> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d0pam1ne.blackhatethicalhacking.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Discover Assets

> Step 1: the beacon maps its own network, without the pivot.

**Discover Assets** is the first mapping, run by the beacon itself over its normal check-in connection, so it does not need the pivot. Open a project, then **Internal Pentest, Discover Assets**, pick the beacon and a profile, and start the sweep.

## Profiles

| Profile | What it does |
| - | - |
| **Passive** | Finds what is alive and names it through ARP, mDNS and NetBIOS, without probing ports. |
| **Recon** (default) | Common ports with full fingerprinting: service banners, TLS certificates, SSH algorithms and SMB identity. |
| **Deep** | The thorough port set and every probe. Recommended for the baseline Internal Recon builds on. |

Every host comes back with its address and name, operating system, device type, NIC vendor and MAC address, and its open services. On the same sweep the beacon reads the Wi-Fi around it for the [Wireless Rogue Detector](https://docs.d0pam1ne.blackhatethicalhacking.com/beacon/wireless.md).

## Identity you can trust

A device's identity is fused from several signals and none is trusted alone. An SMB dialect does not make a host Windows, a NIC vendor shared by phones and IoT does not make it a phone, and a DNS answer only counts when it is a real DNS reply. That keeps phantom assets out of the inventory: a network that intercepts DNS cannot fill it with devices that do not exist.

## What it files

The beacon's own detectors file what the sweep proves as internal findings for review: end-of-life operating systems and services, cleartext and remote-access services, exposed databases, weak TLS and certificates, and rogue Wi-Fi. They land in **Needs Review** with the external findings, tagged internal and filed under the beacon's site.

> [!NOTE]
>
> Internal Recon refuses to start until a discovery sweep has completed for that beacon. Liveness checks and the automatic single-device deep tasks do not count as the initial sweep.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.