Mapping a host
A host is online but you don't know what it exposes. Scan the ports, identify the services and read the web page to find the flag.
Lab 1 of 6 in the Recon & Scanning path. If you get stuck you have 2 hints, from the vaguest to the most precise: they cost 0 and 40 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Scan the host's ports (150 XP)
- Enumerate the web pages (150 XP)
- Find the debug page (200 XP)
Topics: recon, nmap.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
nmap: discovers the live hosts of a network and the open ports of a machine, with services and versions. Defenders use it to compare the real network with the inventory.gobuster: automatically tries a list of folder and page names on a website, to find what no link shows.curl: makes HTTP requests from the terminal and shows the server’s raw answer, headers included.
The simulated environment
The target is an invented host on a simulated private network: you can only reach it from the game terminal.
The target exposes these services:
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
Recon always comes before the attack: first you discover the surface (ports, services, versions), then you enumerate (directories, HTML comments, debug files). Comments left behind by developers are a gold mine.
Before and after this lab
To unlock it you must have solved:
- Hidden files (Linux Fundamentals, easy)
After this lab you can move on to:
- Service banners (Recon & Scanning, easy)
- robots.txt and forgotten folders (Web Exploitation, easy)
The Recon & Scanning path
Recon & Scanning is reconnaissance: before defending a network, or testing it with permission, you need to know what is in it. You learn to discover live hosts, list ports and services, read the banners services greet you with, and query DNS and HTTP headers. Every lab also shows the defender’s point of view: an up-to-date asset inventory, minimal banners, internal DNS kept apart from public DNS and nothing forgotten left running.