Week Content

Introduction: Before You Strike

With your engagement charter signed and scope defined, you're authorized to begin work. But "beginning" doesn't mean launching vulnerability scanners. Professional assessments start with two parallel activities: preparing your tools and understanding your target.

This week covers both: setting up an assessment environment that will serve you throughout the engagement, and conducting reconnaissance to map NovaTech's attack surface. By week's end, you'll have a functioning lab and a comprehensive picture of what you're assessing.

1. Assessment Environment Architecture

A professional assessment environment isolates your testing activities, organizes your tools, and ensures you can document and reproduce your work. The environment you build now will be your workspace for the entire engagement.

Environment Requirements

Your assessment environment should provide:

┌─────────────────────────────────────────────────────────────────┐
│              ASSESSMENT ENVIRONMENT REQUIREMENTS                │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  ISOLATION                    TOOLING                           │
│  ─────────                    ───────                           │
│  • Separate from personal     • Network scanning/enumeration    │
│    systems                    • Web application testing         │
│  • Dedicated assessment       • Exploitation frameworks         │
│    network                    • Traffic analysis                │
│  • Snapshot/restore           • Documentation/reporting         │
│    capability                                                   │
│                                                                 │
│  DOCUMENTATION                SECURITY                          │
│  ─────────────                ────────                          │
│  • Activity logging           • Encrypted storage for findings  │
│  • Screenshot capture         • Secure credential management    │
│  • Evidence preservation      • VPN for client connectivity     │
│  • Timeline tracking          • Clean state verification        │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘
            

Recommended Lab Configuration

For this capstone, we recommend a virtualized environment that you can run on your local machine. This provides isolation, snapshotting, and portability.

passwd

Essential Tool Categories

Kali includes most tools you'll need. Familiarize yourself with these categories:

Directory Structure

Organize your engagement files with a consistent structure from the start:

~/engagements/
└── novatech-2025/
    ├── 00-admin/
    │   ├── engagement-charter.pdf
    │   ├── contacts.md
    │   └── scope.md
    ├── 01-recon/
    │   ├── passive/
    │   │   ├── whois/
    │   │   ├── dns/
    │   │   └── osint/
    │   └── active/
    │       ├── nmap/
    │       └── enumeration/
    ├── 02-scanning/
    │   ├── vulnerability-scans/
    │   └── web-scans/
    ├── 03-exploitation/
    │   ├── evidence/
    │   └── screenshots/
    ├── 04-post-exploitation/
    ├── 05-reporting/
    │   ├── drafts/
    │   └── final/
    └── logs/
        └── terminal-sessions/
            

Create this structure at engagement start:

mkdir -p ~/engagements/novatech-2025/{00-admin,01-recon/{passive/{whois,dns,osint},active/{nmap,enumeration}},02-scanning/{vulnerability-scans,web-scans},03-exploitation/{evidence,screenshots},04-post-exploitation,05-reporting/{drafts,final},logs/terminal-sessions}
            

2. Understanding Reconnaissance

Reconnaissance ("recon") is the systematic collection of information about a target. It's the intelligence-gathering phase that informs all subsequent testing activities. Professional assessments distinguish between passive and active reconnaissance based on detection risk and authorization requirements.

Passive vs. Active Reconnaissance

┌─────────────────────────────────────────────────────────────────┐
│                RECONNAISSANCE SPECTRUM                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  PASSIVE                                      ACTIVE            │
│  ──────────────────────────────────────────────────────────     │
│  No direct target       │        │        Direct target         │
│  interaction            │        │        interaction           │
│                         │        │                              │
│  • Public records       │        │    • Port scanning           │
│  • Search engines       │        │    • Service probing         │
│  • Social media         │        │    • Directory brute-force   │
│  • Job postings         │        │    • Banner grabbing         │
│  • DNS records          │        │    • Vulnerability scanning  │
│  • Certificate logs     │        │                              │
│  • Code repositories    │        │                              │
│                         │        │                              │
│  DETECTION RISK: None   │        │    DETECTION RISK: High      │
│  AUTHORIZATION: Minimal │        │    AUTHORIZATION: Required   │
│                         │        │                              │
└─────────────────────────────────────────────────────────────────┘
            

3. Passive Reconnaissance Techniques

Passive reconnaissance leverages publicly available information to build understanding of the target without any direct interaction. For NovaTech, we'll gather intelligence from multiple sources.

3.1 WHOIS and Domain Information

WHOIS records reveal domain registration details including registrant information, nameservers, and registration dates. While privacy protection has reduced the information available, WHOIS still provides valuable context.

# Query WHOIS for primary domain
whois novatech-solutions.com

# Key information to extract:
# - Registrar (may indicate company size/sophistication)
# - Name servers (identify DNS providers)
# - Creation date (company age)
# - Registrant organization (verify correct target)
# - Admin/Tech contacts (if not privacy-protected)
            

Domain Name: NOVATECH-SOLUTIONS.COM
Registry Domain ID: 2345678901_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.cloudflare.com
Registrar URL: https://www.cloudflare.com
Updated Date: 2024-03-15T12:00:00Z
Creation Date: 2018-06-22T08:30:00Z
Registrar Registration Expiration Date: 2026-06-22T08:30:00Z
Registrar: Cloudflare, Inc.
Registrant Organization: NovaTech Solutions, Inc.
Registrant State/Province: Texas
Registrant Country: US
Name Server: NS1.CLOUDFLARE.COM
Name Server: NS2.CLOUDFLARE.COM
                

3.2 DNS Enumeration

DNS records reveal infrastructure details: mail servers, subdomains, service providers, and sometimes internal naming conventions.

# Query all DNS record types
dig novatech-solutions.com ANY

# Specific record types
dig novatech-solutions.com A        # IPv4 addresses
dig novatech-solutions.com AAAA     # IPv6 addresses
dig novatech-solutions.com MX       # Mail servers
dig novatech-solutions.com TXT      # Text records (SPF, DKIM, verification)
dig novatech-solutions.com NS       # Name servers
dig novatech-solutions.com CNAME    # Aliases

# Attempt zone transfer (usually blocked, but try)
dig axfr novatech-solutions.com @ns1.cloudflare.com
            

;; ANSWER SECTION:
novatech-solutions.com.    300  IN  A      104.21.45.123
novatech-solutions.com.    300  IN  A      172.67.182.45
novatech-solutions.com.    300  IN  MX     10 aspmx.l.google.com.
novatech-solutions.com.    300  IN  MX     20 alt1.aspmx.l.google.com.
novatech-solutions.com.    300  IN  TXT    "v=spf1 include:_spf.google.com include:sendgrid.net ~all"
novatech-solutions.com.    300  IN  TXT    "google-site-verification=abc123..."
novatech-solutions.com.    300  IN  TXT    "atlassian-domain-verification=xyz789..."
                

3.3 Subdomain Enumeration

Subdomains often reveal internal applications, development environments, APIs, and forgotten services. Multiple techniques combine for comprehensive coverage.

# Using amass for passive subdomain enumeration
amass enum -passive -d novatech-solutions.com -o subdomains.txt

# Using subfinder (alternative tool)
subfinder -d novatech-solutions.com -o subfinder-results.txt

# Certificate Transparency logs (crt.sh)
curl -s "https://crt.sh/?q=%25.novatech-solutions.com&output=json" | \
  jq -r '.[].name_value' | sort -u > crtsh-subdomains.txt

# Combine and deduplicate results
cat subdomains.txt subfinder-results.txt crtsh-subdomains.txt | \
  sort -u > all-subdomains.txt
            

api.novatech-solutions.com
app.novatech-solutions.com
blog.novatech-solutions.com
careers.novatech-solutions.com
dev.novatech-solutions.com
docs.novatech-solutions.com
github.novatech-solutions.com
grafana.novatech-solutions.com
jenkins.novatech-solutions.com
jira.novatech-solutions.com
mail.novatech-solutions.com
portal.novatech-solutions.com
staging.novatech-solutions.com
status.novatech-solutions.com
support.novatech-solutions.com
vpn.novatech-solutions.com
www.novatech-solutions.com
                

3.4 Certificate Transparency

Certificate Transparency (CT) logs record all publicly issued TLS certificates. This reveals subdomains, including those the organization may not want publicly known.

# Query crt.sh for all certificates
# Web interface: https://crt.sh/?q=novatech-solutions.com

# Command line query
curl -s "https://crt.sh/?q=%25.novatech-solutions.com" | \
  grep -oP '(?<=)[^<]+(?=)' | \
  grep novatech-solutions.com | sort -u

# Look for:
# - Wildcard certificates (*.novatech-solutions.com)
# - Internal naming patterns
# - Certificates for unexpected domains
# - Certificate issuers (Let's Encrypt vs commercial CAs)
            

3.5 Search Engine Intelligence (Google Dorking)

Search engines index publicly accessible content. Specialized queries can reveal sensitive information that shouldn't be public.

# Site-specific searches
site:novatech-solutions.com

# Find specific file types
site:novatech-solutions.com filetype:pdf
site:novatech-solutions.com filetype:xlsx
site:novatech-solutions.com filetype:docx
site:novatech-solutions.com filetype:sql
site:novatech-solutions.com filetype:log

# Look for exposed directories
site:novatech-solutions.com intitle:"index of"

# Find login pages
site:novatech-solutions.com inurl:login
site:novatech-solutions.com inurl:admin
site:novatech-solutions.com inurl:portal

# Look for error messages
site:novatech-solutions.com "error" OR "warning" OR "exception"

# Search for configuration exposure
site:novatech-solutions.com "password" OR "pwd" OR "credentials"

# AWS-specific searches
site:novatech-solutions.com "s3.amazonaws.com"
site:novatech-solutions.com "amazonaws.com"
            

3.6 GitHub and Code Repository Search

Developers sometimes commit sensitive information to public repositories. Search GitHub for organization names, domain names, and potential credential exposures.

# GitHub search queries (use github.com search or gh CLI)

# Organization and domain references
"novatech-solutions.com"
"novatech" password
"novatech" api_key
"novatech" secret

# AWS-specific leaks
"novatech" AKIA          # AWS access key ID prefix
"novatech" aws_secret

# Common credential patterns
"novatech-solutions.com" password
filename:.env novatech
filename:config novatech password

# Look for the organization's own repositories
org:novatech-solutions
            

3.7 Job Postings and Social Media

Job postings reveal technology stack, organizational structure, and sometimes security maturity. LinkedIn provides employee information and organizational insights.

Senior DevOps Engineer - NovaTech Solutions
Requirements:
- 5+ years experience with AWS (EC2, EKS, RDS, Lambda)
- Strong Kubernetes and Docker experience
- Terraform for infrastructure as code
- Experience with Jenkins CI/CD pipelines
- Familiarity with Datadog or similar monitoring
- Python and Bash scripting
                

3.8 Shodan and Censys

Internet scanning services like Shodan and Censys continuously scan the internet and index exposed services. Query these for target IP ranges to discover exposed services without conducting your own scans.

# Shodan queries (requires free account for full results)
# Web: https://www.shodan.io/

# Search by organization name
org:"NovaTech Solutions"

# Search by domain
hostname:novatech-solutions.com

# Search by SSL certificate
ssl.cert.subject.cn:novatech-solutions.com

# Censys queries (requires free account)
# Web: https://search.censys.io/

# Search by domain
services.tls.certificates.leaf_data.subject.common_name: novatech-solutions.com
            

IP: 52.23.xxx.xxx
Hostnames: vpn.novatech-solutions.com
Port: 443
Product: OpenVPN Access Server
Version: 2.11.1

IP: 54.85.xxx.xxx  
Hostnames: jenkins.novatech-solutions.com
Port: 8080
Product: Jetty
HTTP Title: Dashboard [Jenkins]

IP: 34.201.xxx.xxx
Hostnames: grafana.novatech-solutions.com
Port: 3000
Product: Grafana
Version: 9.3.2
                

4. Active Reconnaissance Techniques

With the engagement charter signed, you're authorized to interact directly with NovaTech's systems. Active reconnaissance confirms passive findings and discovers details only visible through direct interaction.

4.1 DNS Zone Enumeration

While zone transfers are typically blocked, active DNS probing can reveal additional records and verify passive findings.

# Attempt zone transfer (document if it works—significant finding)
dig axfr novatech-solutions.com @ns1.cloudflare.com

# DNS brute-forcing with wordlist
# Note: This generates queries to target DNS servers
dnsrecon -d novatech-solutions.com -t brt -D /usr/share/wordlists/subdomains.txt

# Verify discovered subdomains resolve
while read subdomain; do
  host "$subdomain" && echo "$subdomain resolves"
done < all-subdomains.txt
            

4.2 Port Scanning

Port scanning identifies running services on target systems. Different scan types balance speed, accuracy, and detection risk.

# First, resolve target hosts to IPs
host app.novatech-solutions.com
host api.novatech-solutions.com
host vpn.novatech-solutions.com

# Save in-scope IPs to file
echo "52.23.xxx.xxx" >> targets.txt
echo "54.85.xxx.xxx" >> targets.txt
# ... add all in-scope IPs

# Initial discovery scan (fast, common ports)
nmap -sS -T4 --top-ports 1000 -oA initial-scan targets.txt

# Comprehensive scan (all ports, slower)
nmap -sS -p- -T3 -oA full-port-scan targets.txt

# Service version detection (after identifying open ports)
nmap -sV -sC -p 22,80,443,8080 -oA service-scan targets.txt

# UDP scan (selected ports, slow)
nmap -sU --top-ports 100 -oA udp-scan targets.txt
            

Nmap scan report for jenkins.novatech-solutions.com (54.85.xxx.xxx)
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 8.2p1 Ubuntu
80/tcp   open  http       nginx 1.18.0
443/tcp  open  ssl/http   nginx 1.18.0
8080/tcp open  http       Jetty 9.4.z
|_http-title: Dashboard [Jenkins]
|_http-server-header: Jetty(9.4.43.v20210629)

Nmap scan report for vpn.novatech-solutions.com (52.23.xxx.xxx)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.4p1
443/tcp open  ssl/http OpenVPN Access Server
943/tcp open  http     OpenVPN Access Server admin portal
                

4.3 Service Enumeration

Once ports are identified, deeper enumeration reveals service configurations, versions, and potential vulnerabilities.

# Web server enumeration
whatweb https://app.novatech-solutions.com
nikto -h https://app.novatech-solutions.com -o nikto-app.txt

# SSL/TLS analysis
sslscan https://app.novatech-solutions.com
testssl.sh https://app.novatech-solutions.com

# HTTP methods and headers
curl -I https://app.novatech-solutions.com
curl -X OPTIONS https://app.novatech-solutions.com -i

# Directory enumeration (careful with rate limiting)
gobuster dir -u https://app.novatech-solutions.com \
  -w /usr/share/wordlists/dirb/common.txt \
  -t 10 -o gobuster-app.txt

# Technology fingerprinting
wappalyzer https://app.novatech-solutions.com  # Browser extension
# Or use builtwith.com for passive fingerprinting
            

4.4 Web Application Reconnaissance

For WorkflowPro (app.workflowpro.io), gather application-specific intelligence:

# Crawl application to discover endpoints
# Using Burp Suite (configure browser proxy first):
# 1. Set browser proxy to 127.0.0.1:8080
# 2. Browse application manually
# 3. Review Site Map in Burp

# Automated crawling with gospider
gospider -s https://app.workflowpro.io -d 2 -o crawl-output

# JavaScript file analysis (reveals API endpoints)
# Download and analyze JS files referenced in HTML
curl https://app.workflowpro.io | grep -oP 'src="[^"]+\.js"'
# Review each JS file for API endpoints, hardcoded values

# API endpoint discovery
# Check for common paths
curl https://app.workflowpro.io/api/
curl https://app.workflowpro.io/api/v1/
curl https://app.workflowpro.io/graphql
curl https://app.workflowpro.io/swagger.json
curl https://app.workflowpro.io/api-docs
            

5. Documenting the Attack Surface

Reconnaissance generates substantial data. Professional documentation transforms raw findings into actionable intelligence. Your attack surface map becomes a reference document for the entire engagement.

Attack Surface Map Structure

┌─────────────────────────────────────────────────────────────────┐
│                    ATTACK SURFACE MAP                           │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  1. EXTERNAL PERIMETER                                          │
│     ├── Domains and subdomains                                  │
│     ├── IP ranges                                               │
│     ├── Exposed services by port                                │
│     └── Technology fingerprints                                 │
│                                                                 │
│  2. WEB APPLICATIONS                                            │
│     ├── Application inventory                                   │
│     ├── Authentication mechanisms                               │
│     ├── API endpoints discovered                                │
│     └── Technology stack per application                        │
│                                                                 │
│  3. CLOUD INFRASTRUCTURE                                        │
│     ├── Cloud provider(s) identified                            │
│     ├── Services enumerated                                     │
│     ├── Storage endpoints                                       │
│     └── CDN and edge services                                   │
│                                                                 │
│  4. THIRD-PARTY SERVICES                                        │
│     ├── SaaS applications identified                            │
│     ├── Integration points                                      │
│     └── SSO/federation relationships                            │
│                                                                 │
│  5. HUMAN FACTORS                                               │
│     ├── Key personnel identified                                │
│     ├── Email formats discovered                                │
│     └── Organizational structure                                │
│                                                                 │
│  6. INTELLIGENCE NOTES                                          │
│     ├── Potential vulnerabilities (version-based)               │
│     ├── Misconfigurations observed                              │
│     ├── High-value targets for testing                          │
│     └── Questions for client clarification                      │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘
            

Documentation Best Practices

Sample Attack Surface Entry

## Subdomain: jenkins.novatech-solutions.com

### Basic Information
- IP Address: 54.85.xxx.xxx
- First Discovered: 2025-01-15 via CT logs (passive)
- Verified: 2025-01-16 via nmap scan (active)
- Cloud Provider: AWS (us-east-1 based on IP range)

### Services
| Port | Service | Version | Notes |
|------|---------|---------|-------|
| 22   | SSH     | OpenSSH 8.2p1 Ubuntu | Standard config |
| 80   | HTTP    | nginx 1.18.0 | Redirects to 443 |
| 443  | HTTPS   | nginx 1.18.0 | Valid cert, expires 2025-08 |
| 8080 | HTTP    | Jetty 9.4.43 | Jenkins dashboard |

### Technology Stack
- Operating System: Ubuntu (inferred from SSH banner)
- Web Server: nginx 1.18.0 (reverse proxy)
- Application: Jenkins (version TBD)
- Java Runtime: Jetty 9.4.43

### Security Observations
- Jenkins accessible without VPN (external exposure)
- No apparent IP restriction
- Login page publicly accessible
- Version disclosure in HTTP headers

### Testing Priority: HIGH
- CI/CD systems are high-value targets
- May contain credentials, code, deployment access
- Check for CVEs affecting Jenkins version
- Test for default credentials, authentication bypass

### Screenshots
- [jenkins-login-page.png](./screenshots/jenkins-login-page.png)

### Raw Data Files
- [nmap-jenkins.xml](./nmap/jenkins-scan.xml)
- [nikto-jenkins.txt](./web-scans/nikto-jenkins.txt)
                

6. NovaTech Attack Surface Summary

Based on reconnaissance conducted for this capstone scenario, here's a summary of NovaTech's attack surface. Your lab will involve creating this documentation yourself through actual reconnaissance exercises.

🎯 Hands-On Capstone Activities

Build your reconnaissance toolkit and conduct professional OSINT for the capstone engagement.

💡 Capstone Strategy: Document your recon methodology—show your process, not just results. This demonstrates professional thinking to employers.