0Pricing
Ethical Hacking Academy · Lesson

Building a Recon Tool

Practical script.

Building a Recon Tool is a free Ethical Hacking Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Putting It All Together

Now you will combine variables, loops, tool execution, and parsing into one practical recon script.

The goal: take a target, discover open ports, fingerprint services, and save organized results - all in one command.

Planning the Script

Good tools are designed before they are coded. Our recon script will:

  • Validate input (require a target).
  • Create an output directory.
  • Run a port scan, then version detection.
  • Parse and summarize open ports.

Header and Input Check

Start with the shebang, safety options, and an argument check that prints usage if no target is given.

#!/bin/bash
set -euo pipefail
if [ "$#" -ne 1 ]; then
  echo "Usage: $0 <target>"
  exit 1
fi
target=$1

Output Directory

Create a per-target, timestamped folder so repeated runs do not clobber each other.

stamp=$(date +%F_%H%M)
outdir="recon_${target}_${stamp}"
mkdir -p "$outdir"
echo "[*] Results in $outdir"

Step 1: Quick Port Scan

First find which ports are open, fast, across the full range.

echo "[*] Scanning ports on $target"
nmap -p- --open -T4 "$target" -oG "$outdir/ports.gnmap" >/dev/null

Step 2: Parse Open Ports

Extract the open port numbers from the greppable output into a comma-separated list for the next scan.

ports=$(grep -oE '[0-9]+/open' "$outdir/ports.gnmap" | cut -d/ -f1 | paste -sd, -)
echo "[*] Open ports: $ports"

Step 3: Version Detection

Run a focused service-version scan against only the open ports - faster and quieter than scanning everything again.

if [ -n "$ports" ]; then
  nmap -sV -p "$ports" "$target" -oN "$outdir/services.txt"
fi

Step 4: Summary

Print a clean summary so the operator sees results without opening files.

echo "=== Summary for $target ==="
grep 'open' "$outdir/services.txt" | awk '{print $1, $3}'

Adding Logging

Append a timestamped log line so you can reconstruct what ran and when - important for reporting.

echo "$(date) scanned $target -> $ports" >> recon.log

Running the Tool

Make it executable and point it at a lab VM. Everything lands in the output folder.

chmod +x recon.sh
./recon.sh 192.168.56.10

Extending Further

From this base you can add:

  • Web directory brute-forcing when port 80/443 is open.
  • Banner grabbing with netcat.
  • Looping over a target list instead of a single host.
  • HTML or Markdown report generation.

Quick Check

Recall why we parse before the version scan.

Recap

You built a working recon tool:

  • Validated input and created a timestamped output directory.
  • Ran a fast port scan, parsed open ports, then version-scanned only those.
  • Printed a summary and logged the run.
  • Identified clear extension points (web brute-force, banner grabbing, reporting).

This completes the Bash scripting course.

Frequently asked questions

Is the “Building a Recon Tool” lesson free?

Yes — the full text of “Building a Recon Tool” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Building a Recon Tool”?

Practical script. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Building a Recon Tool” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Script Basics
  2. Automating Recon
  3. Parsing Output
  4. Building a Recon Tool
← Back to Ethical Hacking Academy