Every security test starts with information. Before you try anything against a target, you learn what exists: which domains, which people, which systems, and which services are running. The better your picture, the more focused and effective the rest of the test will be.
You'll begin with passive reconnaissance, gathering public information without touching the target, using OSINT sources, Google dorking, and tools like theHarvester. Then you'll move to active scanning with Nmap, which discovers live hosts, open ports, and the services behind them.
Passive recon is quiet, but scanning is detectable and can be illegal without permission. Only scan systems you own or have written authorisation to test, such as your own lab. Next up is Web Application Security, where you'll look for weaknesses in the websites and apps you've just mapped out.
An introduction to passive information gathering with OSINT tools such as Shodan and Netcraft, the first step of any security assessment.
A step-by-step lab using Google dorks, the Google Hacking Database, and the Wayback Machine to find public information about a target.
A hands-on introduction to Nmap: discovering hosts, scanning ports, and identifying services and potential weaknesses on a network.