---
title: ToolRouter — Workflow
description: A multi-tool workflow showing how to combine ToolRouter tools for a complex task.
url: https://toolrouter.com/workflows/network-reconnaissance
---
# Network Reconnaissance

Map the complete network attack surface through DNS enumeration, geolocation, service probing, and attack vector analysis.

Effective security testing begins with thorough reconnaissance. Understanding the full scope of a target network, from DNS records through hosting infrastructure to running services, determines the quality and coverage of subsequent security testing. Incomplete reconnaissance leads to blind spots that attackers will find.

This workflow performs systematic network reconnaissance starting with DNS enumeration, mapping the network topology through geolocation and ASN analysis, enumerating services across all discovered hosts, and identifying the most promising attack vectors. The result is a complete attack surface map that guides focused, efficient security testing.

**Tools:** security-httpx, dns-domain, ip-geolocation, pentest
**Category:** security

## Steps

### 1. DNS Reconnaissance

Perform comprehensive DNS enumeration to discover all associated hosts, mail servers, and service records.

- **Tool:** dns-domain
- **Skill:** lookup_dns
- **Input:** Target domain for DNS reconnaissance.
- **Output:** All DNS records revealing the target network topology and service architecture.

### 2. Map Network Topology

Geolocate and identify all hosting providers, ASNs, and network ranges associated with discovered IPs.

- **Tool:** ip-geolocation
- **Skill:** bulk_lookup
- **Input:** IP addresses discovered through DNS enumeration.
- **Output:** Network topology map with ISPs, ASNs, geographic distribution, and hosting providers.

### 3. Service Enumeration

Probe all discovered hosts to enumerate running services, web technologies, and open ports.

- **Tool:** security-httpx
- **Skill:** probe_hosts
- **Input:** List of IPs and hostnames to probe.
- **Output:** Running services, technology stacks, HTTP responses, and server banners per host.

### 4. Identify Attack Vectors

Analyze the discovered infrastructure to identify potential attack vectors and entry points for further testing.

- **Tool:** pentest
- **Skill:** recon
- **Input:** Consolidated reconnaissance data from previous steps.
- **Output:** Prioritized list of potential attack vectors, weak points, and recommended testing areas.

## Benefits

- Map the complete network attack surface before testing begins
- Identify all hosting providers and network ranges in scope
- Discover services and technologies that inform testing strategies
- Prioritize attack vectors based on discovered infrastructure
