What Network Recon asks#

Reconnaissance reads the public record on a domain, the Port Scanner finds what is listening on a network, and Crawl & API Scan works over a web application.

Network Recon answers three different questions about a target, and gives each its own tab. What does the public record say about this domain? What is listening on this network? What does this web application expose?

You do not have to work through them in order. Each tab takes a target, runs read-only checks, and leaves the results in place until you close the workspace. Nothing here changes the target. There is one exception, and you must switch it on deliberately. Audit and safety covers it.

The Network Recon workspace on the Reconnaissance tab, with the Port Scanner and Crawl & API Scan tabs beside it and an empty target field

What each tab answers#

Reconnaissance works on a domain name. Enter a domain and the tab runs six lookups at once. The lookups cover DNS, the TLS certificate, email authentication, registration, reachability, and the network path. This is the passive tab: everything it reports comes from public records or from one ordinary request.

Port Scanner works on an address range. It finds which hosts are alive, then which ports on those hosts accept connections, and what answers on them.

Crawl & API Scan works on a web application. It walks the site the way a browser does, records every URL it reaches, and checks the responses for common misconfigurations. It also scans an API directly if you have its definition file.

What the tabs share#

The three tabs share a workspace but not their state. Each keeps its own target and its own results, so you can leave a long scan on one tab and work on another.

When you switch tabs, the workspace clears the smaller pieces of interface state: the filter text you typed, the sections you collapsed, and the row you selected. The results stay.

Reconnaissance is usually the cheapest place to start, because a domain's DNS and certificate records tell you which hosts and names are worth a scan. The Port Scanner then narrows that list to the hosts you can reach. Crawl & API Scan then goes deep on whatever serves HTTP.

Note Port scanning and active crawling are intrusive in a way that reading DNS records is not. Run them only against systems you are responsible for or have written permission to test.