Case Study: Automated, Scope-Safe Reconnaissance Engine

Project: [REDACTED_ID] Stage 5 (Ethical Hacking / VAPT Track)
Role: Penetration Tester / Tool Developer
Technologies: Python 3, Pytest, JSON/CSV

Executive Summary

As part of the Ubuntu Bridge Initiative (UBI) performance assessment, I engineered a highly reliable, scope-safe reconnaissance engine in Python. The tool is designed to automate the initial discovery phase of a penetration test while enforcing strict rules of engagement (RoE), ensuring that zero packets are sent to out-of-scope or decoy targets.

Objectives

• Implement automated HTTP and signal line-protocol discovery.
• Handle DNS/wildcard resolution, TLS/SNI probing, and virtual-host enumeration.
• Implement robust concurrency, rate limiting, and state resumption to avoid detection and handle network instability.
• Ensure 100% compliance with a provided scope register, avoiding decoy endpoints.

Technical Implementation

Scope Enforcement Mechanism

The core feature of this engine is its strict scope discipline. Before any network socket is opened, the target IP, hostname, and port are validated against scope-register.csv.

• Global Out-of-Scope Rule: 0.0.0.0/0 (Default deny)
• Any attempt to probe an unauthorized target (e.g., the assigned 127.0.0.1:26182 decoy) is immediately dropped at the application layer.

Discovery & Fingerprinting

The engine performs service scanning and fingerprinting to identify the runtime profile of hidden service chains. It outputs the normalized data to a JSON report and maintains a chronological request-ledger.csv for audit and reconciliation purposes.

Results & Impact

• Zero Scope Violations: Successfully dropped all traffic to decoy targets, generating zero out-of-scope packets.
• Flag Capture: Utilized the engine's normalized output to successfully uncover the target service chain and extract the private user.txt foothold flag.
• Audit-Ready: The chronological request ledger provided exact proof of execution, satisfying the rigorous compliance requirements of the UBI assessment.

Usage & Execution

1. Run the Recon Engine

Execute discovery against authorized targets using the provided scope register:

python3 -m recon_engine.recon-engine --target 127.0.0.1 --scope scope-register.csv --output .

2. Run Test Suite

Execute the unit and integration tests to verify scope enforcement mechanisms:

python3 -m pytest --junitxml=test-results.xml tests/

---

This project demonstrates my ability to build custom offensive security tooling that strictly adheres to professional ROE and compliance requirements.