Lion Cipher Lab
Build a repeatable enumeration methodology for your OWN lab — the same checklist every time, and the traces it leaves a defender
- Penetration Testing / Red Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The difference between someone who has done twenty technique labs and someone who can actually assess a box is method. Given a fresh IP, a beginner improvises — runs whatever tool comes to mind, forgets to check UDP, never writes anything down, and later cannot reconstruct what they tested. A professional runs the same disciplined loop every time: find the host, find the ports, identify the services, then go deep per service, recording evidence as they go. That repeatability is what makes findings trustworthy and reports possible. This lab builds that loop as a checklist and a script you…
What you'll learn
- designing a repeatable four-phase enumeration workflow
- the two-stage Nmap pattern (fast all-ports, then targeted -sCV)
- branching enumeration by service instead of improvising
- keeping timestamped, engagement-grade notes and evidence
- seeing your own scans from the defender's side (ATT&CK, IDS, Sysmon)
- scoping and authorization discipline before any scan
Steps in this lab
- Why a methodology beats improvising
- First item on the checklist: scope and authorization
- Set up the workspace and the note template
- Phase 1 — is the host even up?
- Phase 2 — find every open port fast (stage one of two)
- Phase 3 — identify the services (stage two, aimed only at open ports)
- Phase 4 — branch by service, don't improvise
- The web branch in depth: fingerprint, then discover content
- Make it repeatable: wrap stages one and two in a script
- Now switch chairs: what did all that look like to a defender?
- Build the detection: catch your own scan with Suricata
- Host-side traces: the same scan on a Windows target
- When NOT to do this, and the traps that make enumeration lie to you
- Turn the run into a reusable checklist you keep
- What you built and where it goes next