Active Recon: Touching a Target You Own

A normal browser visit to a public homepage is often treated as ordinary use of a public service. A burst of pings, a port probe, a scripted crawl, a custom User-Agent that says SCANNER, or a connect_ex loop is not ordinary use. Defenders call those things reconnaissance or scanning because they look like the opening of an attack even when you meant homework. The other host does not owe you the benefit of the doubt. Your ISP and the café operator do not owe it either. Active recon is defined by your intent to test plus traffic you caused, not by whether you used nmap. Python ping-equivalents, curl in a loop, and “I only used ping” are still active.

Topic 7 already made this concrete: connect_ex to 127.0.0.1 is a lab; the same call to a café IP is unauthorized scanning. Module 2 sits one step earlier. Even before a port loop, a single ICMP echo to a host you do not own is a packet you chose to send. DNS lookups of example.com are the public-record exception Lesson 3 will use — they are how the internet is supposed to work, aimed at a designated example name. ICMP to a neighbor, TCP to a school jumphost, and HTTP flooding a shop “to see headers” are not that exception. If you are unsure, do not send it. Ask Cyberlium AI Mentor for a hint about scope, not for a target list.

sudo apt install curl
sudo apt install python3

brew install python3

curl -sS -m 2 -D - "http://127.0.0.1:8000/" | head -n 12

Module 1 asked you to write a personal RoE for YOUR lab. Pull that file. Active recon against 127.0.0.1 is covered because you own the machine. Active recon against a domain you registered is covered if your own RoE says so — still not against their CDN’s other customers. Active recon against a client network requires a contract: names, IP ranges, excluded hosts, allowed ports, hours, emergency contact. You do not have that contract for the campus, the hotel Wi-Fi, or the ISP. Do not invent one. Do not screenshot a Terms of Service and call it RoE; ToS is not a pentest authorization letter.

What “written” looks like in this course: a text file you dated, that lists allowed targets (example.com for public DNS/WHOIS only; YOUR domain; 127.0.0.1 for later scans), and that lists forbidden targets (café, ISP, school, random internet, neighbor). chmod 600. If a future job gives you a real RoE PDF, you will recognize the shape. Until then, your personal RoE is the only writing that matters, and it does not authorize strangers.

sudo apt install dnsutils

cat >> "$NOTES" << 'EOF'
active_means: I initiated contact; logs can name me
permission_document: I own this PC / VM  OR  signed RoE names the host
not_permission: it answered ping; it is on my Wi-Fi; I am learning CEH
EOF

This lesson will not give you a ping sweep of a /24. It will not give you traceroute to a news site as “practice.” It will not give you a list of nmap timing templates. It will not tell you to knock on every host that answered ARP on café Wi-Fi. Those are how unauthorized scans start. The positive list is short: you may ping a host you own (your VM, your router if you administer it at home — not the café AP). You may send one GET to example.com or YOUR site (Lesson 1). You may query public DNS/WHOIS for example.com (Lesson 3). You may later TCP-connect 127.0.0.1 (Module 3). Everything else waits for a contract you do not have yet.

Home-lab note: pinging 127.0.0.1 proves ICMP locally and teaches nothing about the internet, which is fine. Pinging your own public IP from the same machine can hit carrier-grade NAT and confuse you; it still is not a reason to ping a neighbor to “compare.” If you share a house network, other people’s devices are still not yours. Get explicit consent, in writing, or stay on loopback and names you registered.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cat >> "$NOTES" << 'EOF'
will_not_send: port-sweeps of 192.168.0.0/24, hydra, nmap -sS, directory brute on strangers
will_send: GET/HEAD to 127.0.0.1 or DEMO only after identify proved MY app
EOF

Print three lines before any active tool: TARGET, WHY_ALLOWED, PACKET_TYPE. TARGET must be example.com (public records only), a domain you own, 127.0.0.1, or a VM IP you typed because you own the hypervisor. WHY_ALLOWED must be “I own it” or “RoE dated YYYY-MM-DD.” PACKET_TYPE must be the actual thing (ICMP, TCP connect, one HTTP GET) — not “recon” as a fog word. If any line is blank, do not send. If TARGET is a café gateway, stop. This card is the whole skill. Tools change; the card does not.

Logs work both ways. Your notes should record what you sent, to whom, and the permission line, so you can prove the lab stayed in scope. Their logs may still show your IP. That is why permission exists — so a defender who sees you can call the person who authorized you instead of calling abuse. Without writing, you are just a source address.

Create or update $HOME/cyberlium-lab/active-recon-scope.txt. The Python below only pings 127.0.0.1 — loopback ICMP — so you can see an active packet that cannot leave the machine. If ping is blocked on your OS, write “ICMP not available; card still filled” and stop. Do not switch the host to the café to get a prettier RTT. chmod 600.

sudo apt install whois
sudo apt install python3

brew install whois
brew install python3

cd "$HOME/cyberlium-lab"

cat > active_recon_loopback_ping.py << 'PY'
import platform
import subprocess

HOST = "127.0.0.1"
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback — this is not a cafe/ISP/school probe")

count_flag = "-n" if platform.system().lower().startswith("win") else "-c"
cmd = ["ping", count_flag, "1", HOST]
print("scope_target:", HOST)
print("why_allowed: I own this machine (loopback)")
print("packet_type: ICMP echo (one packet)")
print("command:", " ".join(cmd))
try:
completed = subprocess.run(cmd, capture_output=True, text=True, timeout=8)
print("exit:", completed.returncode)
print((completed.stdout or completed.stderr or "")[:500])
except Exception as e:
print("ping_unavailable:", e)
print("still valid: fill the scope card; do not retarget a cafe")
print("ethics: no cafe, no ISP, no school, no random hosts")
PY

python3 active_recon_loopback_ping.py || python active_recon_loopback_ping.py

{

You now treat active recon as traffic you caused, logged on both sides, legal only with ownership or RoE. Loopback ping is the safe demo. Café, ISP, and school stay off the card. This is original Cyberlium material, not official CEH training. Next — Public Records: DNS, WHOIS, and Your Domain — you will read nslookup and whois for example.com (or a domain you control). Those queries are public records, not zone-transfer attacks on random names.