Run reconnaissance end to end against your own lab, scope-enforced

capstone · 150 min · Objective 2.4

Task

Run the whole of Domain 2 as one pipeline against your own lab: passive footprint, active discovery, DNS and service enumeration, all driven by scripts that enforce scope and keep an activity log, ending in one reconciled map of the environment. This is reconnaissance and enumeration unguided, on infrastructure you own.

Steps

  1. Build a small lab environment on the network you own: a few hosts, a DNS zone you host, a web server with seeded content.
  2. Passive: footprint the reserved documentation domain with provenance, as in lesson 7, into /tmp/recon/passive.md.
  3. Active: run scope-enforced discovery using your lesson 14 script against the lab range, logging every action to /tmp/recon/activity.log.
  4. Enumerate: DNS records from your zone, services and versions from your hosts, web content from your server — each into its own file.
  5. Reconcile: merge everything into /tmp/recon/map.md — hosts, services, names, web surface — separating fact from inference and marking what would need ownership confirmed before it could be a target.
  6. Confirm the scope-enforcing script refused at least one out-of-scope target during the run, and that the refusal is logged.

Verify

ls /tmp/recon/ | grep -cE "\.(md|log)$"
awk -F'\t' 'NF>=5{c++} END{print c" activity log line(s)"}' /tmp/recon/activity.log
grep -cE "^(host|service|name):" /tmp/recon/map.md
grep -ciE "refus|out of scope" /tmp/recon/activity.log

The first count must be at least 4 — the pipeline produced its artifacts. The second must be non-zero and well-formed: the activity log ran throughout. The third must be non-zero: the reconciled map has structured entries, not prose. The fourth must be non-zero: the scope enforcement fired at least once, which is the proof that staying in scope was a property of the tooling and not of your memory.

Notes

This capstone is the argument for Domain 2 being 21% of the exam: reconnaissance decides what you scan, what you attack, and often what the report's headline finding is. Everything here ran against your own lab or a reserved domain, driven by scripts that resolve targets and refuse anything outside a scope file — which is exactly how the same pipeline stays lawful on a real engagement.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.