LEARN. PRACTICE. GROW.Concept and mechanism
Reconnaissance gathers information that needs context. A certificate-transparency entry can identify a historical hostname without proving its service remains active. A CNAME expresses an alias relationship rather than common ownership, confirmed takeover, or authorization to test the destination. robots.txt guides crawlers; it neither implements access control nor grants test consent. During enumeration, distinguish observation from inference: an open port indicates a service accepting connections in that context, but its number does not guarantee the application protocol. Service and version detection adds evidence subject to configuration, responses, and method limitations.
Guided application
In a fictional lab, Nmap reports a UDP port as open|filtered. The result retains uncertainty between an open service and filtering; it should not be converted into a confirmed vulnerability. A closed port and a filtered port also have different meanings. Record method, source, and interval to support later comparison. When preparing target lists, use network membership instead of string prefixes. In Python, ip_address("10.70.40.25") is not in ip_network("10.70.4.0/24"), despite similar string beginnings. This exercise is local and sends no network requests. Actual validation must also consider exclusions, IPv6, resolution, and address changes. Keep a clear relationship between discovered leads, completed confirmation, and tests still awaiting authorization.
10.70.4.25 belongs to the supplied /24; 10.70.40.25 is outside.
Common pitfalls
Port as protocol; filtered as open; CT as current availability; string comparison as CIDR; robots as ACL.
Related topics: Scope, communication, and evidence · Discovery, coverage, and validation · Web and API flaws and remediation
Preserve the uncertainty the tool actually reports.
Reference: Nmap port states · PT0-003 / PenTest+ V3; objectives 3.0; launched 2024-12-17