Make a recon script refuse targets outside a scope file

applied · 80 min · Objective 2.4

Task

Build a recon script that enforces scope in code — it resolves every target, checks the address against a scope file, and refuses anything outside it — so that staying in scope is a property of the tool rather than something the tester has to remember at 2am on the third day. Objective 2.4 is customising scripts, and this is the customisation that matters most.

Steps

  1. Write /tmp/scope.txt with the in-scope ranges — use RFC1918 lab ranges and a documentation range you own the meaning of.
  2. Write /tmp/scan.sh that takes a target, resolves the name to an address, checks the address against the scope file, and only then acts — refusing, not warning, anything outside scope.
  3. Make it re-check at the moment of use, not once at startup: a script that expands its target list as it discovers hosts must check each new one.
  4. Make it fail closed: anything it cannot resolve or classify is refused by default, and every refusal is logged with what and why.
  5. Test it: an in-scope lab address is accepted; an out-of-scope address is refused; a name that resolves outside scope is refused even though the name looked fine.

Verify

echo "10.10.10.5" | bash /tmp/scan.sh 2>&1 | grep -ciE "accept|in scope|proceed"
echo "203.0.113.9" | bash /tmp/scan.sh 2>&1 | grep -ciE "refus|out of scope|denied"
test -s /tmp/refusals.log && grep -cE "refus|denied" /tmp/refusals.log || echo "0"

The first must be non-zero: an in-scope lab address is accepted. The second must be non-zero: an out-of-scope address (a documentation range not in your scope file) is refused. The third must be non-zero: every refusal is logged, because a refusal is itself a finding — something in your input pointed outside the scope, and you want to know what and why.

Notes

Checking only the name lets DNS carry you out of scope, which is why the script resolves and checks the address — a name is not a target, and names move. Mutating tools fail closed: refuse by default rather than proceed. This is the difference between remembering the rule and not needing to, and it is the Domain 2 capstone's foundation. Every target here is a lab address or documentation range.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.