Project 95: Reconnaissance Automation

Module: Module 10: Advanced Detection Engineering & Zero-Day Research  |  Level: Advanced  | 
Primary tool: Python + Nmap’s XML output parsing  |  Estimated time: 2–4 hours

Objective: Script a repeatable recon pipeline instead of running tools manually every time.

Free lab environment

scanme.nmap.org + TryHackMe (free tier) — https://scanme.nmap.org/ and https://tryhackme.com/room/introtonetworking

scanme.nmap.org is the Nmap Project’s own public host, explicitly maintained for learners to scan legally, so long as you scan lightly and do not run intrusive options like heavy vulnerability scripts or denial-of-service tests against it. For anything more thorough, create a free TryHackMe account and deploy the room’s disposable target machine instead.

Lab workflow

1. Write a one-paragraph scope note: your target is scanme.nmap.org or your own lab network, your tool is Python + Nmap’s XML output parsing, and your goal is to script a repeatable recon pipeline instead of running tools manually every time.
2. Confirm authorization: re-read the lab platform’s terms and this project’s Safety section before sending a single packet.
3. Run your baseline Python + Nmap’s XML output parsing command against the target and save the raw output to a text file before you interpret anything.
4. Interpret the output: for every result, write one sentence on what it tells a defender, not just what it tells an attacker.
5. Re-run the same command a second time and compare results — note anything that changed, since real infrastructure is not static.
6. Package your findings into the report format described under Expected Deliverable below.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your script’s source code
• its parsed, human-readable summary output from a live scan

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.