Full reconnaissance
Client: Orion Logistics. All you have is a network, 10.10.20.0/24, and a statement: "the test orders panel no longer exists". Run a full reconnaissance: every answer hands you the next question.
Lab 6 of 6 in the Recon & Scanning path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 60 and 200 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- Discover the hosts on the network (100 XP)
- Get a name out of the mail service (200 XP)
- Resolve the leaked name with DNS (200 XP)
- Read the headers of the test site (200 XP)
Topics: recon, nmap, dns, http, capstone.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
cat: prints the contents of a file: the most direct way to read configurations, notes and logs.nmap: discovers the live hosts of a network and the open ports of a machine, with services and versions. Defenders use it to compare the real network with the inventory.nc: netcat opens a raw connection to a port and shows what the service answers, including its greeting message (banner).dig: queries DNS and tells you which address a name points to; if the name does not exist it answers NXDOMAIN.curl: makes HTTP requests from the terminal and shows the server’s raw answer, headers included.echo: prints some text or the value of a variable, such as $HOME.base64: encodes and decodes Base64, the format that turns bytes into text. It protects nothing: it can be undone without a key.|: the vertical bar | chains commands: the output of the first becomes the input of the next, so small tools form a complete analysis.
The simulated environment
The target is an invented host on a simulated private network: you can only reach it from the game terminal.
The target exposes these services:
- SSH: encrypted remote command-line access; it is protected with keys instead of passwords and without direct root login.
- SMTP: the mail server, whose greeting message can reveal internal names.
- Web (HTTP): a web server with pages, APIs or admin panels: the most exposed part of almost every organisation.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
A reconnaissance is a chain: every piece of information a service declares opens the way to the next — a host on the network, a banner that gives away a name, the DNS that resolves it, the headers that point to a page. No step was an "attack": listening was enough. Defense, link by link: minimal banners (smtpd_banner without internal names), internal DNS kept apart from public DNS, clean headers (no debug in production) and an asset inventory that says what is supposed to exist, so that whatever stays on by forgetfulness is found before an attacker finds it.
Before and after this lab
To unlock it you must have solved:
- DNS talks (Recon & Scanning, medium)
- Headers tell tales (Recon & Scanning, medium)
It is one of the final labs: no other lab requires it.
The Recon & Scanning path
Recon & Scanning is reconnaissance: before defending a network, or testing it with permission, you need to know what is in it. You learn to discover live hosts, list ports and services, read the banners services greet you with, and query DNS and HTTP headers. Every lab also shows the defender’s point of view: an up-to-date asset inventory, minimal banners, internal DNS kept apart from public DNS and nothing forgotten left running.