Active Reconnaissance — TryHackMe

Part of my Cyber Security Internship at Cyber Leelawat

© Tryhackme

Active reconnaissance is the process of directly interacting with a target system or network to gather information about it. Active reconnaissance requires transmitting packets, making connections, and probing services. The distinction matters because active techniques leave traces in the form of log entries, IDS alerts, WAF blocks, and honeypot triggers.

As part of my learning journey — and while gaining practical experience during my Cyber Security Internship at Cyber Leelawat — I completed the “Active Reconnaissance” room on TryHackMe to strengthen my information gathering skills.

Room: Active Reconnaissance [TryHackMe]

Objectives:

• Use a web browser and its Dev Tools to inspect headers, JS source files, and certificates for reconnaissance purposes.
• Use ping to test host reachability and infer operating system details from TTL values.
• Use traceroute and mtr to map network paths and discover. intermediate hops.
• Use telnet for legacy banner grabbing.
• Use netcat to perform banner grabbing, basic port probing, and simple client-server communication.

Let’s get started!

TASK 2: WEB BROWSER

The web browser is one of the most convenient and least suspicious tools for active reconnaissance. The developer tools of a browser allows you to inspect the source code, headers, requests and responses. Plugins / extension like wappalyzer allows to inspect underlying technologies of a website.

Question 1: Browse to the following website and ensure that you have opened your Developer Tools on AttackBox Firefox, or the browser on your computer. Using the Developer Tools, figure out the total number of questions.

Ans: 8

TASK 3: PING

Ping send a small test packet to a remote host and waits for a reply. This simple exchange tells you whether the target is reachable over the network and whether it is online and responding.

Question 1: Which option would you use to set the size of the data carried by the ICMP echo request?

Ans: -s

Question 2: What is the size of the ICMP header in bytes?

Ans: 8

Question 3: Does MS Windows Firewall block ping by default? (Y/N)

Ans: Y

Question 4: Deploy the VM for this task and using the AttackBox terminal, issue the command ping -c 10 10.48.160.159. How many ping replies did you get back?

Get Darsh Mohile’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Ans: 10

TASK 4: TRACEROUTE

The traceroute command traces the route that packets take from your system to a target host. Its purpose is to discover the IP addresses of the routers (hops) along the path and to determine how many of them sit between you and the destination.

This information is useful for understanding network topology, identifying where filtering or latency occurs, and mapping infrastructure.

Question 1: In Traceroute A, what is the IP address of the last router/hop before reaching tryhackme.com?

Ans: 172.67.69.208

Question 2: In Traceroute B, how many routers are between the two systems?

Ans: 104.26.11.229

Question 3: In Traceroute B, how many routers are between the two systems?

Ans: 25

Question 4: In Traceroute B, how many routers are between the two systems?

Ans: 25

TASK 5: TELNET

The TELNET (Teletype Network) protocol was developed in 1969 to communicate with a remote system via a command-line interface.The telnet command uses this protocol for remote administration, with a default port of 23. From security point of view, it sends all the data in plain text including usernames and passwords which is obviously insecure and poor design.

Despite its security shortcomings, the telnet client has a useful property for reconnaissance. Because it operates over TCP, you can use it to connect to any TCP port and observe the server’s response. This technique is known as banner grabbing.

Question 1: Start the attached VM from Task 3 if it is not already started. On the AttackBox, open the terminal and use the telnet client to connect to the VM on port 80. What is the name of the running server?

Ans: Apache

Question 2: Start the attached VM from Task 3 if it is not already started. On the AttackBox, open the terminal and use the telnet client to connect to the VM on port 80. What is the name of the running server?

Ans: 2.4.61

TASK 6: NETCAT

Netcat is a versatile networking utility that supports both TCP and UDP protocols. It can function as a client that connects to a listening port, or as a server that listens on a port of your choice.

This dual capability makes it useful for banner grabbing, port probing, simple file transfers, and basic client-server communication.

Question 1: Start the VM and open the AttackBox. Once the AttackBox loads, use Netcat to connect to the VM port 21. What is the version of the running server?

Ans: 0.17

Completing this room provides us with a great amount of information on active reconnaissance, key factors of active recon like banner grabbing, tracing the route of a packet, reachability testing and source code analysis. All of these tools are essential to gather accurate and crucial information.

Thank you