Skip to main content
Internal Recon is the deeper assessment. It runs on your console and reaches the client network through the beacon’s pivot, so no tool is ever installed on the client’s machines. Turn the pivot on for the beacon on its Deploy card, then open Internal Pentest, Internal Recon.

Targets and ports

Enter an internal host, a CIDR such as 192.168.0.0/24, or an address range, then pick the ports: Before you launch, a preview shows the deduplicated address and port counts and the discovery probes it will send. A run above 100,000 address and port combinations has to be split into smaller ranges or port sets, so a mistaken All TCP on a /24 can never flood the tunnel. Common service ports are tested first so results start arriving early.

Profiles

  • Discover maps the open ports, then adds nmap service versions on only the ports found open.
  • Web adds live web probing with httpx on the ports actually discovered, nonstandard web ports included.
  • Full adds Katana crawling, testssl protocol and certificate checks, gowitness screenshots and nuclei.
The tools run on the console, through the pivot, and use the same install and update page as the rest of Pro. Screenshots appear in Project Data with an Internal filter.

Watching a run

The run uses the same view as external recon: the stage pipeline, the Equalizer, live charts, a typing ticker and the colored tool logs. Follow output keeps the log scrolled to the newest line; scrolling up pauses it and Jump to latest resumes. While a run is active its targets and settings are locked against edits or a second start. Stop cancels pending work and keeps everything already confirmed. A run whose pivot connections partly failed finishes as Partial, keeps its confirmed results, and records what was attempted against what was expected in its CSV and JSON exports.
Run a Deep discovery sweep first. Internal Recon will not start without one, and the richer the baseline, the better recon and attacks can target.