Back to All Modules

01 - Pre-Foothold Operations

#Overview

Pre-foothold work turns an approved scope into a defensible attack-surface map before any attempt to gain access. This module is an operational hub: it provides repeatable workspace conventions and paste-ready discovery scripts, then links into the deeper reconnaissance, enumeration, vulnerability-assessment, and exploitation references.

#Workflow

Rules of engagement
        |
        v
Normalize scope --> passive asset discovery --> DNS resolution
        |                                      |
        v                                      v
Network discovery --> TCP/UDP scanning --> service fingerprinting
        |                                      |
        +--> web surface mapping               +--> printer assessment
        |
        +--> wireless survey / 802.1X inventory
        |
        v
Evidence normalization --> vulnerability assessment --> operator-selected validation
TEXT

#Pages

PagePurpose
Scope and WorkspaceScope files, exclusions, output layout, logging, rate limits, and evidence handling
External Asset DiscoveryAmass, Subfinder, certificate transparency, permutations, DNS resolution, takeover screening, and HTTP probing
Network and Service ScanningHost discovery, TCP/UDP scans, service detection, NSE validation, and XML parsing
Web Surface DiscoveryVirtual hosts, crawling, directories, TLS, screenshots, and technology inventory
Printer Discovery and AssessmentSNMP, IPP, PJL, SMB printing, web consoles, firmware evidence, and non-destructive checks
Wireless and 802.1X AssessmentPassive Wi-Fi survey, WPA/WPA2 evidence, WPS, PMKID review, rogue AP analysis, and enterprise EAP inventory
Windows Discovery with PowerShellNative Windows network, DNS, HTTP, printer, and wireless discovery

#Guardrails Used by Every Script

  1. Scope is supplied explicitly; no script invents adjacent targets.
  2. Output is written below a timestamped engagement directory.
  3. Missing tools are reported and skipped instead of being installed automatically.
  4. Active checks use bounded rates and conservative timeouts.
  5. Destructive, disruptive, credential-spraying, persistence, and payload actions are excluded.
  6. Raw evidence is preserved beside normalized summaries.

#Related Deep Dives