TryHackMe: Active Reconnaissance

Sudoroot

5 min read

·

Jul 19, 2026

--

Listen

Share

Press enter or click to view image in full size

Room: https://tryhackme.com/room/activerecon

Executive Summary

This room introduces the fundamentals of active reconnaissance, where an attacker or security tester directly interacts with a target system to gather information. Unlike passive reconnaissance, active techniques generate traffic that can be detected by the target environment.

Throughout the room, we explored several common reconnaissance tools and protocols, including browser developer tools, ICMP ping, traceroute, Telnet, and Netcat. These tools help identify live hosts, network paths, running services, and application details that can later assist with enumeration and exploitation.

Task 2: Web Browser

Modern web browsers provide powerful developer tools that allow analysts to inspect web applications, view source code, analyze network traffic, and identify hidden information.

In this challenge, the goal was to inspect the website’s resources and JavaScript files using the browser’s Developer Tools.

Question

Browse to the website and determine the total number of questions.

Answer: 8

How the Answer Was Found

1. Open the target website.
2. Press F12 to launch Developer Tools.
3. Navigate to the Sources tab.
4. Inspect the JavaScript file (script.js).
5. Review the application logic and data structures used to render the quiz.

Press enter or click to view image in full size

The script revealed that the application contained a total of 8 questions, which is why the correct answer is:

8

Task 3: Ping

ping is one of the most widely used network troubleshooting tools. It sends ICMP Echo Requests to a target and waits for ICMP Echo Replies.

This allows analysts to determine:

• Whether a host is online
• Network latency
• Packet loss

Question 1

Which option would you use to set the size of the data carried by the ICMP echo request?

Answer: -s

Explanation

On Linux systems, the -s option specifies the payload size of the ICMP packet.

Example:

ping -s 100 10.10.10.10

This sends ICMP packets containing 100 bytes of data.

Question 2

What is the size of the ICMP header in bytes?

Answer: 8

Explanation

The standard ICMP Echo Request header contains:

• Type (1 byte)
• Code (1 byte)
• Checksum (2 bytes)
• Identifier (2 bytes)
• Sequence Number (2 bytes)

Total:

8 bytes

Question 3

Does Microsoft Windows Firewall block ping by default?

Answer: Y

Explanation

Modern Windows systems block inbound ICMP Echo Requests by default through Windows Defender Firewall. As a result, ping requests are typically ignored unless the firewall rule is modified.

Question 4

Issue the command below and determine how many replies are received.

ping -c 10 10.49.141.181

Answer: 10

Explanation

The -c 10 option instructs ping to send exactly 10 ICMP requests.

Because all requests received responses, the total number of replies was:

10

This confirms the target host was reachable throughout the test.

Task 4: Traceroute

Traceroute identifies the path packets take across a network by incrementally increasing the Time-To-Live (TTL) value and recording each router that responds.

This helps analysts:

• Map network paths
• Identify routing issues
• Discover intermediate infrastructure

Question 1

In Traceroute A, what is the IP address of the last router before reaching tryhackme.com?

Press enter or click to view image in full size

Answer: 172.67.69.208

Explanation

The final hop shown before the destination was:

172.67.69.208

This was therefore the last router observed before reaching the target.

Question 2

In Traceroute B, what is the IP address of the last router before reaching tryhackme.com?

Press enter or click to view image in full size

Answer: 104.26.11.229

Explanation

Reviewing the traceroute output showed that the final hop prior to the destination was:

104.26.11.229

Question 3

In Traceroute B, how many routers are between the two systems?

Press enter or click to view image in full size

Answer: 25

Explanation

Counting the hops in the traceroute output revealed that traffic traversed:

25 routers

before reaching the destination.

Task 5: Telnet

Telnet can be used to manually connect to TCP services and inspect their responses.

Although rarely used today for remote administration, it remains useful for service enumeration.

Objective

Connect to port 80 on the target:

telnet 10.49.166.150 80

After connecting, manually send an HTTP request by typing :

GET / HTTP/1.1
Host: 10.49.166.150

Captured Response

HTTP/1.1 408 Request Timeout
Date: Sun, 19 Jul 2026 05:50:58 GMT
Server: Apache/2.4.61 (Debian)

Question 1

What is the name of the running server?

Answer: apache

Explanation

The HTTP response header revealed:

Server: Apache/2.4.61 (Debian)

The server software is:

Apache

Question 2

What is the version of the running server?

Answer: 2.4.61

Explanation

The version number was disclosed in the same header:

Apache/2.4.61

Therefore:

2.4.61

is the correct answer.

Task 6: Netcat

Netcat (nc) is a versatile networking utility often referred to as the "Swiss Army Knife" of networking.

It can:

• Connect to TCP services
• Listen on ports
• Transfer files
• Perform banner grabbing

Objective

Connect to the FTP service:

nc 10.49.141.181 21

Server Banner

220 ip-10-49-141-181.ap-south-1.compute.internal FTP server (Version 6.4/OpenBSD/Linux-ftpd-0.17) ready.

Question

What is the version of the running server?

Answer: 0.17

Explanation

The FTP banner exposed the service version:

Linux-ftpd-0.17

The version number is:

0.17

Banner grabbing is a simple yet effective reconnaissance technique because many services reveal software names and versions immediately after a connection is established.

Conclusion

In this room, we explored several foundational active reconnaissance techniques used during the early stages of penetration testing and security assessments. Using browser developer tools, we extracted information from client-side code. ICMP ping demonstrated how to verify host availability and measure connectivity, while traceroute revealed the network path taken to reach a target.

We also used Telnet and Netcat to perform service enumeration and banner grabbing, allowing us to identify server software and version information directly from live services. Together, these techniques highlight how seemingly small pieces of information can help build a detailed understanding of a target environment and prepare the way for deeper enumeration and vulnerability analysis in later phases of an engagement.