Lab — Recon
Pack recon plan — passive/active labels, OSINT self, discovery log — literacy file only, dest $LAB_HOST.
Visual · pentest_recon_lab
Lab: write recon pack. $LAB_HOST only. Original Cyberlium.
Recon pack before probes — methodology on paper first.
Lessons 3-1 through 3-3 covered passive vs active, OSINT on self/lab domain, and host discovery logging. This lab ships the combined recon plan: technique labels, three OSINT sources on YOUR domain, discovery log template — all pointing at $LAB_HOST. Optional: run discovery against $LAB_HOST only if RoE pack exists. No dorm sweeps. Next: Quiz — Recon Literacy.
1. Lab contract: write the recon pack
Create $HOME/cyberlium-lab/t19-m03-l04-recon-lab.txt with passive/active definitions, three self OSINT sources, discovery log template, and NEVER stranger lines.
Optional: one discovery result line for $LAB_HOST — still no port scan required here.
Command guide
Try these commands — Lab contract: write the recon pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Recon output — save to file for report evidence Nmap output — https://nmap.org/book/man-output.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t19-lab.env" nmap -oN "$HOME/cyberlium-lab/t19-recon.txt" -sn "$LAB_HOST" grep -E 'Nmap scan|Host is up' "$HOME/cyberlium-lab/t19-recon.txt"
Primary tools to practice this lesson: nmap, grep. Reference sites: Recon output; Nmap output (https://nmap.org/book/man-output.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Verify scope before any probe
Cross-check RoE and scope packs name $LAB_HOST. Redact any stranger IP examples from drafts.
Tutorials showing public range discovery get rewritten to YOUR lab IP mentally before copying.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Service Enumeration.
Pentest reports open with recon methodology; you are drafting that section early.
4. What you ship: recon pack for $LAB_HOST
Passive/active + OSINT self + discovery log. $LAB_HOST only. NEVER stranger recon. chmod 600.
5. What you record before the next lesson
Date. Recon pack path. Optional $LAB_HOST discovery note. File t19-m03-l04-recon-lab.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Add Shodan stranger IPs to recon pack. Skip file and nmap dorm.
- Right: Write YOUR recon pack for $LAB_HOST. chmod 600. Next: Quiz — Recon Literacy.
Mission: freeze YOUR recon pack on disk
1) Combine passive/active, OSINT, discovery template. 2) Name $LAB_HOST as sole active target. 3) chmod 600. Never list stranger IPs.
Stuck? Ask Cyberlium AI Mentor
Recon packs save you from 'just one quick scan' on the wrong network.
APPLY: This lab requires:
APPLY: True or False: Optional discovery may target only $LAB_HOST per RoE.
APPLY: OSINT in recon pack should use: