Recon and mapping the target
Before a single payload: find the hosts, name the technology, read what the site hands out for free, and map the attack surface. Where every real engagement, and every exam, actually starts.
- By
- PentestingHere
- Lessons
- 7
- Length
- 170 min
- Published
- 13 Sep 2026
What this path is
You finished Foundations, so you can read a request, send one, and spot a control that only lives in the browser. This path is the step every real tester takes before any of that: looking at an unfamiliar target and building a map of it. Which hosts exist, what software runs them, what the site quietly hands out, what is hidden, and where the soft spots are, all before you send a single payload.
Recon is the least glamorous part of the job and the part that most often decides whether you find anything. A tester who maps well finds bugs on hosts nobody remembered building. A tester who skips straight to "try SQL injection on the login" tests one form on one server and calls it a day.
Who it is for
- Anyone who has done Foundations and wants to know what to actually do first when handed a target.
- Someone preparing for an entry-level web-application penetration testing exam. This path covers the recon and analysis skills those exams test, built on the public OWASP Web Security Testing Guide. It is not affiliated with or endorsed by any exam vendor, and uses none of their material.
The plan
- Why recon comes first. The map is the work, and it is a loop, not a checkbox.
- Passive reconnaissance and OSINT. Learn a lot without the target ever noticing.
- Domains, subdomains, and the IP space. One name is a doorway; the org is a neighbourhood.
- What the site hands out for free. robots.txt, sitemaps, headers, comments, metafiles.
- Fingerprinting the stack. Name the server, framework and versions from their tells.
- Content discovery. The routes nobody linked are where the bugs hide.
- HTTP methods and how they surprise you. GET and POST are not the whole verb set.
Before you start
You need what Foundations gave you: a browser with developer tools, and a terminal with curl. A few lessons name tools like subfinder, ffuf, httpx and whatweb; you do not need them installed to follow along, and every idea is shown with curl or the browser first. One rule runs through the whole path and gets its own lesson later: active recon touches someone else's server, so you only do it where you are allowed to.