> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d0pam1ne.blackhatethicalhacking.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Internal Recon

> Step 2: the console scans the internal network through the beacon's pivot.

**Internal Recon** is the deeper assessment. It runs on your console and reaches the client network through the beacon's **pivot**, so no tool is ever installed on the client's machines. Turn the pivot on for the beacon on its Deploy card, then open **Internal Pentest, Internal Recon**.

## Targets and ports

Enter an internal host, a CIDR such as `192.168.0.0/24`, or an address range, then pick the ports:

| Ports | Coverage |
| - | - |
| **Quick** | 28 common service ports. |
| **Standard** (default) | 117 ports: the beacon's deep list plus Quick. |
| **Custom** | Your own TCP list or ranges. An invalid list is rejected, never silently replaced. |
| **All TCP** | All 65,535 ports on every address. |

Before you launch, a preview shows the deduplicated address and port counts and the discovery probes it will send. A run above 100,000 address and port combinations has to be split into smaller ranges or port sets, so a mistaken All TCP on a /24 can never flood the tunnel. Common service ports are tested first so results start arriving early.

## Profiles

* **Discover** maps the open ports, then adds nmap service versions on only the ports found open.
* **Web** adds live web probing with httpx on the ports actually discovered, nonstandard web ports included.
* **Full** adds Katana crawling, testssl protocol and certificate checks, gowitness screenshots and nuclei.

The tools run on the console, through the pivot, and use the same install and update page as the rest of Pro. Screenshots appear in Project Data with an Internal filter.

## Watching a run

The run uses the same view as external recon: the stage pipeline, the Equalizer, live charts, a typing ticker and the colored tool logs. **Follow output** keeps the log scrolled to the newest line; scrolling up pauses it and **Jump to latest** resumes. While a run is active its targets and settings are locked against edits or a second start.

**Stop** cancels pending work and keeps everything already confirmed. A run whose pivot connections partly failed finishes as **Partial**, keeps its confirmed results, and records what was attempted against what was expected in its CSV and JSON exports.

> [!TIP]
>
> Run a [Deep discovery sweep](https://docs.d0pam1ne.blackhatethicalhacking.com/beacon/discover-assets.md) first. Internal Recon will not start without one, and the richer the baseline, the better recon and attacks can target.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.