Script Modification for Recon

What it is

Testers often start from an existing script and change it to fit the job: new targets, a different port, another output format. The exam does not ask you to write large programs. It asks you to read a short script in Bash, Python or PowerShell, understand its logic and spot what to change.

This is a code reading skill. Always test a modified script on a lab or a single in-scope host first.

How it works

Core building blocks

Every language in scope uses the same ideas.

Common data structures are the list (an ordered set of items), the dictionary (named key and value pairs), and the array. Data is often exchanged as JavaScript Object Notation (JSON) or comma-separated values (CSV).

Operators

Scripts combine and compare values with operators, and the three languages use slightly different syntax.

For example, Bash uses && for and, Python uses the word and, and PowerShell uses -and. A combined condition might act only when a port is open and the host is in scope.

Bash example

Bash is the shell on most Linux systems. This harmless loop checks a short list of in-scope hosts with ping.

#!/bin/bash
# Linux shell: check whether listed hosts answer one ping
while read -r host; do
  if ping -c 1 -W 1 "$host" > /dev/null 2>&1; then
    echo "$host is up"
  else
    echo "$host did not answer"
  fi
done < hosts.txt

The while read loop takes one host per line from hosts.txt. The if tests the result of ping, and > /dev/null hides its normal output. To adapt it, you could change the input file, the wait time -W, or write results to a file with >>.

Python example

Python is popular for tools because of its libraries. This script reads a JSON file of hosts and tries one TCP connection to each.

# Python 3: check whether a TCP port accepts connections
import json
import socket

with open("targets.json") as f:
    targets = json.load(f)       # e.g. {"hosts": ["192.0.2.10"], "port": 443}

for host in targets["hosts"]:
    try:
        with socket.create_connection((host, targets["port"]), timeout=2):
            print(host, "port open")
    except OSError:
        print(host, "no connection")

Here import loads libraries, a dictionary holds the settings, and try and except handle failures so one dead host does not stop the loop. Changing the port or the timeout means editing the JSON file or the timeout value.

PowerShell example

PowerShell is the Windows automation shell, and it works with objects rather than plain text. The cmdlet Test-NetConnection checks a port.

PowerShell:
Get-Content .\hosts.txt | ForEach-Object {
    Test-NetConnection -ComputerName $_ -Port 445 -WarningAction SilentlyContinue |
        Select-Object ComputerName, TcpTestSucceeded
}

The pipe sends each line of the file to the loop, and $_ stands for the current item. The output is a small table showing whether the connection worked.

What to check before running a modified script

• Does it only touch addresses from the approved scope?
• How many requests per second will it send, and is there a delay?
• Does it write credentials or sensitive data to a file or the screen?
• What happens when a target does not respond (error handling)?
• Does it need administrator rights, and what could it change?