Reconnaissance Workflow

Run comprehensive reconnaissance against the target.

Target

Target: $ARGUMENTS

If no target was provided, ask the user for a target before proceeding. Verify the target is in .pentest/scope.json (run cat .pentest/scope.json to check). If not in scope, ask the user to add it with /scope add <target>.

Environment Detection

• Wrapper scripts available: !test -f scripts/nmap/discover-live-hosts.sh && echo "YES" || echo "NO"

Steps

1. Host Discovery

Discover active hosts on the target network. ARP scans are fastest on local networks; TCP SYN/ACK probes work across subnets and through some firewalls.