Lab 01 Reconnaissance and Attack Surface Discovery

Mission: You are a penetration tester beginning an authorized assessment. Before attempting exploitation, your job is to understand the target environment, identify exposed services, determine what technologies are running, and build an attack-surface map that can guide later testing.

Mission Information

Item	Details
Certification	CompTIA PenTest+
Difficulty	Beginner → Intermediate
Estimated Time	90–120 minutes
Primary Skills	Reconnaissance, enumeration, scanning, service identification
Environment	Isolated/local penetration-testing lab
Attacker System	Kali Linux
Target	Metasploitable 2 or another intentionally vulnerable VM
Primary Tools	Nmap, dig, nslookup, whois, curl
Output	Attack Surface Discovery Report

Learning Objectives

By completing this lab, you should be able to:

• distinguish passive from active reconnaissance;

• define an authorized assessment scope;

• collect publicly available information appropriately;

• discover live hosts;

• perform TCP port discovery;

• identify services and versions;

• perform operating-system fingerprinting;

• enumerate common network services;

• identify web technologies;

• interpret Nmap results rather than simply running commands;

• create an attack-surface inventory;

• prioritize findings for subsequent vulnerability assessment;

• collect evidence suitable for a penetration-testing report.

The important PenTest+ skill is not memorizing commands.

You should understand why a reconnaissance technique is being used, what information it provides, and how that information affects the next phase of a penetration test.

1. Scenario

You work for a security consulting organization.

A client has asked your team to perform a penetration test against a server in its test environment.

The client provides the following Rules of Engagement:

Assessment Type: Network Penetration Test
Authorized Target: 192.168.56.105
Authorized Network: 192.168.56.0/24
Testing Window: Current Lab Session

Permitted:
- Host discovery
- Port scanning
- Service enumeration
- OS fingerprinting
- Web enumeration

Not Permitted:
- Denial-of-service testing
- Destructive testing
- Modification of target data
- Testing systems outside the lab subnet

Replace 192.168.56.105 throughout the lab with the IP address of your own intentionally vulnerable VM.

Why scope matters

A penetration tester does not have permission to test everything they can reach.

A target may be technically reachable while still being outside the authorized scope.

Before running a scanner, verify:

What systems can I test?
What techniques can I use?
When can testing occur?
What activities are prohibited?
Who should be contacted if something goes wrong?

This is an important PenTest+ concept.

2. Lab Architecture

Use an isolated environment:

                PenTest+ Lab Network
                 192.168.56.0/24
                         |
          +--------------+--------------+
          |                             |
          |                             |
   +-------------+               +-------------+
   | Kali Linux  |               | Vulnerable  |
   | Attacker    |               | Target VM   |
   +-------------+               +-------------+
   | .101        |               | .105        |
   +-------------+               +-------------+

Recommended virtualization options include:

• VirtualBox

• VMware Workstation

• VMware Fusion

Configure the machines using a host-only/internal isolated network where practical.

Do not bridge an intentionally vulnerable VM directly onto an untrusted or production network.

3. Prerequisites

Before starting, confirm:

• Kali Linux is operational.

• Your vulnerable target VM is operational.

• Both machines are connected to the same isolated network.

• You know which subnet belongs to the lab.

• You have authorization to scan every system you test.

On Kali Linux, check your interfaces:

ip addr

Alternatively:

ip a

Identify the lab interface and address.

Example:

eth0
192.168.56.101/24

Record:

Attacker IP:
Attacker Interface:
Lab Subnet:
Target IP:

4. Phase 1 — Understand Passive vs Active Reconnaissance

Reconnaissance is commonly divided into two categories.

Passive reconnaissance

Passive reconnaissance attempts to collect information without directly interacting with the target infrastructure.

Examples include:

WHOIS
Search engines
Public websites
DNS information from public sources
Job advertisements
Public code repositories
Certificate transparency records
Social media
Public documentation

Passive reconnaissance can reveal:

domains
subdomains
email formats
technology stacks
employee information
cloud providers
IP ranges
third-party services

Active reconnaissance

Active reconnaissance interacts directly with target infrastructure.

Examples include:

Ping
Port scanning
Banner grabbing
Service enumeration
OS fingerprinting
Directory discovery
SNMP queries
SMB enumeration

Because the target can observe these requests, active reconnaissance is generally more detectable.

Exam Checkpoint

Be prepared to distinguish:

Passive Recon
        ↓
Information gathered without directly probing target systems

Active Recon
        ↓
Direct interaction with target infrastructure

5. Phase 2 — Passive Information Gathering

For a real engagement, passive reconnaissance may begin with the client’s public domain.

For this isolated lab, we’ll practice the commands without targeting unrelated third-party organizations.

WHOIS

Syntax:

whois example.com

WHOIS information can potentially reveal:

• registrar;

• registration dates;

• name servers;

• administrative information;

• domain status.

Modern privacy controls often hide registrant information, so the absence of personal registration details is normal.

Evidence

Record:

Domain:
Registrar:
Name Servers:
Creation Date:
Expiration Date:
Interesting Observations:

6. DNS Reconnaissance

DNS can reveal important infrastructure information.

Try:

nslookup example.com

Then:

dig example.com

Query specific record types.

A records

dig example.com A

AAAA records

dig example.com AAAA

MX records

dig example.com MX

Name servers

dig example.com NS

TXT records

dig example.com TXT

Understand what each means:

Record	Purpose
A	Hostname → IPv4
AAAA	Hostname → IPv6
MX	Mail servers
NS	Authoritative name servers
TXT	Text-based information/policies
CNAME	Alias to another hostname
PTR	Reverse DNS mapping

PenTest+ Thinking

Finding an MX record doesn’t mean:

“Attack the mail server.”

It means:

“The organization exposes mail infrastructure that may need to be evaluated if it is included in the authorized scope.”

Reconnaissance builds hypotheses. It does not automatically authorize further testing.

7. Phase 3 — Discover the Lab Network

Now move into active reconnaissance against your isolated lab.

Verify the network.

ip route

Example:

192.168.56.0/24 dev eth0

You can inspect neighboring systems already known to Kali:

ip neigh

Now perform host discovery against your authorized lab subnet:

nmap -sn 192.168.56.0/24

-sn performs host discovery without the normal port scan.

Example output might show:

Nmap scan report for 192.168.56.1
Host is up.

Nmap scan report for 192.168.56.105
Host is up.

Do not assume every discovered device is automatically a valid penetration-testing target.

Compare discoveries against the scope.

Record your findings

Create:

LIVE HOST INVENTORY

IP Address:
MAC Address:
Vendor:
Status:
In Scope?:
Notes:

8. Phase 4 — Initial TCP Port Scan

Once the authorized target has been identified, perform an initial scan.

nmap 192.168.56.105

Nmap will scan its default set of commonly used ports.

Possible findings might include:

21/tcp   open
22/tcp   open
23/tcp   open
25/tcp   open
80/tcp   open
139/tcp  open
445/tcp  open
3306/tcp open

Your output will depend on your target.

Understand Nmap states

Open

An application is accepting connections.

Closed

The host is reachable, but no application is listening on that port.

Filtered

Nmap cannot reliably determine whether the port is open because filtering is interfering with the probes.

Potential causes include:

Firewall
ACL
Packet filtering
Security appliance

Exam Checkpoint

Know the difference between:

OPEN
CLOSED
FILTERED

Do not interpret filtered as simply “closed.”

9. Phase 5 — Scan All TCP Ports

A default scan does not test every possible TCP port.

Run:

nmap -p- 192.168.56.105

-p- means:

ports 1–65535

You can optionally control scan speed in the isolated lab:

nmap -T4 -p- 192.168.56.105

Compare the results with your original scan.

Ask:

Did the complete scan discover services that the default scan missed?

Record the answer.

10. Phase 6 — Understand SYN Scanning

With suitable privileges, run:

sudo nmap -sS 192.168.56.105

-sS requests a TCP SYN scan.

Conceptually:

Kali                        Target

 SYN  ---------------------->

      <---------------- SYN/ACK

 RST  ---------------------->

Rather than completing a normal TCP connection, the scanner can infer port state from the response.

PenTest+ Concept

Know the distinction between common scan approaches such as:

TCP SYN scan
TCP connect scan
UDP scan
Service/version detection
OS detection

You should select a technique based on the assessment objective rather than using every Nmap option automatically.

11. Phase 7 — Service and Version Detection

An open port is only the beginning.

You need to determine what is actually listening on it.

Run:

nmap -sV 192.168.56.105

Example:

PORT    STATE  SERVICE  VERSION

21/tcp  open   ftp      vsftpd
22/tcp  open   ssh      OpenSSH
80/tcp  open   http     Apache httpd

Create a service inventory.

Port	Protocol	Service	Version	Notes
21	TCP	FTP	Discovered version	Review
22	TCP	SSH	Discovered version	Review
80	TCP	HTTP	Discovered version	Web server

Use your actual scan results, not the example values.

12. Phase 8 — Operating-System Detection

Attempt OS fingerprinting:

sudo nmap -O 192.168.56.105

You can combine OS and service discovery:

sudo nmap -sV -O 192.168.56.105

Nmap may report an OS family or possible matches.

Treat OS fingerprinting as an inference, not guaranteed truth.

Record:

Detected OS:
Confidence:
Supporting Evidence:

13. Phase 9 — Nmap Default Scripts

Nmap’s scripting engine can perform additional enumeration.

Against your lab target:

nmap -sC 192.168.56.105

-sC runs Nmap’s default script set.

You can combine it with version detection:

nmap -sC -sV 192.168.56.105

Review the output carefully.

Scripts may reveal information such as:

HTTP titles
SSH host keys
Service information
SMB information
Certificates
Protocol capabilities

The key skill is interpreting what each result means for the attack surface.

14. Phase 10 — Web Service Enumeration

Suppose your scan identifies:

80/tcp open http

First inspect the HTTP response:

curl -I http://192.168.56.105

Possible headers could reveal:

Server
Content-Type
Location
Authentication requirements
Caching information

Then request the page:

curl http://192.168.56.105

You can also visit:

http://192.168.56.105

from a browser inside your lab.

Record:

Page Title:
Server:
Application:
Interesting Headers:
Authentication Present:
Potential Technology:

15. Phase 11 — HTTP Enumeration with Nmap

Run HTTP-related discovery scripts appropriate for your lab:

nmap -p 80 --script http-title 192.168.56.105

You can inspect HTTP headers:

nmap -p 80 --script http-headers 192.168.56.105

If HTTPS is present, include its actual port from your scan.

The purpose is to determine:

What application is exposed?
What server appears to host it?
Does it redirect elsewhere?
Are interesting headers exposed?
Is authentication present?

16. Phase 12 — SMB Enumeration

If the target exposes:

139/tcp
445/tcp

SMB may be available.

Begin with service identification:

nmap -sV -p 139,445 192.168.56.105

Then perform non-destructive SMB discovery appropriate to the authorized lab:

nmap -p 445 --script smb-protocols 192.168.56.105

Depending on the lab configuration, you may discover supported SMB protocol versions.

This matters because protocol configuration can influence subsequent vulnerability analysis.

Record:

SMB Available:
Ports:
Protocol Versions:
Observed Host Information:
Follow-up Required:

17. Phase 13 — FTP Enumeration

If port 21 is open:

nmap -sV -p 21 192.168.56.105

You can inspect the service manually:

nc 192.168.56.105 21

A service banner may identify the software.

For example:

220 FTP Server Ready

Exit with:

QUIT

This technique is called banner grabbing.

Banner information can assist with:

service identification
version identification
vulnerability research
configuration analysis

18. Phase 14 — SSH Enumeration

If SSH is available:

nmap -sV -p 22 192.168.56.105

You may also examine supported cryptographic configuration using appropriate Nmap discovery scripts:

nmap -p 22 --script ssh2-enum-algos 192.168.56.105

Record:

SSH Version:
Algorithms Observed:
Potential Legacy Configuration:
Follow-up Required:

Do not start password guessing simply because SSH exists.

Reconnaissance and credential attacks are different activities and may have different authorization requirements.

19. Phase 15 — UDP Discovery

TCP-only reconnaissance can miss important services.

Perform a limited UDP scan against common ports in your lab:

sudo nmap -sU --top-ports 20 192.168.56.105

Potential UDP services include:

DNS
SNMP
NTP
TFTP

UDP scanning behaves differently from TCP scanning and may take significantly longer.

You may encounter:

open
closed
open|filtered

Exam Focus

Understand why UDP enumeration can be harder:

• UDP is connectionless.

• Applications may not respond to unexpected probes.

• Firewalls may silently drop traffic.

• ICMP responses may be rate limited.

20. Phase 16 — Build the Attack Surface Map

You should now have enough information to construct an initial map.

Example:

TARGET: 192.168.56.105
        |
        +-- FTP
        |    └── TCP/21
        |
        +-- SSH
        |    └── TCP/22
        |
        +-- HTTP
        |    └── TCP/80
        |
        +-- SMB
        |    ├── TCP/139
        |    └── TCP/445
        |
        +-- Database
             └── TCP/3306

Again, use the services you actually discovered.

This attack-surface map becomes an input into vulnerability analysis.

21. Phase 17 — Prioritize the Attack Surface

Not every exposed service carries the same risk.

Create a table:

Service	Exposure	Information Known	Potential Concern	Priority
FTP	Network	Version identified	Legacy/insecure configuration	High
SSH	Network	Version identified	Configuration review	Medium
HTTP	Network	Web application	Web attack surface	High
SMB	Network	SMB exposed	Sharing/protocol security	High

These are examples only.

Your priority should be based on evidence from your lab.

Think like a penetration tester:

Exposure
    ↓
Service
    ↓
Version
    ↓
Configuration
    ↓
Potential vulnerability
    ↓
Validation
    ↓
Risk

Do not jump directly from:

Open Port → Vulnerable

An open port is an exposure, not automatically a vulnerability.

22. Save Your Evidence

Create a working directory:

mkdir -p ~/pentest-lab/recon
cd ~/pentest-lab/recon

Save an Nmap scan:

nmap -sV 192.168.56.105 -oN service-scan.txt

Save an all-port scan:

nmap -p- 192.168.56.105 -oN all-ports.txt

Save XML output when useful for later processing:

nmap -sV 192.168.56.105 -oX service-scan.xml

Or multiple standard formats:

nmap -sV 192.168.56.105 -oA target-services

You may then have:

target-services.nmap
target-services.xml
target-services.gnmap

Evidence management is part of professional penetration testing.

23. Create a Reconnaissance Log

Create:

nano recon-notes.md

Use a structure such as:

# Reconnaissance Notes

## Target

IP:
Hostname:
Scope:

## Host Discovery

Method:
Result:

## Open Ports

Port:
Protocol:
State:
Service:

## Service Versions

Service:
Version:
Evidence:

## Web Technologies

Server:
Application:
Headers:

## Additional Services

SMB:
SSH:
FTP:
Database:

## Potential Areas for Further Assessment

1.
2.
3.

## Evidence Files

-
-
-

24. Student Challenge

Now repeat the reconnaissance process with minimal guidance.

Your mission is to answer:

1. What is the target IP address?

2. Which TCP ports are open?

3. Are any UDP services exposed?

4. What services are running?

5. What versions can be identified?

6. What operating system appears to be running?

7. Is a web server present?

8. Is SMB exposed?

9. Is FTP exposed?

10. Which three services deserve the highest-priority follow-up?

For every answer, provide evidence.

Do not perform exploitation in this lab.

25. Required Deliverables

Submit the following:

01-host-discovery.txt
02-port-scan.txt
03-service-scan.txt
04-attack-surface.md
05-recon-notes.md

Your attack-surface report should contain:

# Attack Surface Discovery Report

## 1. Scope

## 2. Target Information

## 3. Reconnaissance Methodology

## 4. Live Hosts

## 5. Open Ports

## 6. Services and Versions

## 7. Operating System Observations

## 8. Web Technologies

## 9. Additional Network Services

## 10. Potential Areas of Concern

## 11. Recommended Next Steps

## 12. Evidence

26. PenTest+ Exam Checkpoints

Make sure you can explain these concepts without relying on the lab instructions.

Reconnaissance

Passive vs Active

DNS

Know:

A
AAAA
MX
NS
TXT
CNAME
PTR

Nmap

Understand the purpose of:

-sn
-sS
-sV
-sU
-O
-p
-p-
-sC
-oN
-oX
-oA

Do not focus only on memorizing switches. Understand the testing objective behind each option.

Port states

Know:

open
closed
filtered
open|filtered

Enumeration

Understand the purpose of:

DNS enumeration
HTTP enumeration
SMB enumeration
SSH enumeration
FTP enumeration
Banner grabbing
Service fingerprinting
OS fingerprinting

27. Knowledge Check

Question 1

What is the primary difference between passive and active reconnaissance?

Expected concept: Active reconnaissance directly interacts with target infrastructure; passive reconnaissance seeks information without directly probing those systems.

Question 2

You discover TCP/443 open. Does this prove the server is vulnerable?

Answer: No.

An open port demonstrates exposure of a listening service. Additional analysis is required to identify vulnerabilities.

Question 3

Nmap reports:

445/tcp filtered microsoft-ds

What does filtered indicate?

Answer: Filtering prevents Nmap from reliably determining whether the port is open.

Question 4

Why perform service-version detection?

Because knowing:

Port 80 is open

is less useful than understanding:

Port → Protocol → Service → Product → Version → Configuration

The additional information supports vulnerability analysis.

Question 5

Why should a penetration tester preserve reconnaissance results?

They provide:

• evidence;

• repeatability;

• reporting information;

• inputs for later testing;

• an audit trail of assessment activity.

28. Lab Completion Checklist

Before marking the lab complete, verify:

• I verified the authorized scope.

• I identified my attacker IP and subnet.

• I understand passive vs active reconnaissance.

• I performed host discovery.

• I performed TCP port discovery.

• I performed a complete TCP port scan.

• I identified services and versions.

• I attempted OS fingerprinting.

• I performed basic web enumeration where applicable.

• I examined other discovered network services.

• I performed limited UDP discovery.

• I created an attack-surface inventory.

• I prioritized potential follow-up areas.

• I saved scan evidence.

• I created reconnaissance notes.

• I did not test outside the authorized lab environment.

Key Takeaways

A professional penetration test does not begin with exploitation.

It begins with:

Scope → Reconnaissance → Discovery → Enumeration → Analysis

The objective of reconnaissance is to transform an unknown environment into an understandable attack surface.

For PenTest+, remember the relationship:

Reconnaissance
      ↓
Host Discovery
      ↓
Port Discovery
      ↓
Service Enumeration
      ↓
Technology Identification
      ↓
Attack Surface Mapping
      ↓
Vulnerability Assessment

The strongest penetration testers do not simply collect scanner output. They use reconnaissance findings to determine what should be investigated next and why.

What’s Next?

➡️ Lab 02 — Vulnerability Scanning and Analysis

In the next lab, you will take the attack surface discovered here and move into the vulnerability assessment phase.

You will learn how to:

• perform vulnerability scans in an authorized lab;

• correlate scanner findings with discovered services;

• interpret severity and risk;

• distinguish a vulnerability from simple service exposure;

• identify and investigate false positives;

• manually validate selected findings safely;

• prioritize vulnerabilities;

• collect defensible evidence;

• build a vulnerability assessment report.

The progression becomes:

Reconnaissance → Vulnerability Discovery → Validation → Prioritization

This prepares us for Lab 03 — Web Application Penetration Testing, followed by controlled exploitation and finally the full PenTest+ capstone assessment.