Practice — full recon sweep of a lab target range — Offensive Security & Penetration Testing

What You'll Build

In this exercise you will run a complete, structured reconnaissance sweep against an authorized lab target range and consolidate everything into a single prioritized asset inventory. You will move through passive discovery, active scanning, subdomain enumeration, and vulnerability triage, producing the exact deliverable a real engagement's recon phase yields: a documented, source-cited map of live hosts, their services, and their most notable weaknesses, ready to hand off to an analysis or exploitation phase.

Analogy🏏Cricket

🎬 Think of it like movies: Producing a film means running every department, scouting, shooting, editing, sound, then delivering one coherent final cut a distributor can actually screen, not a pile of loose reels. Just as the producer is judged by that single assembled cut, this exercise judges you by one consolidated, prioritized inventory drawn from passive discovery, active scanning, enumeration, and vulnerability triage. Just as no scene is shot without the studio's sign-off, none of this runs outside your authorized lab range. This reveals the recon sweep as delivering the final cut, not a heap of unassembled footage.

Prerequisites

A signed authorization and defined scope for the lab range, from Lesson 1, since even lab work should rehearse the discipline of confirming permission first.
Comfort with passive sources, WHOIS, DNS, and certificate transparency, from Lesson 2, which you will use for the stealthy first pass.
Working Nmap skills for host discovery and service or version detection, from Lesson 3, including timing and rate controls.
Familiarity with passive and active subdomain enumeration and attack surface mapping, from Lesson 4, plus wildcard awareness.
Understanding of vulnerability scanning and triage, from Lesson 5, so you can validate rather than blindly trust automated findings.

Setup & Project Structure

Work inside an isolated lab you are authorized to test, never against systems you do not own or have written permission for. Create a clean working directory to hold each phase's output, since a recon sweep is only as valuable as its documentation. Keeping every result in dated, named files means your final inventory is reproducible and every finding is traceable to the tool and moment that produced it, exactly as a real engagement demands.

Analogy🏏Cricket

💪 Think of it like fitness: Serious athletes train in a controlled gym they are cleared to use and keep a meticulous logbook, dating every set and weight so progress is reproducible and any coach can pick up exactly where they left off. Just as that controlled environment and dated logbook make training safe and auditable, working inside an authorized lab and saving each phase's output in dated, named files makes the recon sweep safe and reproducible. Just as an undocumented workout teaches nothing repeatable, an undocumented sweep produces findings no teammate can trust. This reveals disciplined setup as the training log that makes every result traceable.

bash

# Create and enter a working directory for the sweep.
mkdir recon-lab && cd recon-lab

# One subfolder per phase keeps output organized and traceable.
mkdir passive active subdomains vulns

# Record the authorized scope at the top level as your reference.
cat > scope.txt <<'EOF'
AUTHORIZED LAB SCOPE
  domain:    lab.example.internal
  ip_range:  10.10.10.0/24
  window:    open (isolated lab)
  notes:     lab only; do not test anything outside this range
EOF
cat scope.txt

Step 1 — Passive Discovery

Begin invisibly. Gather everything public before sending a single packet to the target, mirroring how a real engagement stays stealthy for as long as possible. In a lab this simulates querying registries and certificate logs; the habit matters more than the volume of data. Record each source so every later host in your inventory can be traced back to where it first appeared, reinforcing the professional practice of source-citing every finding you eventually report.

Analogy🏏Cricket

♟️ Think of it like chess: Preparation happens quietly at home, studying an opponent's published games long before you sit across the board, and you note exactly which game each idea came from so you can trust it under pressure. Just as that silent home study reveals an opponent's habits without them ever knowing you looked, passive discovery gathers public intelligence before a single packet reaches the target. Just as citing the source game lets you rely on your preparation mid-match, recording each host's source lets the client rely on your inventory. This reveals passive discovery as the home preparation that wins before the clock even starts.

bash

# Passive first: gather public intelligence without touching the target.

# Domain registration facts and name servers
whois lab.example.internal            > passive/whois.txt
dig lab.example.internal NS MX TXT    > passive/dns_records.txt

# Certificate-transparency style subdomain hints (public logs)
subfinder -d lab.example.internal -silent > passive/subs_passive.txt

# Everything here reads public data; the target sees nothing.
wc -l passive/subs_passive.txt

Step 2 — Active Scanning

Now enter the active phase, where packets reach the authorized range. Discover which hosts are live, then fingerprint the services and versions each one runs, tuning your scan rate to stay controlled even though this is a lab. This step converts the range into a concrete service map, the backbone of your inventory, listing every open port and the exact software behind it so you know precisely what each host exposes and what to research.

Analogy🏏Cricket

🍳 Think of it like cooking: This is the moment you finally taste and probe the dish itself, touching each pot to see what is actually simmering and identifying every ingredient by flavor, work that unavoidably disturbs the food you are testing. Just as tasting reveals what no recipe on paper could promise, active scanning reveals the live services and exact versions no public source listed, sending real packets the hosts can feel. Just as you adjust the heat gently so a delicate sauce does not break, you tune the scan rate so a fragile host is not disrupted. This reveals active scanning as tasting the dish to learn what is truly in the pot.

bash

# Active: these packets reach the authorized lab range only.

# 1) Which hosts are alive in the range?
nmap -sn 10.10.10.0/24 -oA active/discovery

# 2) Service + version detection on each live host (tuned timing)
nmap -sV -T3 -oA active/services -iL <(grep -oP '10\.10\.10\.\d+' \
    active/discovery.gnmap | sort -u)

# Result: host -> open ports -> service versions, saved for the inventory.
grep -E 'open' active/services.nmap | head

Step 3 — Subdomain Enumeration & Mapping

Expand the surface. Combine your passive subdomain list with active DNS enumeration to find hosts that never appeared publicly, filtering wildcards so phantom entries do not pollute the results. Resolve everything to separate live hosts from dead names, then map each survivor to its address and services. This produces the broadened, deduplicated attack surface that ensures no forgotten asset in the range escapes your inventory and later analysis.

Analogy🏏Cricket

💰 Think of it like finance: A thorough auditor does not stop at the headline accounts; they combine public filings with a deeper probe of subsidiaries and shell entities, discarding phantom shells that exist only on paper before consolidating the real ones. Just as that combined, filtered search uncovers hidden entities a surface glance would miss, merging passive and active DNS enumeration and filtering wildcards uncovers hosts no public log listed while discarding phantom names. Just as consolidating only the genuine subsidiaries gives an honest balance sheet, resolving only the live hosts gives an honest attack surface. This reveals enumeration as auditing every subsidiary, not just the parent company.

bash

# Merge passive + active enumeration, filter noise, resolve to live hosts.

# Active brute-force against DNS (authorized lab)
amass enum -brute -d lab.example.internal -o subdomains/subs_active.txt

# Merge with the passive list and deduplicate
sort -u passive/subs_passive.txt subdomains/subs_active.txt \
    > subdomains/subs_all.txt

# Resolve to keep only live hosts (dnsx handles wildcard filtering)
dnsx -l subdomains/subs_all.txt -resp -silent \
    > subdomains/resolved.txt
wc -l subdomains/resolved.txt   # count of confirmed live subdomains

Step 4 — Vulnerability Triage & Consolidated Inventory

Finally, run a vulnerability scan across the discovered hosts, then do the work that matters: triage. Verify high and critical findings, discard false positives, and re-rank by real exposure. Consolidate the outputs of all four phases into one prioritized inventory, host, services, notable findings, and source, the single deliverable that makes this sweep useful. Confirm the inventory reads clearly enough that a teammate could act on it without repeating your work.

Analogy🏏Cricket

💼 Think of it like business: A due-diligence team runs an automated risk scan over a target company, but its real value is verifying which flagged issues are genuine liabilities, discarding the false alarms, and ranking the rest by true business impact into one decision-ready memo. Just as executives act on that single consolidated memo rather than the raw alert dump, this step consolidates all four phases into one prioritized inventory of hosts, services, findings, and sources. Just as an unverified alarm can send a deal chasing phantom risk, an unverified finding can send a client chasing phantom issues. This reveals triage and consolidation as turning a raw alert list into a memo worth acting on.

bash

# Scan discovered hosts, then TRIAGE (verify, don't just trust).

# Ensure the check database is current, then scan the live hosts
# (use safe-check settings; this is a controlled lab range)
#   -> run OpenVAS/Nessus against active + resolved host lists
#   -> export raw findings to vulns/raw_report.txt

# Consolidate everything into ONE prioritized inventory:
cat > vulns/inventory.md <<'EOF'
# Recon Inventory — lab.example.internal (10.10.10.0/24)
| Host | Services (ver) | Notable finding | Verified? | Source |
|------|----------------|-----------------|-----------|--------|
| 10.10.10.5 | nginx 1.18.0; ssh | weak TLS cipher | yes | nmap+scan |
| 10.10.10.9 | admin app | default creds | yes (manual) | scan+hand |
EOF
cat vulns/inventory.md

Warning: Everything in this exercise must stay inside your authorized lab range. Pointing these same tools at a domain or address you do not own or have written permission to test is unauthorized access and can be a crime, exactly the line Lesson 1 drew. The tooling is identical whether the target is sanctioned or not; only your authorization makes the difference. Confirm every target against your scope file before running any active command.

Extension Challenge: Deepen the sweep with three additions. First, correlate certificate-transparency hostnames against your resolved list to spot assets that appear in logs but no longer resolve, and note them as decommissioned. Second, tag each inventory host with a business-context guess, internet-facing versus internal, and re-rank findings accordingly. Third, write a two-paragraph executive summary of the attack surface, practising the reporting skills Module 5 will formalize.

A recon sweep moves from passive discovery to active scanning to subdomain enumeration to vulnerability triage, layering stealth then completeness in a deliberate order.
Every phase's output is saved in dated, named files so the final inventory is reproducible and each finding traces back to the tool and moment that produced it.
Passive sources are exhausted before any packet reaches the target, and active steps run only within the authorized range with tuned, controlled scan rates.
Enumeration merges passive and active results, filters wildcards, and resolves names so the broadened attack surface contains only genuine live hosts.
Vulnerability findings are triaged, not trusted: high and critical items are manually verified, false positives discarded, and the rest re-ranked by real exposure.
The deliverable is one prioritized inventory of hosts, services, notable findings, and sources, clear enough for a teammate to act on without repeating the work.