internal-recon

Internal network mapping identifies live hosts, open ports, and running services to reveal active assets. It focuses on discovering critical infrastructure like domain controllers, databases, and file servers within the internal network from your current foothold.

Locating critical assets during internal reconnaissance involves scanning live hosts and enumerating their services to pinpoint high-value targets. This specifically identifies domain controllers, databases, and file servers within the internal network topology.

Yes, nmap is supported as a fallback for port scanning when fscan is unavailable. The internal reconnaissance workflow prioritizes fscan for host discovery and service enumeration but seamlessly falls back to nmap to complete topology mapping.

Internal network reconnaissance typically does not face CDN or WAF protections, simplifying host discovery. However, your scanning scope and operational reach are strictly limited by the network position of your current foothold within the topology.

The primary limitation of scanning from a single foothold is restricted network visibility, confining host discovery to accessible subnets. Network segmentation and routing boundaries may prevent the mapping from reaching isolated or firewalled critical infrastructure.

Generating an internal network map and priority attack paths requires discovering live hosts and enumerating open ports to locate critical infrastructure. This process outputs the network topology and highlights high-value targets for optimal lateral movement planning.