Kali Network Reconnaissance Scripts — Ping Sweeps, Port Scans & Web Recon

Reconnaissance scripts — ping sweeps, port scans, banner grabbing, DNS enumeration, HTTP header analysis, subdomain testing and SSL certificate checks. Use them only against networks you own or have explicit written permission to test.

Kali · Network Recon — script list

Code samples

nmap_fast_scan.sh — automate a fast Nmap scan

#!/bin/bash

# nmap_fast_scan.sh
# Concept: Automating a fast Nmap scan via Bash

TARGET=$1

if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target_ip>"
    exit 0
fi

echo "[*] Initializing fast scan on $TARGET..."
echo "[*] Command: nmap -F $TARGET"

# -F scans top 100 ports
nmap -F "$TARGET"

echo "[+] Fast scan finalized."

ping_sweep_threaded.py — threaded ping sweep

#!/usr/bin/env python3
import subprocess
import threading
from queue import Queue

# ping_sweep_threaded.py
# Concept: Using Multi-threading to speed up network reconnaissance

# Thread-safe queue to hold IP addresses
queue = Queue()

def pinger():
    while True:
        # Get an IP from the queue
        ip = queue.get()
        if ip is None:
            break
        
        # Run ping command (1 packet, 1 second timeout)
        # On Windows it's 'ping -n 1', on Linux it's 'ping -c 1'
        # We assume a Linux environment (Kali)
        try:
            res = subprocess.run(['ping', '-c', '1', '-W', '1', ip], 
                                 stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
            if res.returncode == 0:
                print(f"[+] {ip} is UP")
        except Exception:
            pass
            
        queue.task_done()

def start_sweep(subnet):
    print(f"[*] Starting threaded ping sweep on {subnet}.0/24...")
    
    # Spawn 50 worker threads
    for _ in range(50):
        t = threading.Thread(target=pinger)
        t.daemon = True
        t.start()

    # Add IPs 1-254 to the queue
    for i in range(1, 255):
        queue.put(f"{subnet}.{i}")

    queue.join()
    print("[*] Sweep complete.")

if __name__ == "__main__":
    import sys
    if "-h" in sys.argv or "--help" in sys.argv:
        print("Usage: python3 ping_sweep_threaded.py")
        print("Threaded ping sweep of a /24 subnet (interactive prompt).")
        sys.exit(0)
    base_ip = input("Enter first three octets (e.g., 192.168.1): ") or "192.168.1"
    start_sweep(base_ip)
    # Stop the threads
    for _ in range(50):
        queue.put(None)

Related pages

• Local & network enumeration
• Vulnerability scanning
• Nmap guide for Termux

View the full toolkit on GitHub