Back to case studies
Beginner45 min - 1 h
Reconnaissance of a target company
Map Veltara Logistics’ exposure using open sources only, the way an attacker would before a campaign.
Briefing
Veltara Logistics, an 800-employee carrier, has hired your team for an external attack surface audit (signed contract, scope: veltara-logistics.example). Your job: find out what an attacker can learn without ever touching the company’s systems. No active scanning is allowed at this stage: passive sources only (Certificate Transparency logs, public DNS, engines like Shodan, social networks, job ads).
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Enumerate subdomains through Certificate Transparency
- Identify email providers from DNS
- Work out the email address format
- Spot exposed services to prioritize
- Use job ads as a technical source
Tools used in real investigations
crt.shdig / DNSDumpsterShodanHunter.ioLinkedIntheHarvester
100% Free
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.