Lab 1 — Reconnaissance and mapping
Kick-off in week 4 · due in week 6
Context
You receive VPN access to a fictitious lab network (10.20.0.0/24), with an RoE that
authorizes passive and active reconnaissance up to the identification of vulnerabilities,
with no exploitation.
Learning objectives
- Chain OSINT, active scanning and service enumeration, in that order.
- Produce a professional document reusable in the exploitation phase.
- Prioritize based on objective criteria.
Expected deliverable
A report of 6 to 10 pages (Markdown or PDF) containing:
- Context — reminder of the perimeter, dates, tools used.
- Passive reconnaissance — DNS, WHOIS, public certificates and search-engine results.
- Active mapping — table of live hosts, table of services (host, port, service, version).
- Analysis of likely vulnerabilities — for each notable host, hypothesis, source (CVE/EPSS/KEV), confidence level.
- Three prioritized attack hypotheses — no exploitation, just the plan. Justify the priority (potential impact × ease).
- Appendices — commands executed, raw outputs, decisions taken.
Grading grid (100 points)
| Criterion | Points |
|---|---|
| Passive reconnaissance complete and sourced | 15 |
| Actionable active mapping | 25 |
| Quality of service enumeration | 15 |
| Relevance of attack hypotheses | 20 |
| Justified prioritization | 10 |
| Traceability (commands, dates, versions) | 10 |
| Writing clarity | 5 |
What loses points
- Copy-pasting Nmap output without reading it.
- Unsourced hypotheses ("it looks vulnerable").
- Missing dates or command log.
- Red line: exploiting before submission. Lab 1 is purely descriptive.