PenTest+ exam prep: reconnaissance and enumeration
You get to know a fictional company first from open sources, then by active scanning and service enumeration, automate the recon with scripts and report it.
Level 301 · 16 lessons · 12 practice labs
Lessons
Passive reconnaissance
- Open-source intelligence: tracing a fictional company
- DNS recon: subdomains and zone transfers
- Gathering information from certificate logs and document metadata
- People and role recon: preparing for social engineering
- Short task: map the target company’s external attack surface
Active scanning
- Finding live hosts
- Port scanning: types, timing, staying quiet
- Service and version detection, NSE scripts
- Seeing past the firewall: fragmentation and source ports
- Short task: produce a full inventory of the target network
Enumeration
- SMB and NetBIOS enumeration
- Gathering information with SNMP
- Web enumeration: directories, technologies, parameters
- Enumerating usernames
- Automating recon with scripts
- Capstone: write the recon report for a network you have never seen
Practice labs
- Work out a fictional company's email format: From employee profiles in the offline dataset you work out Kozalak Mobilya's email address format and write the likely address list.
- Gather users and software from document metadata: You extract author names, software versions and internal paths from ten documents in the dataset and write an exposure note for the company.
- Find forgotten subdomains from certificate records: You compare offline certificate records with DNS records and report subdomains missing from inventory with a recommendation to retire them.
- Map servers from the target domain's records: You query the authorised lab domain's A, MX, NS and TXT records and tabulate which server does what.
- Check a name server for open zone transfers: You test which lab name server permits zone transfers, count the leaked records and recommend the restricting setting.
- Find hidden subdomains with a wordlist: You run a wordlist subdomain search on the lab domain, filter out wildcard-record noise and report the real results.
- Count live hosts on the lab subnet: You find live hosts on the in-scope subnet and write them to an inventory file with IP and MAC.
- Build a service and version table: You detect open ports, service names and versions on four lab servers and lay them out as a client-ready table.
- Tell filtered ports from closed ones: On a lab server behind a firewall you compare the results of two scan types and prove which ports are filtered.
- List open file shares: You list shares on the lab file server and those open to anonymous access and mark the ones that should be closed.
- Document what a default community string leaks: You document the system and interface details readable from a lab device answering a default community string and recommend moving to SNMPv3.
- Map a web app's directories and technologies: With directory discovery and header inspection on the lab web server you map admin paths, framework and version details into the recon report.
About this course
You get to know a fictional company first from open sources, then by active scanning and service enumeration, automate the recon with scripts and report it.
What you will learn
- Passive reconnaissance
- Active scanning
- Enumeration
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.