Purple Edge
Get started

Reconnaissance & OSINT

intermediate5 labsSubscription

Build the full recon kill-chain: passive OSINT, active host discovery, Nmap service scanning, web/DNS enumeration, and turning findings into a vulnerability picture.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    beginner Hands-on lab Subscription

    Passive Recon & OSINT

    Gather a target's footprint without touching it: WHOIS, DNS records, certificate transparency, Google dorks, and document metadata.

    35 min3 tasksReconnaissance
  2. 2
    beginner Hands-on lab Subscription

    Active Host Discovery

    Find which hosts are actually alive using ICMP, ARP, and TCP ping sweeps with Nmap's host-discovery (-sn) mode.

    30 min2 tasksReconnaissance
  3. 3
    intermediate Hands-on lab Subscription

    Port & Service Scanning with Nmap

    Enumerate open ports and fingerprint the services behind them: TCP connect vs SYN scans, UDP, version detection, and default NSE scripts.

    40 min3 tasksReconnaissance
  4. 4
    intermediate Hands-on lab Subscription

    Web & DNS Enumeration

    Brute-force directories, virtual hosts, and subdomains with gobuster and ffuf, and pull DNS apart with dig, dnsenum, and zone transfers.

    40 min3 tasksReconnaissance
  5. 5
    intermediate Hands-on lab Subscription

    Vulnerability Identification

    Turn the service versions you fingerprinted into concrete CVEs and confirm them with nmap --script vuln and OpenVAS.

    40 min2 tasksReconnaissance

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-06-15