Project · Ethical Hacking and Penetration Testing (legal labs)
Project: map the attack surface
The brief
For your authorised lab target you confirm it is in scope, check it is up, grab a service banner, then rank the services by how much they are worth a closer look. The output is a short attack-surface report with a fix for the riskiest finding.
Why it matters
Before any deeper testing, a tester lists what is exposed and decides where to look first. Ranking the attack surface and recording a fix for each item is the shape of real junior-pentester and bug-bounty work.
Skills you practise
- scope checks
- host discovery
- banner grabbing with nc and curl
- ranking exposure in Python
- reporting with fixes
You need
- Your isolated lab (Kali plus a Metasploitable or DVWA target) from the beginner labs
What you will have at the end
surface.py (a tested scope check and exposure ranker) and surface.txt (a ranked attack-surface report with a fix for the top finding).
How it is marked (rubric, 100 points)
| Code worksin_scope, service_score and rank pass every check, including cleartext and unknown services. | 45 |
|---|---|
| Real reconA real banner was grabbed from an in-scope target and recorded. | 25 |
| Report with fixesThe report ranks the surface and pairs the top finding with a correct fix. | 20 |
| Stayed in scopeOnly the authorised target was touched. | 10 |
0/5 steps done
Step 1 of 5
Confirm the target is in scope
in_scope(ip, SCOPE) is True only for addresses in the authorised network.
Never touch a host you are not authorised to test. in_scope(ip, scope) returns True only when the address is inside one of the authorised networks. Run it before anything else.
Run shows what your code prints. Check runs the step's tests. Ctrl+Enter checks too.