12/01/2026
Headline: Day 2: Digital Footprinting & The Power of "Passive" Observation 🔍👣
If Day 1 was about building the weapons, Day 2 was about choosing the target. In the world of Ethical Hacking, 70% of the work happens before you ever send a single "attack" packet.
Today was all about Reconnaissance.
🌐 The Art of OSINT (Open Source Intelligence)
I explored how much information a company leaks without even realizing it. Using tools like theHarvester and shodan.io, I practiced gathering:
Subdomains and hidden IP blocks.
Email patterns and employee profiles (crucial for social engineering).
Publicly exposed IoT devices and server banners.
🕵️♂️ Active Recon: Poking the Perimeter
Once the "passive" research was done, I moved into my lab to practice Active Scanning using Nmap. This is where the "noise" starts. I focused on:
Service Version Detection (-sV): Identifying exactly what software is running on a port (e.g., Is that an old, vulnerable version of Apache?).
OS Fingerprinting (-O): Guessing the target's operating system based on how it responds to TCP/IP packets.
Stealth Scanning (-sS): Learning how to scan without completing a 3-way handshake to stay under the radar of basic Firewalls/IDPs.
💡 The Key Realization
Recon isn't just a checklist; it's a puzzle. One leaked "README" file or an open port on a forgotten dev server is often the only "in" a hacker needs.
Current Progress:
Successfully mapped the attack surface of my Metasploitable VM. I’ve identified several "low-hanging fruit" services that look suspiciously outdated...
Next Up: Vulnerability Assessment. It’s time to find the cracks in the armor. 🛠️
