Reconnaissance and scanning

15 courses, 238 lessons. A real Kali Linux lab in the browser.

Nmap fundamentals (Level 101, 16 lessons): Who is on the network and which ports are open?
Introduction to open-source information: your organisation’s online footprint (Level 101, 13 lessons): You learn what an organisation leaves public on the internet, the difference between passive and active discovery, build a first profile from search engines and domain data, and suggest how to shrink the footprint.
Introduction to auditing network services (Level 101, 15 lessons): You learn ports and services as the doors of a building, see the services listening on your machine and the lab network, audit common services, switch off the needless ones and verify from outside that they are closed.
Nmap: host discovery and port scanning (Level 201, 17 lessons): Scan types, timing and stealth, reading the results.
OSINT and passive recon: whois, dig, theHarvester (Level 201, 17 lessons): Gathering information from open sources without touching the target.
Auditing file-sharing services: SMB, NFS, FTP (Level 201, 17 lessons): You audit SMB, NFS, FTP, rsync and WebDAV shares: you find guest access, share and file permissions, old protocol versions and forgotten sensitive files, harden them and follow access in the logs.
Nmap: fingerprinting and the scripting engine (Level 301, 17 lessons): Version and OS detection, NSE scripts.
External attack surface management: from inventory to prioritisation (Level 301, 18 lessons): You continuously inventory your organisation’s internet-facing domains, servers and services, find needless exposure and get it closed in priority order.
Auditing infrastructure services: LDAP, SMTP, SNMP and databases (Level 301, 19 lessons): You audit directory, mail, network management, database and cache services: you find anonymous access, open relays, default community strings and password-less data stores, close them and report by business impact.
Writing organisation-specific audit scripts with the Nmap scripting engine (Level 401, 15 lessons): With enough Lua and NSE libraries you write safe scripts that check your organisation’s configuration rules, test them, produce structured output and share them with your team under version control.
Auditing the external exposure of cloud assets (Level 401, 16 lessons): Starting from the shared-responsibility model you inventory the organisation’s cloud assets, then find and close public storage, overly wide security groups, shared disk images and leaked access keys.
Auditing remote access paths: SSH, remote desktop and VPN (Level 401, 16 lessons): You audit SSH, RDP, VNC, remote support tools and VPN gateways: you measure configuration and algorithm choices, the key inventory, MFA coverage and patch status, and bring access into one monitored model.
Continuous asset inventory on large networks: distributed scanning and change tracking (Level 501, 15 lessons): You keep the inventory of a network with thousands of addresses up to date: you set up a distributed scanning architecture and schedule, reconcile results with the asset database, track changes and run a workflow for ownerless assets.
Building a continuous exposure management programme (Level 501, 13 lessons): You design an exposure management programme from discovery to closure: you prioritise with business context, receive outside reports, verify exposure, assign work to owners and report measured results to management.
Safely auditing IoT and industrial device services (Level 501, 14 lessons): You write safe testing rules for fragile devices, build a passive inventory from traffic, audit default passwords, MQTT permissions and segmentation on simulated IoT and industrial services, and propose compensating controls for unpatchable devices.

Projects

Take the first inventory of a school network: You find the live devices, ports and services on Gelincik Okulları’s office network in the lab with Nmap. You put the results into an inventory table with device, port, service and “is it needed?” columns.
A summary of an organisation’s online footprint: You go through Mercanköşk Otelcilik’s prepared open sources in the lab (domain records, web pages, job adverts) and classify the information visible from outside. You write a footprint summary with advice on reducing what need not be public.
Find the live service: discover and verify: You locate a running service on the lab network, confirm it really is that service, and document what you found in a short inventory note.
Check guest and staff network access: In your own lab you check whether a device on the guest network can reach systems on the staff network, and report whether the separation holds.
Review network changes after a server update: After a server update you compare open ports and services with the earlier state, and report any unexpected changes.
Audit the file shares of a branch office: You list the SMB, NFS and FTP shares on Kuzeyyıldızı Kargo’s branch servers in the lab and identify those open to everyone or with wider rights than needed. You narrow the permissions, check again and write the share audit report.
External attack surface assessment: You list the organisation's systems visible from the internet, identify the ones that are open without need, and present a prioritised plan to close them.
Audit infrastructure services: LDAP, SMTP, SNMP, database: You audit how much the directory, mail, network management and database services on Selvikent Belediyesi’s lab network reveal to others. You report the findings in order of importance, harden the three most important settings and check again.
Write an Nmap script that audits an organisation policy: You write an Nmap scripting engine script that audits Ilgıntepe Tekstil’s rule “management interfaces open only from the management network and show no version details”. You run it on the lab network and list the non-compliant systems in a compliance report.
Audit the remote access paths: SSH, remote desktop, VPN: You locate each remote access point in Lodoskaya Denizcilik’s lab and audit protocol versions, authentication methods and who can reach them. You report the findings, harden the SSH server and attach the retest record.
Set up continuous asset inventory and change tracking: You set up scheduled scans for Yakamoz Telekom’s three-segment lab network that merge results into one inventory and work out the difference from the previous scan. You show it catches a newly opened service and hand in the change report.
A safe audit plan and inventory for industrial devices: You write an audit plan for Demirsu Enerji’s simulated field devices in the lab that picks only methods which will not disturb a device, and follow it step by step. You collect the devices, their protocols and exposed management services in an inventory and findings report.