Skip to main content
Log in

Reconnaissance, OSINT & Vulnerability Assessment

Learn to gather intelligence passively and actively, enumerate hosts and services with Nmap, and turn raw scanner output into a prioritised, evidence-based list of vulnerabilities. This is the discovery half of every authorised penetration test and of government vulnerability-management programmes.

Ethical Hacking & Penetration Testing
Level
Intermediate
Study time
8 hours
Lessons
6
Practice labs
4
Assessments
2
Format
Self-paced, online

What you will learn

By the end of this course you will be able to:

  • Distinguish passive from active reconnaissance and justify which is permitted by a given scope
  • Collect and interpret DNS, certificate-transparency, WHOIS and public-document intelligence for an organisation, within ethical limits
  • Run and interpret Nmap host discovery, port, service-version and basic NSE scans against authorised targets
  • Explain CVE, CVSS bands and false positives, and recognise a banner-only false positive
  • Prioritise scanner findings using exposure, exploitability and asset criticality rather than CVSS alone
  • Write remediation-oriented summaries of a vulnerability assessment

Before you start

Foundations path: networking basics (TCP/IP, DNS), Linux command line, basic security concepts

Tools you will use

  • Nmap
  • whois
  • dig
  • Nessus / OpenVAS (concepts)
  • crt.sh (certificate transparency)

Course outline

6 lessons in 2 modules.

Module 1: Reconnaissance and OSINT

  • Passive vs active reconnaissance
  • OSINT: DNS, certificates and public records

Module 2: Scanning and vulnerability assessment

  • Host, port and service discovery with Nmap
  • Nmap Scripting Engine and reading scan output
  • Vulnerability scanning: CVE, CVSS and false positives
  • Prioritising and reporting scan results

Practice labs and assessments

Labs run in the browser as simulations. They never touch a real system.

4 practice labs

  • DNS and WHOIS reconnaissance Beginner, 25 min
  • OSINT exposure review of a fictional organisation Beginner, 30 min
  • Nmap discovery against an authorised range Intermediate, 35 min
  • Prioritise the scan report Advanced, 45 min, final lab

2 assessments

  • Reconnaissance and scanning: knowledge check
  • Reconnaissance, OSINT and vulnerability assessment: final quiz

The pass mark is 70%. You can retake an assessment.

Take Reconnaissance, OSINT & Vulnerability Assessment

Request access and your instructor will set up your account.

Log in