offensive-recon

A small, opinionated toolkit for the early phases of an authorized network engagement: fast service discovery and signal-focused host triage. Built and field-tested during OSCP preparation — designed to be quieter and higher-signal than the usual all-in-one enumeration scripts.

⚠️ For authorized security testing, CTFs, and lab environments only. Scanning or running these tools against systems you do not own or have explicit written permission to test is illegal.

What's inside

Tool	Runs on	Purpose
recon/recon.sh	Attacker (Linux)	Three-phase nmap orchestration: full TCP sweep + parallel UDP + targeted service/version scan
triage/oscp-linux-triage.sh	Target (Linux)	Detection-only local triage — credential & misconfiguration hunting with a severity rubric
triage/oscp-windows-triage.ps1	Target (Windows)	PowerShell credential hunter with the same signal-first philosophy

---

recon.sh — network discovery

Automates the nmap workflow you'd otherwise drive by hand across three terminals:

1. UDP top-20 in the background (non-blocking), with a version/script follow-up on anything truly open.
2. Full TCP port sweep (-p- --min-rate=1000 -T4) in the foreground.
3. Targeted -A scan on exactly the ports found in step 2 — version detection, default scripts, OS guess.

./recon/recon.sh 10.10.10.10            # full run  -> ./recon-10.10.10.10/
./recon/recon.sh --quick 10.10.10.10    # skip UDP
./recon/recon.sh 10.10.10.10 out-dir    # custom output directory

Design notes

• Parses discovered ports precisely (open TCP only) and pipes them straight into the targeted scan — no copy/paste between steps.
• Primes sudo once so the backgrounded UDP scan doesn't race the foreground scan for the password prompt; degrades cleanly under NOPASSWD.
• Writes -oN / -oA outputs to a per-target directory so results are easy to grep later.

Validated end-to-end against a live Windows domain controller: a full 65,535-port sweep plus targeted service scan completed in ~5 minutes, and an independent higher-retry scan confirmed zero missed ports.

---

Triage scripts — detection-only host enumeration

A deliberate alternative to linPEAS / winPEAS, built on two principles:

• Detection, not prescription. They report what was found — files, credentials, misconfigurations — against a severity rubric. They do not print pages of speculative "you could try…" attack steps.
• Signal over volume. Tuned to surface credentials and high-value findings first, with a false-positive filter so you aren't wading through framework boilerplate and package noise.

# Linux target
./triage/oscp-linux-triage.sh           # CRIT/HIGH + system enum to stdout, full report to /tmp
./triage/oscp-linux-triage.sh --full    # also print MED / FLAG findings

# Windows target (PowerShell)
.\triage\oscp-windows-triage.ps1
.\triage\oscp-windows-triage.ps1 -Full

Severity model (both scripts):

Level	Meaning
CRITICAL	bait-named file with secret content, private keys, or credentials found in another user's profile
HIGH	unambiguous secret formats (tokens, key=value credential assignments, URL-embedded creds)
MED	weaker indicators worth a look
FLAG	interesting filenames/locations to eyeball manually

stdout carries CRITICAL + HIGH + system enumeration so findings survive truncation over wmiexec / SMB shells; the complete report (including MED / FLAG) is written to a file.

---

License

MIT