add thm labs

Tools/autorecon.md

@@ -5,4 +5,6 @@ autorecon <target>
 
 ```
 proxychains -q autorecon 10.1.1.65 --proxychains
-```
+```
+
+Related notes: [[Tools/nmap]] for follow-up port scans and [[Windows/Information Gathering]] for host recon once access is gained.

Tools/nc.md

@@ -0,0 +1,8 @@
+## Connect to filtred port
+```
+nebi@htb[/htb]$ ncat -nv --source-port 53 10.129.2.28 50000
+
+Ncat: Version 7.80 ( https://nmap.org/ncat )
+Ncat: Connected to 10.129.2.28:50000.
+220 ProFTPd
+```

Tools/nmap.md

@@ -55,4 +55,6 @@ sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace
 
 ```bash
 sudo nmap 10.129.2.28 -p50000 -sS -Pn -n --disable-arp-ping --packet-trace --source-port 53
-```
+```
+
+See also: [[Tools/autorecon]] for automated port discovery, [[Linux/portscanning]] for quick Bash loops, and [[Windows/Active Directory for OSCP/Initial Access/Scan Network]] when nmap has to run through proxychains in AD-heavy networks.