0Pricing
Ethical Hacking Academy · Lesson

Automating Recon

Scripted scans.

Automating Recon is a free Ethical Hacking Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Automate Recon

Reconnaissance is the first phase of an assessment - discovering hosts, ports, and services. It is repetitive and error-prone by hand.

Scripting recon makes it consistent, fast, and easy to repeat across targets while you take notes.

Host Discovery

The first step is finding live hosts. A ping sweep with Nmap returns who is up on a subnet.

nmap -sn 192.168.56.0/24 -oG hosts.gnmap

A Simple Ping Sweep Script

You can roll your own sweep in pure Bash, useful when Nmap is unavailable on a target.

#!/bin/bash
net=192.168.56
for i in $(seq 1 254); do
  ping -c1 -W1 $net.$i >/dev/null 2>&1 && echo "$net.$i is up"
done

Port Scanning

Once you have live hosts, scan their ports. Save output in a parseable format so a later script can read it.

nmap -p- --open -oN ports.txt 192.168.56.10

Service and Version Detection

Add -sV to fingerprint the software behind each open port. Knowing exact versions helps you find matching exploits.

nmap -sV -p 22,80,443 192.168.56.10 -oN services.txt

Looping Over Targets

Feed a list of hosts into a loop to scan many machines unattended.

#!/bin/bash
while read host; do
  echo "[*] Scanning $host"
  nmap -sV "$host" -oN "scan_$host.txt"
done < targets.txt

Adding a Timestamp

Recording when each scan ran keeps your evidence organized for the report.

stamp=$(date +%Y%m%d_%H%M%S)
nmap -sV 192.168.56.10 -oN "scan_$stamp.txt"

Chaining Tools

Recon scripts shine when they chain tools: discover with Nmap, then feed web hosts into a directory scanner like gobuster.

gobuster dir -u http://192.168.56.10 -w /usr/share/wordlists/dirb/common.txt

Throttling and Stealth

Aggressive scans are noisy and may crash fragile lab services. Control speed with timing templates and add delays in loops.

  • -T2 is polite, -T4 is fast.
  • A sleep between hosts reduces load.
nmap -T2 192.168.56.10
# sleep 1   # between iterations in a loop

Organizing Output

Create a results directory per engagement so scans, screenshots, and notes stay together.

#!/bin/bash
outdir=recon_$(date +%F)
mkdir -p "$outdir"
nmap -sV 192.168.56.10 -oN "$outdir/services.txt"

Always Have Authorization

Automated scanning amplifies your reach. Only ever run these scripts against systems you own or have written permission to test.

In your lab, point everything at the host-only subnet and your vulnerable VMs.

Quick Check

Recall Nmap output and detection flags.

Recap

You scripted the recon workflow:

  • Discover hosts (nmap -sn or a Bash ping sweep).
  • Scan ports and detect versions (-sV).
  • Loop over target lists, timestamp results, and chain tools like gobuster.
  • Throttle scans and always confirm authorization.

Next: parsing the output you collect.

Frequently asked questions

Is the “Automating Recon” lesson free?

Yes — the full text of “Automating Recon” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Automating Recon”?

Scripted scans. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Automating Recon” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Script Basics
  2. Automating Recon
  3. Parsing Output
  4. Building a Recon Tool
← Back to Ethical Hacking Academy