# Scanning & Reconnaissance Tools

Published: 2026-02-08 · Updated: 2026-10-27 · By HackerGPT Team
Canonical: https://hackergpt.org/blog/scanning-reconnaissance-tool/

> Master the mechanics of network reconnaissance. Learn how to operationalize subdomain enumeration, Nmap scanning, and service fingerprinting for effective exposure management.

HackerGPT provides a comprehensive suite of scanning and reconnaissance tools designed for cybersecurity professionals and OSINT enthusiasts. These tools help you discover network services, map infrastructure, and gather intelligence about target domains.

This page is the reference for each tool. For a worked run, see how to [check the open ports of your own server](https://hackergpt.org/blog/accelerating-reconnaissance-a-technical-guide-to-hackergpts-integrated-network-scanning/) and how to [map the attack surface of your web app](https://hackergpt.org/blog/map-web-app-attack-surface/). Every [HackerGPT feature](https://hackergpt.org/features/) is meant for targets you own or have written permission to test.

* * *

## Scanning Tools

Use these tools to discover open ports, running services, and detect potential vulnerabilities on target hosts.

### Network Scanning (nmap\_scan)

Advanced network mapping and vulnerability discovery tool with multiple scan types:

- **Service Discovery:** Identify running services on target hosts
- **SYN Scan (-sS):** Fast, stealthy half-open scan
- **TCP Scan (-sT):** Full TCP connection scan
- **UDP Scan (-sU):** Discover UDP services
- **Comprehensive Scan (-A):** OS detection, version detection, script scanning, and traceroute

#### Example Prompts:

```
Perform a service discovery scan on juice-shop.hackergpt.app
```

```
Run a SYN scan on example.com
```

```
Perform OS and version detection on cybergym.hackergpt.app
```

```
Do a comprehensive scan on my target domain
```

### Web Fingerprinting (web\_fingerprint)

Fingerprint web applications to discover server type, version, and other software information. This is recommended as a first step for service discovery.

- Identifies the server and software running on it
- Helps with identifying potential vulnerabilities
- Detects web frameworks and technologies in use

#### Example Prompts:

```
Check juice-shop.hackergpt.app
```

```
Fingerprint the web application at example.com
```

```
What technologies is hackergpt.app running?
```

![Service Fingerprinting Analysis](https://hackergpt.org/blog/scanning-reconnaissance-tool/1770431689717-69y4etdyy0h.webp "Service Fingerprinting Analysis")

A visual breakdown of how fingerprinting tools analyze HTTP headers and favicons to identify technology stacks.

### SSL/TLS Scanning (sslscan)

Analyze SSL/TLS configuration to identify security weaknesses in cryptographic implementations.

- Identifies supported TLS/SSL protocol versions
- Lists available cipher suites
- Checks for vulnerabilities like Heartbleed
- Evaluates certificate information

#### Example Prompts:

```
Perform SSL Scan on juice-shop.hackergpt.app
```

```
Check SSL configuration for example.com
```

```
Is example.com vulnerable to heartbleed?
```

* * *

## Reconnaissance Tools

Gather intelligence about target domains, discover hidden infrastructure, and map out potential attack surfaces.

![Attack Surface Visualization](https://hackergpt.org/blog/scanning-reconnaissance-tool/1770431579918-tsaq7hjias9.webp "Attack Surface Visualization")

An abstract visualization of a network topology showing the relationship between subdomains, IPs, and cloud assets.

### Subdomain Discovery (subfinder)

Advanced subdomain enumeration to discover hidden or forgotten infrastructure.

- Discovers subdomains using multiple sources
- Identifies potential attack surfaces
- Uncovers forgotten or misconfigured services

#### Example Prompts:

```
Find subdomains for hackergpt.app
```

```
Enumerate subdomains of example.com
```

```
What subdomains exist for target.example?
```

### WHOIS Lookup (whois)

Domain registration intelligence gathering for extracting ownership and registration details.

- Extracts registration details and dates
- Reveals ownership information
- Identifies potential contact points
- Shows domain expiration dates

#### Example Prompts:

```
Find domain registration details for hackergpt.app
```

```
WHOIS lookup for example.com
```

```
Who owns the domain target.example?
```

### Geo IP Location (get\_ip\_geolocation)

Geographical infrastructure mapping to understand where target systems are located.

- Provides city, region, and country information
- Returns latitude and longitude coordinates
- Offers geopolitical context for targeted infrastructure

#### Example Prompts:

```
Find geo location of hackergpt.app
```

```
Where is the server for example.com located?
```

```
Get IP geolocation for 8.8.8.8
```

### Domain to IP Resolution (get\_domain\_ip)

Map domain names to their IP addresses for further analysis.

#### Example Prompts:

```
What is the IP address of example.com?
```

```
Resolve hackergpt.app to its IP
```

* * *

## Combining Tools for Better Results

HackerGPT can chain multiple tools together to provide comprehensive analysis. Here are some powerful combinations:

![How HackerGPT's recon tools chain: subfinder, get\_domain\_ip, nmap\_scan, then CVEs, with fingerprint, TLS and WHOIS on the side](https://hackergpt.org/blog/scanning-reconnaissance-tool/tool-chain.webp)

Each tool's output feeds the next. Green is the main path from a domain you own to the CVEs worth checking; grey tools add context.

### Full Reconnaissance Workflow

```
Perform a service discovery scan and find associated CVEs on cybergym.hackergpt.app
```

### Infrastructure Mapping

```
Find subdomains for target.example and check their SSL configurations
```

### Vulnerability Discovery Chain

```
Perform a service discovery scan and find associated CVEs on juice-shop.hackergpt.app
```

After vulnerabilities are found, you can prompt:

```
Find exploit script for CVE-XXXX-XXXXX
```

* * *

## Best Practices

- **Start with web fingerprinting:** Always begin reconnaissance by fingerprinting the target to understand what you're dealing with.
- **Use appropriate scan types:** SYN scans are faster and stealthier; TCP scans are more reliable but slower.
- **Combine tools:** Chain multiple tools together for comprehensive results.
- **Only scan authorized targets:** Always ensure you have permission before scanning any system.

* * *

## Quick Reference

| Tool | Purpose | Example |
| --- | --- | --- |
| nmap\_scan | Network/port scanning | `Perform a service discovery scan on target.example` |
| web\_fingerprint | Web app identification | `Check target.example` |
| sslscan | SSL/TLS analysis | `Perform SSL Scan on target.example` |
| subfinder | Subdomain discovery | `Find subdomains for target.example` |
| whois | Domain registration info | `Find domain registration details for target.example` |
| get\_ip\_geolocation | IP location mapping | `Find geo location of target.example` |
| get\_domain\_ip | Domain to IP resolution | `What is the IP of target.example?` |