Overview
Recon challenges in a CTF hand you a target and ask a single, foundational question: what is actually here? Before you can exploit anything, you need a picture of the systems, ports, and pages you are allowed to attack. Target mapping is the disciplined process of turning "here is an IP and a scope" into a clear inventory of everything reachable. In a CTF the whole target is provided for you to probe, so mapping is safe, expected, and usually the first thing that earns you points.
Learning objectives
- Explain what target mapping is and why it comes first in a recon challenge.
- Describe how host discovery and port scanning build an inventory.
- Distinguish enumerating a provided in-scope target from scanning systems you have no permission to touch.
Core concept
Target mapping is building a structured inventory of a target's attack surface: which hosts are alive, which ports are open, and which services and applications sit behind them. It is the reconnaissance phase applied to a bounded, authorized target. The goal is coverage — you want to discover everything the challenge exposes, because the flag is often hidden behind the one service or page you failed to notice.
Mapping is deliberately broad before it is deep. You first sweep for anything reachable, then narrow your attention. Skipping the sweep is the classic beginner error: people latch onto the first open port and never discover the second, more interesting one.
How it works
Target mapping in a recon challenge generally proceeds in layers:
- Confirm the scope. The challenge tells you exactly what you may attack — an IP, a hostname, a subnet, or a URL. Everything outside that boundary is off-limits, just like the scope rules in any engagement.
- Host discovery. If you are given a range, you first determine which hosts respond at all. A ping sweep or a light scan tells you which addresses are live so you do not waste time on empty ones.
- Port scanning. For each live host, you probe TCP (and sometimes UDP) ports to learn which are open, closed, or filtered. Open ports are doors into running services.
- Service identification. For each open port, you determine what is listening — a web server, an SSH daemon, a database, and so on. This is where mapping hands off to the deeper enumeration covered later in this module.
- Record everything. You keep an organized note of host, port, service, and version. In a recon challenge the flag frequently rewards completeness, so a tidy inventory is the deliverable.
A key idea is the difference between an open, closed, and filtered port. Open means a service accepted the connection. Closed means the host answered but nothing is listening there. Filtered means a firewall silently dropped the probe, so you cannot tell — a signal that something may be deliberately protected.
Practical example
A CTF recon challenge gives you a single in-scope host at an address on an isolated lab network and asks you to "find every service running." You begin with a broad port scan across all ports rather than only the common ones. The scan reports three open ports: 22 (SSH), 80 (HTTP), and a high-numbered port like 8080 running a second web service.
A hasty player would stop at port 80 and start poking at the obvious website. But because you scanned the full range, you notice the 8080 service — and that is where the challenge hid an administrative interface holding the flag. The lesson is concrete: the flag lived behind the port you would have missed without full mapping. Your inventory (host, three ports, two web apps, one SSH service) becomes the map that guides every later step.
Cybersecurity relevance
Target mapping is the real first phase of any authorized security assessment. Professionals begin an engagement by enumerating the agreed scope: discovering live hosts, scanning ports, and identifying services to build an accurate attack-surface inventory. Defenders do the mirror-image work — asset discovery and continuous scanning — to know what they are exposing before an attacker does. CTF recon challenges train exactly this habit: be systematic, be thorough, and never attack blind. The difference between the CTF and the real world is only authorization and isolation: in the CTF the target is handed to you; in the real world you map only what a signed scope permits.
Common mistakes
- Scanning only common ports and missing a service hidden on an unusual high port.
- Fixating on the first open port instead of finishing the full inventory first.
- Ignoring filtered ports, which can hint at protected or firewalled services worth noting.
- Not recording results, so you re-scan repeatedly and lose track of the attack surface.
Key takeaways
- Target mapping is building a complete inventory of a target's attack surface — live hosts, open ports, and the services behind them — and it is the first step in a recon challenge.
- Work broad before deep: host discovery, then full port scanning, then service identification, recording everything.
- Open vs. closed vs. filtered ports tell you where services live and where something may be deliberately protected.
- The flag often hides behind the port or service you would miss without thorough mapping; completeness wins recon challenges.
Check your understanding
- Why is it risky to start attacking the first open port you find instead of finishing the full scan?
- What is the difference between an open, a closed, and a filtered port, and what does each tell you?