Recon & Scanning path
Recon & Scanning is reconnaissance: before defending a network, or testing it with permission, you need to know what is in it. You learn to discover live hosts, list ports and services, read the banners services greet you with, and query DNS and HTTP headers. Every lab also shows the defender’s point of view: an up-to-date asset inventory, minimal banners, internal DNS kept apart from public DNS and nothing forgotten left running.
The labs, in order
- Mapping a host
easy · 650 XP
A host is online but you don't know what it exposes. Scan the ports, identify the services and read the web page to find the flag.
Requires: Hidden files.
- Service banners
easy · 330 XP
When you connect to a service with nc, it often introduces itself: name, version, sometimes much more. Scan archivio.nr, connect to every open port and read what each one has to say: one of them is out of the ordinary.
Requires: Mapping a host.
- Who's on the network?
medium · 600 XP
The branch's IT inventory says there are 4 devices on the 10.10.7.0/24 network. Check how many actually respond: if one is not on the list, find it, see what it exposes and read its web page.
Requires: Service banners.
- DNS talks
medium · 600 XP
DNS is the company's phone book, and every name is a clue. You have a list of names to try (wordlist.txt) for the corp.nr domain: find out which ones exist and reach the one nobody remembers.
Requires: Who's on the network?.
- Headers tell tales
medium · 600 XP
The orders application always answers with HTTP headers, and they often say more than they should. See what the server declares on the main page: a suspicious header hides the way to a restricted page.
Requires: Who's on the network? and Base64 is not a secret.
- Full reconnaissance
hard · 1000 XP
Client: Orion Logistics. All you have is a network, 10.10.20.0/24, and a statement: "the test orders panel no longer exists". Run a full reconnaissance: every answer hands you the next question.
Requires: DNS talks and Headers tell tales.
Commands in this path
Along this path the simulated terminal has you use these commands: nmap, gobuster, curl, cat, nc, dig, echo and base64. Each lab page explains what they are for.
Learn more with the guides
The other paths
- Linux Fundamentals – Shell, files, filters, permissions
- Encodings & secrets – Base64, hex, ciphers
- Web Exploitation – Hidden dirs, cookies, access
- Privilege Escalation – From user to root
- Blue Team / Defense – Logs, incidents, hardening