lan-recon is a read-only network reconnaissance tool that refuses to run unauthorized and never presents a guess as a fact — evidence-graded LAN discovery & asset inventory, plus the assessment methodology behind it.
Most networks have never been inventoried — nobody has the full list of what's connected, let alone what it exposes. lan-recon produces that list, completely and honestly, without ever logging in, writing, or disrupting a thing. The "honestly" is the point: anyone can paste a scanner's raw output; the value is telling you which lines are proven, which are inferred, and which are unknown — and being right about it.
Security tooling is dual-use — the same probe is a service when the owner asked and a crime when they didn't. The tool's authorization gate makes affirming scope a step you can't skip. It's negative-control-tested in CI: a run without an authorizer fails.
Every observation is graded VERIFIED (a byproduct proved it), INFERRED (indirect signal), or UNKNOWN — and the report says so, out loud, next to the claim. A finding built on a guess is worse than no finding.
Read-only by construction — it climbs a technique ladder (cheapest signal first) and grades each host by the strongest evidence it obtains.
$ ./lan-recon.sh --subnet 192.168.1.0/24 --jump user@onsite-box ╔══════════════════════════════════════════════════════════╗ ║ AUTHORIZATION REQUIRED — read AUTHORIZATION.md ║ ║ Proceed ONLY with the owner's written, scoped consent. ║ ╚══════════════════════════════════════════════════════════╝ To confirm you are authorized, re-type the subnet: 192.168.1.0/24 → [1/4] host sweep + ARP … found 14 live host(s). → [2/4] per-host fingerprint … probed 14 → [3/4] mDNS/Bonjour enumeration … service types captured. → [4/4] assembling report … → inventory.md
…and the inventory it produces — every host evidence-graded:
| IP | Device | Vendor | Open ports | Confidence |
|---|---|---|---|---|
| 192.0.2.1 | Router / gateway | (router vendor) | 53 | VERIFIED |
| 192.0.2.20 | Windows workstation | Dell | 135, 139, 445 | VERIFIED |
| 192.0.2.31 | Network printer | HP | 80, 443, 9100 | VERIFIED |
| 192.0.2.60 | IoT / smart-home | Samsung | — (cloud-tethered) | INFERRED |
| 192.0.2.77 | Unidentifiable device | (withheld OUI) | — (all closed) | UNKNOWN |
Synthetic example (RFC 5737 documentation IPs). The UNKNOWN host is exactly the device an assessor recommends physically identifying — flagged, not guessed.
Bounded host sweep + ARP, then per-host read-only fingerprinting: TCP connect-probes, HTTP/SSH banners, anonymous NetBIOS, MAC-vendor, TTL — and mDNS/Bonjour enumeration (the richest identity signal on Apple/IoT networks).
Never a guess dressed as a fact. An open port is only ever reported as open — never promoted to a confirmed service until a banner proves it.
A companion tool checks what's exposed to the internet — internet-facing RDP, SMB, databases, telnet — the #1 SMB breach vector, each open port risk-classified.
Turn the inventory + findings into a scaffolded client report — the mechanical assembly done, the human-judgment sections flagged, never faked.
The tool is Phase 2 of a four-phase assessment — framework-aligned (NIST SP 800-115 / PTES) but right-sized for a five-person office, not a compliance binder.
Written scope, rules of engagement, verified ownership.
Enumerate every host, identify it, map the topology.
Exposed / misconfigured / unpatched surface, ranked by business impact.
Prioritized plan, then re-test to prove each fix is closed.
Zero-risk preview — see exactly what it would do, no target needed:
$ git clone https://github.com/convenientlymike/lan-recon.git && cd lan-recon $ ./toolkit/lan-recon.sh --subnet 192.168.1.0/24 --dry-run