Five Phases as a Defender Map

Attackers do not owe you a Gantt chart, but their work still tends to move from learning, to probing, to getting in, to staying in, to reducing how obvious they were. Defenders place controls on that path: shrink what the internet already says (later footprinting hygiene), notice scans, make access expensive (auth, patching, least privilege from Topic 1), notice persistence, and keep logs that are hard to silently erase. If you only memorize tool names, you miss the placement problem. If you only memorize stage names as a criminal recipe, you picked the wrong course.

Authorized testers use the same map as a story they are allowed to tell inside a contract: “we will attempt to learn, probe, and (if in scope) demonstrate access on these hosts, then we will write it down.” The contract may stop the story early — recon-only, scan-only, no persistence, no touching backups. That is not a failed test. That is a scoped test. Cyberlium’s default scope for you is even tighter: until later modules say otherwise, you describe the map in notes and you practice only on assets named in your ethics file. You do not “complete” a phase by aiming it at a stranger.

Other public models exist (kill chains, campaign loops, “assume breach”). They rhyme; they are not homework to reproduce from a copyrighted poster. Five names are enough for Module 1: they give you vocabulary to talk to a SOC lead and to read a rules-of-engagement paragraph that says “no persistence.” If a hiring manager uses different labels, you can still map their words onto learn / probe / enter / stay / hide-or-document. The skill is translation, not reciting a vendor order as if it were a statute.

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cat >> "$NOTES" << 'EOF'
map: recon -> scan -> gain_access -> maintain -> cover (DEFENDER names)
use: detection opportunities + where MY RoE stops
not_use: a strike plan against strangers
stop_when: the written paper stops — curiosity is not the sixth phase
EOF

printf "%s
" "1 recon (learn, mostly published)" "2 scan (probe allowed hosts/ports)" "3 gain access (impact you DESCRIBE)" "4 maintain (persistence you DETECT)" "5 covering tracks (why logs must leave the box)"

Reconnaissance is learning without (or before) poking the target as a live system: what the organization publishes, what DNS and certificate transparency already show, what job ads reveal about the stack. Topic 4 taught you that footprints exist whether you are the subject or the observer. Module 2 in this topic will treat passive recon as reading public data on domains you own or on example.com-style public records — not as stalking a neighbor. Recon is where many students accidentally go criminal: scraping personal inboxes, buying dumps, phishing a real company “for OSINT.” Those are not recon labs here.

Scanning is active probing: asking a host which ports answer, which services speak, sometimes which software versions banner. Packets make it more obvious than quiet reading. Defenders care because scanners are noisy if you are looking, and because a well-placed probe can still crash a fragile service. Authorized testers care because scanning the wrong CIDR is how you become an incident on someone else’s ticket. In this introduction you will not run a network scanner at all. You will write what scanning would mean on YOUR VM later, and you will write that scanning a campus or a cloud range you do not lease is out. Topic 3 already taught ports as facts; this lesson adds the permission wrapper around those facts.

A defender reading the map at these two stages asks: what have we published that we did not mean to, and what would a probe of our listening services look like in logs? An authorized tester asks: what public facts are in scope to collect, and which probes are allowed against which IPs on which dates? You, today, ask: can I explain both questions without sending a packet? If yes, the notes file is enough. If you feel incomplete without nmap output, that feeling is a risk signal — sit with it until Lesson 4’s personal RoE names exactly which loopback or VM is allowed, and until a later module actually assigns a scan of that VM.

sudo apt install whois

brew install whois

cat >> "$NOTES" << 'EOF'
recon: published pages/DNS/WHOIS on example.com or a name I own
scan: I sent a packet asking is this port open — ONLY 127.0.0.1 or MY VM
log_can_name_me: yes, once I probe
EOF

Gaining access means crossing from “I can see a service” to “I can act as the system or a user in a way the owner did not intend.” That might be a guessed password on a lab VM you own, a vulnerability in a deliberately vulnerable app you cloned locally, or — in a real paid test — a finding the contract asked you to attempt. This course will not hand you exploit proof-of-concepts against the public internet. When later modules discuss access, they will stay inside YOUR lab or clearly marked local targets. Demonstrating access on a stranger’s box is a crime even if you immediately log out and write a friendly email.

Maintaining access is persistence: a way back after reboot, a second account, a scheduled task, a token that still works. Defenders hunt persistence because one phish should not become a year of presence. Authorized testers sometimes install a temporary foothold if and only if the rules say they may, and they remove it or hand it to the owner at the end. In Cyberlium you will not plant persistence on anything you do not own. You will write why persistence matters: backups, privileged accounts, and “we rotated one password” are incomplete if a second door remains. Topic 1’s least privilege and Topic 8’s key hygiene are already controls on this stage.

These two stages are where CIA fails in the loud way. Confidentiality fails if you can read data you should not. Integrity fails if you can change it. Availability fails if you can smash the service — which is why many rules of engagement forbid denial-of-service even when access tests are allowed. Your ethics notes should already say you do not steal data. This lesson adds: you do not need to perform access or persistence to understand them as map locations. Description is in scope. Demonstration waits for a lab that names YOUR process, YOUR file, YOUR VM.

cat >> "$NOTES" << 'EOF'
gain_access_means: a control failed — I describe it, I do not pop a stranger
maintain_means: a foothold that survives reboot — I look for it in MY logs
cover_tracks_means: why off-box logs matter — I do not wipe anyone
EOF

Criminal covering tracks means deleting logs, tampering timestamps, or hiding files so investigators struggle. We will not teach you how to do that to someone else’s systems. We will teach you why the stage exists on the map: if logs are only on the same box that was compromised, a competent intruder may alter them; if logs are copied off-box, time-synced, and access-controlled, covering tracks gets harder. That is a defensive design sentence. Topic 2’s log habits and Topic 7’s parsers sit here. Your job as a learner is to expect artifacts, not to practice wiping a school firewall.

In an authorized engagement, “covering tracks” often flips into professional hygiene: do not leave your test accounts, do not leave a webshell, tell the owner what you changed, and put it in the report. Hiding your work from the client is the opposite of the job. Students mix this up because crime dramas treat stealth as skill. In a paid test, stealth might be in scope as “can we detect you,” or it might be forbidden because the client wants every action in the SIEM on purpose. The rules of engagement decide. Without rules, stealth is just unauthorized concealment.

Write the five names in order as a defender would brief them: (1) what did we leak before anyone knocked, (2) what would a knock look like, (3) what does a successful knock become, (4) what would keep the knocker inside, (5) what evidence should still exist anyway. Then write the Cyberlium cut: I describe all five; I perform none of them against assets I do not own; I will not use this list as a burglary order. That paragraph is the whole lesson in portable form. Law and RoE next will attach signatures and stop-conditions to it.

Create or update files only under $HOME/cyberlium-lab. The block writes ceh-five-phases-notes.txt with the five names, a defender question per stage, and an ethics cut. Fill every parenthetical in your own words. Do not attach nmap output from a third party. Do not paste copyrighted vendor outlines. chmod 600. If you cannot explain covering tracks without describing a wipe command aimed at someone else, rewrite that line until it is about logs you would want to keep.

cd "$HOME/cyberlium-lab"

cat > "$NOTES" << 'EOF'
=== CYBERLIUM FIVE PHASES — DEFENDER MAP (MODULE 1 LESSON 2) ===
disclaimer: Original Cyberlium curriculum mapped to the CEH v13 introduction
domain. NOT official EC-Council training. NOT a CEH exam dump. Completing
this does NOT grant CEH.

1_recon: learn from what is already public / owner-approved
defender_question: (what have we published that we did not mean to?)
tester_cut: only data I am allowed to read; no stalking, no dumps
2_scan: probe services that are in written scope
defender_question: (what would a probe of our listeners look like in logs?)
tester_cut: no campus/cafe/neighbor/random CIDR; later labs = MY VM/localhost
3_gain_access: act as system/user in an unintended way
defender_question: (which control should have made this expensive?)
tester_cut: describe now; demonstrate only on assets I own when a lab says so
4_maintain: persistence after reboot or password change
defender_question: (what second door would we miss if we only rotated one secret?)
tester_cut: I will not plant footholds on systems I do not own
5_cover_tracks: artifacts and log design — NOT a wipe tutorial
defender_question: (are logs off-box, time-synced, hard to silently alter?)
tester_cut: in an engagement I document and clean up MY changes; I do not hide from the owner

shared_map: defenders place controls; authorized testers stay inside the paper
cyberlium_cut: I describe all five; I do not run them on strangers
ethics: authorized lab only; $HOME/cyberlium-lab; chmod 600; no attacking others
EOF

ls -l "$NOTES"

You can now brief five stages without pretending they are a burglary app: recon and scan are how learning becomes a knock; access and maintain are how a knock becomes impact; covering tracks is why logs must outlive the box. You refused to run that story on anyone who did not authorize it. Next — Law, Contracts, and Rules of Engagement — you will see why “I was practicing” is not a defense, and what written RoE actually contains, still inside original Cyberlium teaching, still not a CEH voucher, still chmod 600 on every file that names your lab.