Skip to content

Lab · Ethical Hacking and Penetration Testing (legal labs)

Lab: reconnaissance, the right way

Labbeginner· about 1.5 hours· 4 steps

The brief

Recon is gathering information before any attack. You practise passive recon (public DNS, with no packet sent to the target) and active recon against your own authorised lab target (a ping to check it is up, and HTTP headers to fingerprint the web server). For each finding you also write the defender's fix.

Why it matters

Every real engagement and every bug-bounty write-up starts with recon: what is out there, what software and version, what is exposed. Doing it methodically, and knowing which steps touch the target and which do not, keeps you inside your authorisation and makes your report credible.

Skills you practise

  • passive vs active recon
  • DNS lookups with nslookup
  • host discovery with ping
  • HTTP fingerprinting with curl
  • banner hardening (the fix)

You need

  • Your isolated lab from the previous lab (Kali plus a DVWA or Metasploitable target)
  • nslookup (built in) for the passive step

What you will have at the end

recon.txt: a short recon report separating passive from active findings, with the exact fix for the web-server information leak.

How it is marked (rubric, 100 points)
Recon done correctlyAll three technical steps pass: DNS resolves, the target replies, and the server banner is captured.45
Passive vs activeThe notes make clear which steps touched the target and which did not.20
Finding plus fixThe banner leak is paired with the correct hardening fix.25
Tidy notesrecon.txt is clear enough for a client to read.10

0/4 steps done

Step 1 of 4

Passive recon: public DNS

You have read a domain's public DNS records without sending anything to the target.

Passive recon uses public sources, so the target never sees you. Public DNS is a good example. Look up the addresses of a domain you are allowed to research (use iana.org or your own domain; do not scan it, only read its DNS). nslookup queries the public directory, not the target's own servers.

Run this on your machine, then paste the output below
$ nslookup iana.org

Also check yourself

Your notes: recon.txt

Write down each command you ran. It goes into your project summary.