Bug › Module 4 › Lesson 4
Lab — Recon
Pack recon plan — passive first, subdomain filter, URL sources — literacy file only, dest $SCOPE_HOST.
Visual · bounty_recon_lab
Lab: write recon pack. $SCOPE_HOST only. Original Cyberlium.
Opening
Recon pack before probes — methodology on paper first.
Lessons 4-1 through 4-3 covered passive first, subdomain filtering, and URL discovery. This lab ships the combined recon plan: passive sources, subdomain workflow, URL table — all pointing at $SCOPE_HOST. Optional: one passive result line for $SCOPE_HOST if scope pack exists — no aggressive crawl required. No dorm sweeps. Next: Quiz — Recon for Bounty.
1. Lab contract: write the recon pack
Create $HOME/cyberlium-lab/t20-m04-l04-recon-lab.txt with passive-first plan, subdomain filter workflow, URL discovery table, and NEVER stranger lines.
Optional: one passive intel line for $SCOPE_HOST — placeholders OK if offline.
Command guide
Try these commands — Lab contract: write the recon pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Recon lab — curl headers + subfinder on scope domain Never scan strangers — $SCOPE_HOST from env
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
macOS:
Command — copy this
brew install subfinder
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" curl -sS -I --max-time 10 "https://$SCOPE_HOST" 2>/dev/null | head -15 || curl -sS -I --max-time 10 "http://$SCOPE_HOST" | head -15 subfinder -d "$(cat "$HOME/cyberlium-lab/t20-root-domain.txt" 2>/dev/null || echo httpbin.org)" -silent 2>/dev/null | head -10 || true
Primary tools to practice this lesson: curl, subfinder. Reference sites: Recon lab; Never scan strangers. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Verify scope before any probe
Cross-check scope pack names $SCOPE_HOST. Redact random URL examples. Confirm rate limits in pack before optional active step.
Tutorials showing public range recon get rewritten to YOUR $SCOPE_HOST mentally.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Asset Mapping.
Recon plans open bounty reports; you are drafting that section early.
4. What you ship: recon pack for $SCOPE_HOST
Passive + subdomain filter + URL table. $SCOPE_HOST only. NEVER stranger recon. chmod 600.
5. What you record before the next lesson
Date. Recon pack path. Optional $SCOPE_HOST passive note. File t20-m04-l04-recon-lab.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add Shodan stranger IPs to recon pack. Skip file and crawl random sites.
Right
Write YOUR recon pack for $SCOPE_HOST. chmod 600. Next: Quiz — Recon for Bounty.
Mission: freeze YOUR recon pack on disk
1) Combine passive, subdomain, URL sections. 2) Name $SCOPE_HOST as sole target root. 3) chmod 600. Never list stranger URLs.
Stuck? Ask Cyberlium AI Mentor
Recon packs save you from 'just one quick scan' on the wrong host.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Optional passive intel may reference only $SCOPE_HOST per scope.
True or False
Knowledge Check
APPLY: Subdomain workflow in recon pack should:
Multiple choice