Recon, scan and identify the attack chain — Offensive Security & Penetration Testing

What You'll Build

In this first capstone phase you will reconnoitre the authorized external and web-application targets, scan them thoroughly, and synthesize the results into a proposed attack chain, a hypothesis of how an attacker could move from initial access to real impact. The deliverable is a documented target map plus a reasoned chain: which foothold looks viable, how it might lead to escalation, and how findings across the network and application could connect. This sets the plan the later phases will test.

Analogy🏏Cricket

🎬 Think of it like movies: Producing a film means running every department, scouting, shooting, editing, sound, then delivering one coherent final cut a distributor can actually screen, not a pile of loose reels. Just as the producer is judged by that single assembled cut, this exercise judges you by one consolidated, prioritized inventory drawn from passive discovery, active scanning, enumeration, and vulnerability triage. Just as no scene is shot without the studio's sign-off, none of this runs outside your authorized lab range. This reveals the recon sweep as delivering the final cut, not a heap of unassembled footage.

Prerequisites

Signed authorization and clear scope for the capstone external and web-application targets, from Lesson 1, confirmed before any active step.
The full recon workflow from Module 1, passive discovery, active scanning, subdomain enumeration, and vulnerability triage.
Web-application testing fundamentals from Module 3, especially the OWASP categories and disciplined manual testing.
The chaining mindset from Lesson 31, thinking about how findings across the network and application could connect.
The habit of continuous, timestamped documentation, so every discovery is captured for the eventual report.

Setup & Project Structure

Work only within the authorized capstone lab, and set up a workspace with sections for external recon, web-application mapping, and your synthesized attack chain. Because this phase produces the plan the whole engagement follows, organize it carefully and document every finding with its source. A well-structured target map now makes the exploitation and reporting phases far smoother, and ensures the connected story you eventually tell is grounded in evidence gathered systematically from the very first command.

Analogy🏏Cricket

💪 Think of it like fitness: Serious athletes train in a controlled gym they are cleared to use and keep a meticulous logbook, dating every set and weight so progress is reproducible and any coach can pick up exactly where they left off. Just as that controlled environment and dated logbook make training safe and auditable, working inside an authorized lab and saving each phase's output in dated, named files makes the recon sweep safe and reproducible. Just as an undocumented workout teaches nothing repeatable, an undocumented sweep produces findings no teammate can trust. This reveals disciplined setup as the training log that makes every result traceable.

bash

# Authorized capstone lab only. Set up a documented workspace.
mkdir capstone && cd capstone
mkdir external webapp chain evidence

# Record scope and targets up front as the reference of record.
cat > scope.txt <<'EOF'
AUTHORIZED CAPSTONE SCOPE
  external:  authorized external network range (isolated lab)
  web_app:   authorized web application (staging mirror)
  rule:      these targets only; nothing outside the authorized lab
EOF
cat scope.txt

Step 1 — External Recon and Scanning

Begin with the external network, reusing Module 1's workflow: passive discovery first, then active host discovery and service or version fingerprinting within the authorized window. Map every live host, open port, and service version, noting anything, an outdated service, an exposed management interface, that could be a foothold. Save all output as evidence. This external picture is one half of your target map and the source of many potential first links in the attack chain.

Analogy🏏Cricket

💼 Think of it like business: Entering a new market, a company first researches quietly, then surveys the field directly, cataloguing every competitor, channel, and opening before committing resources. Just as that systematic market map reveals where an entrant could break in, your external scan maps every live host, port, and service to reveal where a foothold might be. Just as a good analyst records each source so the strategy is defensible, you save every scan output as evidence. This reveals why external recon is disciplined intelligence-gathering, building one half of the target map.

bash

# External recon + scan (authorized window only).
# Passive first, then active (Module 1 workflow).
nmap -sn <external_range> -oA external/discovery        # live hosts
nmap -sV -oA external/services -iL external/live.txt    # service versions

# Flag potential footholds:
grep -E 'open' external/services.nmap
#   -> outdated services, exposed mgmt interfaces = candidate first links