skills.rest
baljinnyamday
baljinnyamdayCOMMUNITY
Explore all skills by this author →
GitHub

ring-expansion

Expands network reconnaissance from a sparse /24 into adjacent RFC1918 segments.

Updated May 27, 2026
Search Tags:#reconnaissance#network discovery#red team#nmap#lateral movement#subnet scanning#rfc1918
One-click install
npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill ring-expansion-baljinnyamday
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ring-expansion
Source: https://github.com/baljinnyamday/autonomous-red-team-agent/tree/main/harness/src/agent_redteam/skill_library/ring-expansion
Command: npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill ring-expansion-baljinnyamday

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? A sparse local /24 scan often hides a larger network, and this playbook guides widening reconnaissance ring by ring so sibling segments reachable through the gateway are discovered instead of missed. ## Core Features & Use Cases - Cheap liveness probing: Runs nmap -sn one probe per host instead of full-port scans to map live segments quickly. - Progressive radius growth: Expands from adjacent /24s to the surrounding private block and other in-scope RFC1918 ranges. - Targeted deep recon: Runs full recon only on segments that answer, keeping effort proportional to findings. - Use Case: During an authorized red team engagement, a scan of 10.0.1.0/24 returns only two hosts but a default route points at a gateway; use this playbook to probe 10.0.0.0/24 and 10.0.2.0/24, then deep-scan the responsive segments. ## Quick Start Use the ring-expansion playbook to widen reconnaissance beyond the sparse local /24 and map adjacent in-scope network segments.

Frequently Asked Questions about ring-expansion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find more hosts when a /24 scan returns almost nothing?▼

Run cheap liveness probes with nmap -sn against adjacent /24 segments rather than repeating full-port scans. A sparse subnet often means sibling segments route through the same gateway, so grow the search radius ring by ring.

What nmap command works best for fast network discovery?▼

Use nmap -sn for a ping-style liveness sweep that sends one probe per host without port scanning. It quickly identifies which segments contain live hosts before committing to expensive full recon.

When should I expand reconnaissance beyond the local subnet?▼

Expand when scan results return far fewer hosts than the evidence implies, or when a default route points at a gateway. These signs indicate additional segments are reachable through routing rather than visible locally.

Can I scan any RFC1918 range during a red team engagement?▼

No, only scan private ranges that are explicitly in scope for the engagement. The playbook expands through adjacent /24s and the surrounding private block but never sweeps out-of-scope address space.

Why run full recon only on segments that answer?▼

Full-port recon is expensive in time and network noise, so it is reserved for segments where liveness probes confirm active hosts. This keeps the engagement efficient and reduces unnecessary defensive telemetry.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

internal-recon

Map live hosts, open ports, services, and critical assets in internal networks using fscan.

Official
Intermediate
Prohao42Prohao42
120

linux-lateral-movement

Automate lateral movement across Linux hosts using SSH agent hijacking and credential harvesting.

Community
Advanced
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced
duriandurinoduriandurino

enum

Discover live hosts and enumerate open ports and services with nmap, gobuster, feroxbuster, and ffuf.

Community
Intermediate