Reconnaissance and Footprinting

Prerequisites: A Linux environment (native, VM, or WSL) with a terminal; comfort installing packages with apt/brew; no prior offensive security experience needed.

Targeted versions: Verified against nmap.org (Nmap 7.99, released 2026-03-26, is the current stable release) and the OWASP Web Security Testing Guide's reconnaissance chapter (WSTG stable is v4.2; v5.0 is in active development — this project uses only test IDs and techniques stable since v4.2).

⚠ Authorization note: scanme.nmap.org is named directly in Nmap's own documentation as a host the project maintains specifically so people can test the tool without needing individual permission — it is the only host in this project you may scan without first getting your own written authorization. Every other example in this project uses local, learner-controlled resources. This distinction matters for every remaining project in this roadmap too: never point any tool you learn here at a system you don't own or don't have explicit written permission to test.

Every real engagement starts the same way, regardless of what comes after it: you learn as much as you can about the target before you send it a single crafted packet. Reconnaissance splits into two modes that matter for very different reasons. Passive recon (WHOIS, DNS records, certificate transparency logs, search engine artifacts) never touches the target directly — you're only querying third-party records about it, which is why it's safe to practice against almost any public domain. Active recon (port scanning, service fingerprinting) does touch the target, which is exactly why it requires the authorization scanme.nmap.org gives you by design. This project builds both skill sets and ends with a script that turns raw tool output into an organized report — the format every later project in this roadmap will keep producing evidence for.