Run Your First Reconnaissance Scan

Overview

This tutorial walks you through creating your first reconnaissance scan in reNgine Cloud. You'll learn how to add targets, configure scan profiles, execute scans, interpret results, and export findings for further analysis or reporting.

reNgine Dashboard - Reconnaissance Overview

Step 1: Add a Target Domain

Begin by adding your target domain to reNgine. This creates a project that will contain all scan data, findings, and historical results.

POST /api/targets/
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "name": "example.com",
  "description": "Company website - Q1 2025 assessment",
  "h1_team_handle": "@security-team",
  "tags": ["production", "web-app"]
}

Step 2: Understand Scan Profiles

Scan profiles define what tools run and how aggressive the scan will be. reNgine includes several pre-configured profiles for different use cases.

Step 3: Configure Scan Engine

Scan engines are collections of reconnaissance tools. You can customize which tools run and their parameters.

# Example: Custom scan engine configuration
{
  "engine_name": "Custom Full Recon",
  "subdomain_discovery": true,
  "http_probe": true,
  "port_scan": true,
  "vulnerability_scan": true,
  "screenshot": true,
  "nuclei_severity": ["critical", "high", "medium"],
  "port_scan_type": "top-1000",
  "enable_http_crawl": true,
  "enable_osint": true
}

Step 4: Launch Your First Scan

Now you're ready to initiate your first reconnaissance scan.

POST /api/scans/
Authorization: Bearer YOUR_API_KEY

{
  "target_id": 1,
  "scan_engine_id": 2,
  "scan_type": "full",
  "import_subdomains": true
}

# Response
{
  "id": 42,
  "status": "running",
  "target": "example.com",
  "scan_engine": "Full Scan",
  "started_at": "2025-01-15T10:00:00Z",
  "celery_ids": ["abc-123", "def-456"]
}

Scan progress is displayed in real-time. You'll see each tool's status as it executes.

Step 5: Monitor Scan Progress

Track your scan in real-time from the dashboard. reNgine provides detailed metrics on each task.

# Check scan status via API
GET /api/scans/42/
Authorization: Bearer YOUR_API_KEY

# Response includes task progress
{
  "id": 42,
  "status": "running",
  "progress": {
    "subdomain_discovery": "completed",
    "http_probe": "running",
    "port_scan": "pending",
    "vulnerability_scan": "pending"
  },
  "subdomains_found": 127,
  "endpoints_discovered": 89,
  "vulnerabilities_found": 12
}

Step 6: Analyze Scan Results

Once the scan completes, review your findings across multiple categories.

# Get scan results summary
GET /api/scans/42/results/
Authorization: Bearer YOUR_API_KEY

# Response structure
{
  "scan_id": 42,
  "target": "example.com",
  "summary": {
    "subdomains": 127,
    "endpoints": 89,
    "vulnerabilities": {
      "critical": 2,
      "high": 8,
      "medium": 15,
      "low": 23,
      "info": 45
    },
    "technologies": 34,
    "interesting_subdomains": 12
  },
  "completion_time": "2025-01-15T11:30:00Z",
  "duration_minutes": 90
}

Step 7: Export Results

Export scan data in various formats for reporting or further analysis.

# Export scan results
GET /api/scans/42/export?format=pdf
GET /api/scans/42/export?format=json
GET /api/scans/42/export?format=csv

# Or via dashboard: Click "Export" → Select format → Download

Step 8: Schedule Automated Scans

Set up recurring scans to continuously monitor your attack surface.

POST /api/scheduled-scans/
Authorization: Bearer YOUR_API_KEY

{
  "target_id": 1,
  "scan_engine_id": 2,
  "frequency": "weekly",
  "day_of_week": "monday",
  "time": "02:00",
  "timezone": "UTC",
  "enabled": true,
  "notification_emails": ["security@company.com"]
}

Understanding Results: Example Findings

Here's what a typical scan might discover:

# Subdomains (127 found)
www.example.com         → 93.184.216.34
api.example.com         → 93.184.216.35
admin.example.com       → 93.184.216.36
staging.example.com     → 93.184.216.37
dev.example.com         → 93.184.216.38

# Critical Vulnerabilities (2)
[CRITICAL] SQL Injection on api.example.com/search?q=
[CRITICAL] Exposed .git directory on staging.example.com/.git/

# High Vulnerabilities (8)
[HIGH] Missing security headers on www.example.com
[HIGH] Outdated WordPress version on blog.example.com
[HIGH] Exposed admin panel on admin.example.com (no auth)
...

# Technologies Detected
- WordPress 5.8 (outdated)
- PHP 7.4
- nginx 1.18.0
- MySQL
- jQuery 3.5.1
- Cloudflare CDN

Best Practices

Troubleshooting

Next Steps