From confirming authorization and scope, through passive recon and OSINT, asset inventory, active recon and service identification, to recording and handoff. In 30 lessons you learn to map the attack surface of an authorized target from the outside. Every example and exercise targets only the fictional "Sample Corp." and your own local lab.
The 30 lessons are split into 6 chapters. Working through them in order is recommended, but you can also dip into just the parts you need. * Recon tools (dig, nmap, jq, etc.) are shown as command examples. Only run them against the consented lab on the security track (Public Asset Inventory) or a practice environment you set up yourself.
Reconnaissance is building a picture of an authorized target from the outside. This chapter covers where recon fits, the lines on what you may do, and how to keep records.
You can learn a surprising amount from public information without touching the target. This chapter gathers information from WHOIS, DNS, certificates, search and public files.
You organize what you gathered into a list of assets to protect. This chapter enumerates subdomains, reconciles them against an inventory, and ends with the inventory lab.
From here you actually send packets to the authorized target. This chapter covers host discovery and the thinking behind port scanning, with settings that avoid harm.
You identify what is running behind the open ports. This chapter covers reading banners, versions, web tech stacks and TLS.
Recon pays off only when it is organized into something the next phase can use. This chapter organizes findings, drafts them, hands off, and sums up what you must never do.
After the 30 lessons, head to the Web Application Assessment course to actually probe the entry points you found. The course order is on the security track. Membership unlocks every course.