CyberSecurity Deep Dive
by Sergey Okinchuk
TLS Inspection and ProxiesReconnaissance and OSINT

Chapter Five · The Intruder's Campaign

Reconnaissance and the Attack Lifecycle

The intruder's campaign against Meridian begins. This chapter walks the attacker's path — recon, scanning, initial access, exploitation, and lateral movement — entirely through a defender's eyes and against Meridian's own lab, so you understand each move well enough to detect and block it in Chapters 10 and 11. Every command is authorized.

5 topics

To defend against an attacker you have to understand how they actually work — not the movie version, but the patient, staged campaign a real intrusion is. This chapter follows the intruder from knowing nothing about Meridian to standing on its network reaching for the customer database, naming every stage and, at each one, the control or detection that breaks the chain.

Everything here is offense taught through a defender's eyes. Each command is run against Meridian's own lab or a sanctioned target, never a system you do not own — the point is not to attack, but to see the attack coming. Five topics: reconnaissance and OSINT, scanning and enumeration, initial access, exploitation basics, and post-exploitation and lateral movement.

The intruder's path against Meridian — each stage a chance to break the chain
1
Recon
OSINT · scanning · enumeration
2
Initial access
the foothold
3
Exploitation
vuln → control
4
Post-exploitation
persist · harvest · move

Topics in This Chapter

Topic 25
Reconnaissance and OSINT
Before touching a target, an attacker learns everything reachable without touching it — employees, tech, subdomains, leaked credentials. Much of it no IDS will ever see. Run it against yourself first.
Recon
Topic 26
Scanning and Enumeration
Active recon turns "what exists" into "what's exploitable" — which hosts, which ports, which versions. nmap is the tool, and reading its output is a core defender skill: it's exactly what the attacker sees.
Scanning
Topic 27
Initial Access
The moment an attacker crosses from outside to a foothold — almost always through phishing, a vulnerable service, or a valid stolen credential. Knowing which doors are used lets you spend where it matters.
Initial Access
Topic 28
Exploitation Basics
Turning a vulnerability into control. A defender doesn't write exploits, but must know what bug classes become what compromise — to prioritize patching by real exploitability, not just CVSS.
Exploitation
Topic 29
Post-Exploitation and Lateral Movement
A foothold is rarely the goal. Persistence, credential harvesting, and lateral movement turn a contained incident into a full breach — and are where segmentation, least privilege, and detection pay off most.
Lateral Movement