ring-expansion

Expands network reconnaissance from a sparse /24 into adjacent RFC1918 segments.

Updated May 27, 2026

Search Tags:#reconnaissance #network discovery #red team #nmap #lateral movement #subnet scanning #rfc1918

Ready to run

npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill ring-expansion-baljinnyamday

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ring-expansion
Source: https://github.com/baljinnyamday/autonomous-red-team-agent/tree/main/harness/src/agent_redteam/skill_library/ring-expansion
Command: npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill ring-expansion-baljinnyamday

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? A sparse local /24 scan often hides a larger network, and this playbook guides widening reconnaissance ring by ring so sibling segments reachable through the gateway are discovered instead of missed. ## Core Features & Use Cases - Cheap liveness probing: Runs `nmap -sn` one probe per host instead of full-port scans to map live segments quickly. - Progressive radius growth: Expands from adjacent /24s to the surrounding private block and other in-scope RFC1918 ranges. - Targeted deep recon: Runs full `recon` only on segments that answer, keeping effort proportional to findings. - Use Case: During an authorized red team engagement, a scan of 10.0.1.0/24 returns only two hosts but a default route points at a gateway; use this playbook to probe 10.0.0.0/24 and 10.0.2.0/24, then deep-scan the responsive segments. ## Quick Start Use the ring-expansion playbook to widen reconnaissance beyond the sparse local /24 and map adjacent in-scope network segments.

Frequently Asked Questions about ring-expansion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find more hosts when a /24 scan returns almost nothing?▼

Run cheap liveness probes with nmap -sn against adjacent /24 segments rather than repeating full-port scans. A sparse subnet often means sibling segments route through the same gateway, so grow the search radius ring by ring.

What nmap command works best for fast network discovery?▼

Use nmap -sn for a ping-style liveness sweep that sends one probe per host without port scanning. It quickly identifies which segments contain live hosts before committing to expensive full recon.

When should I expand reconnaissance beyond the local subnet?▼

Expand when scan results return far fewer hosts than the evidence implies, or when a default route points at a gateway. These signs indicate additional segments are reachable through routing rather than visible locally.

Can I scan any RFC1918 range during a red team engagement?▼

No, only scan private ranges that are explicitly in scope for the engagement. The playbook expands through adjacent /24s and the surrounding private block but never sweeps out-of-scope address space.

Why run full recon only on segments that answer?▼

Full-port recon is expensive in time and network noise, so it is reserved for segments where liveness probes confirm active hosts. This keeps the engagement efficient and reduces unnecessary defensive telemetry.