Active
Scanning or active enumeration is the phase where the attacker begins to touch the systems and possibly leaving some traces behind.
The active recon chain is somehow pretty obvious:
1) You find the target (might have done this in the passive recon phase).
2) Trace the route to target IP or network and try to map the network as best as you can.
3) Search for open ports and services, if its a web app try using it and viewing the source code or use browser extensions that can give you some info about the technologies and apps behind it.
4) Finally move on to the next phase (threat modeling or vulnerability assessment).
