Read Your First Scan

You ran the tools. Now work out what actually matters.

Running the tools is the easy part. The skill that separates a scan from an assessment is reading the output — knowing which of forty live hosts deserves your attention in the next ten minutes, and which is noise. This exercise gives you real-shaped output from a standard passive-to-active pipeline against a fictional company and asks you to triage it. The evidence stays on screen while you answer.

Fictional training scenario. Northwind Logistics is an invented company and all output below is synthetic, written to be realistic rather than captured from a real target.

Your brief

You have authorization to assess northwind.example. You've run passive subdomain discovery, probed for live web services, and port-scanned the hosts that responded. Nothing has been exploited and nothing has been reported yet. Read the three outputs and decide what matters.

$ subfinder -d northwind.example -silent

www.northwind.example
api.northwind.example
mail.northwind.example
cdn.northwind.example
shop.northwind.example
blog.northwind.example
staging-payments.northwind.example
vpn.northwind.example
autodiscover.northwind.example
docs.northwind.example
jenkins-old.northwind.example
support.northwind.example

Triage decisions5 questions · 70% to pass

1. Which host should you look at first?

Select one. · Evidence: ,

2. Which findings here are genuinely concerning? Select all that apply.

Select all that apply. · Evidence: ,

3. subfinder returned autodiscover.northwind.example, but it never appears in the httpx output. What does that tell you?

Select one. · Evidence: ,

4. What is the right next action for jenkins-old.northwind.example?

Select one. · Evidence: ,

5. Which discovery technique would most likely have found staging-payments before an attacker did?

Select one. · Evidence:

0/5 answered

Defensive lessons

1Triage on exposure × severity × business context, not on tool output order. A debug payments service with an exposed database outranks a current-version WordPress every time.
2A 401 is a control working. Learn to tell findings from evidence of correct configuration, or you'll drown your remediation queue in noise and lose credibility.
3Absence from one tool's output is not absence. Web probes only see web services; cross-reference DNS, port scans, and certificate data before dropping a host from scope.
4Development servers and debug builds in production are findings in their own right, independent of any CVE. They expose stack traces, environment variables, and sometimes interactive consoles.
5'old', 'staging', 'test', and 'legacy' in a hostname mean nobody owns it. Unowned means unpatched and unmonitored — treat those names as a priority signal.
6Discovery must be continuous, not inventory-based. The riskiest asset in this exercise is the one that was never on anyone's list, and only passive continuous monitoring would have caught it early.
7Stay inside your authorization. Confirming that a dashboard loads is discovery; trying credentials is intrusion. The line matters legally and professionally, and it is yours to hold.