custom exploits
5. Post-Exploit Pivot, escalate, persist linpeas, pspy
6. Reporting Document findings Report writing
■■ LEGAL WARNING
ONLY scan systems you own or have WRITTEN permission to test. Unauthorised scanning is illegal
in most countries (e.g. Computer Fraud and Abuse Act in the US, Computer Misuse Act in the UK).
Use a home lab, HackTheBox, TryHackMe, or VulnHub.
Nmap — The Port Scanner King
Nmap (Network Mapper) is the most important recon tool. It discovers hosts, open ports,
running services, OS versions, and can even run scripts against targets.
COMMAND WHAT IT DOES
nmap [Link] Basic scan — top 1000 ports
nmap -sV [Link] Detect service versions
nmap -sV -O [Link] Service + OS detection
nmap -p- [Link] Scan ALL 65535 ports
nmap -p 22,80,443 host Scan specific ports only
Linux for Hackers · Page 1 For educational purposes only — hack ethically!
nmap -sU -p 53,161 host UDP scan (DNS, SNMP)
nmap -sS [Link]/24 SYN stealth scan on subnet
nmap -A -T4 host Aggressive: OS+version+scripts+traceroute
nmap --script vuln host Run vulnerability detection scripts
nmap -oN [Link] host Save output to file
nmap -oX [Link] host XML output (import to Metasploit)
Reading Nmap Output
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.2p1
80/tcp open http Apache 2.4.41
443/tcp open ssl/https nginx 1.18
3306/tcp filtered mysql
open = reachable service. filtered = firewall blocking. closed = port exists but no service.
Passive Recon Tools
COMMAND WHAT IT DOES
whois [Link] Registrar, owner, nameservers, dates
dig [Link] ANY All DNS records (A, MX, NS, TXT ...)
dig [Link] MX Mail server records
fierce -dns [Link] DNS brute-force zone enumeration
theHarvester -d [Link] Email/subdomain OSINT gathering
curl [Link]/[Link] IP geolocation and ASN info
shodan search apache Search Shodan for exposed servers (API)
Gobuster — Directory & File Brute-Force
Gobuster finds hidden web directories and files by brute-forcing with a wordlist. It's one
of the first tools to run against a web application.
$ gobuster dir -u [Link] -w /usr/share/wordlists/dirb/[Link]
→ Basic dir scan
$ gobuster dir -u [Link] -w [Link] -x php,html,txt
→ Also check extensions
$ gobuster dns -d [Link] -w [Link]
→ Subdomain enumeration
Linux for Hackers · Page 2 For educational purposes only — hack ethically!
Netcat — The Swiss Army Knife
COMMAND WHAT IT DOES
nc -zv host 80 Test if port 80 is open (-z = no data)
nc -zv host 1-1000 Port scan range 1-1000
nc -lvnp 4444 Listen on port 4444 (catch reverse shells)
nc host 4444 Connect to remote listener
nc -l 1234 > file Receive a file over network
nc host 1234 < file Send a file to remote listener
Lab Exercises
Use a VM or a practice platform like TryHackMe / HackTheBox.
■ Lab 1: Set up two VMs. Run nmap -sV -O against the second VM and document every open port
and service version.
■ Lab 2: Use gobuster to find hidden directories on DVWA (Damn Vulnerable Web App —
install locally).
■ Lab 3: Run nmap --script vuln against a Metasploitable2 VM and identify at least 3
vulnerabilities.
■ Lab 4: Use theHarvester to collect email addresses and subdomains for a public
organisation (e.g. a CTF site).
■ Lab 5: Set up a netcat listener and use it to transfer a file between two machines.
Linux for Hackers · Page 3 For educational purposes only — hack ethically!