Purple Edge
Get started

Reconnaissance and OSINT

beginner4 labsSubscription

Map a target from nothing: passive OSINT, DNS and subdomain enumeration, active service discovery, and a prioritised attack-surface capstone.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    beginner Hands-on lab Subscription

    Passive Recon and OSINT

    Build a picture of a target from public sources alone, without sending a single packet to their infrastructure.

    40 min3 tasksReconnaissance
  2. 2
    intermediate Hands-on lab Subscription

    DNS and Subdomain Enumeration

    Map an organisation's external footprint by discovering its subdomains and DNS records.

    40 min3 tasksReconnaissance
  3. 3
    intermediate Hands-on lab Subscription

    Active Service Discovery

    Scan discovered hosts to find live services, versions, and the ones worth attacking.

    45 min3 tasksReconnaissance
  4. 4
    intermediate Hands-on lab Subscription

    Capstone: Map the Attack Surface

    Combine passive and active recon into a single prioritised attack-surface map of an organisation.

    70 min3 tasksReconnaissance

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-09-01