Reconnaissance

OSINT is where red team engagements actually begin. Not when you fire up Metasploit. Not when you scan the first subnet. Before any of that — you do recon. You learn everything you can without touching the target. Done right, OSINT tells you where the doors are before you ever try to open one. This guide covers the full methodology: what to collect, which tools to use, how to stay invisible while doing it, and how to turn raw intelligence into an attack plan. ...

You don’t memorize Nmap. Nobody does. You keep a cheat sheet, you use it constantly, and eventually the important stuff sticks. This is that cheat sheet — updated for 2026, organized by what you actually do on engagements, not alphabetically by flag name. Covers everything from basic discovery to NSE scripting to firewall evasion. If it’s not here, you probably don’t need it in the field. Target Specification These go at the end of any Nmap command. Mix and match as needed. ...