Research session unavailable. No participant research session is associated with this browser. Use the participant access link supplied by the facilitator.

Participant Dashboard

MITRE ATT&CK PRE training

Work through the first two Enterprise ATT&CK tactic lanes: Reconnaissance and Resource Development. Controlled actions are available only where the trainer has an explicitly authorized lab exercise.

0 / 24

training lessons completed

0% complete

Training Orientation

About this training

In this training, you will work through selected MITRE ATT&CK PRE techniques related to Reconnaissance and Resource Development. The lessons are designed to help you understand how information about a target can be gathered, interpreted, and documented before later security-testing activities take place.

You will complete short instructional lessons, knowledge checks, and controlled hands-on exercises in an authorized training environment. The goal is to build your ability to recognize relevant security evidence, understand what common reconnaissance activities reveal, and document your observations clearly.

Recommended device: Complete this training on a desktop or laptop computer using a modern web browser. The study involves multiple browser tabs, note-taking, and interaction with a web application training lab. Phones and tablets are not recommended for the full study experience.

These skills matter because effective security testing depends on understanding the target environment before drawing conclusions about possible weaknesses. The exercises focus on learning and evidence interpretation within the researcher-controlled lab.

Learning Pathway

Where this training is taking you

Orientation and reconnaissance lessons — Learn how testers gather information about reachable systems, services, and the target environment.
Web Security Fundamentals — Learn the baseline → change → compare → interpret → document process and what common web vulnerabilities mean.
Browser Investigation — Learn how to approach an unfamiliar web application and apply the testing method in the browser.
Synthetic Practice — Practice that process with guided examples before working independently.
Final Assessment — Apply what you learned independently in the authorized DVWA environment. Once this stage starts, earlier training and practice are locked.

Use this pathway to understand where you are going next; your lesson completion count above shows your progress through the ATT&CK training lessons.

Scope reminder: Perform executable exercises only against the target and services explicitly authorized by the facilitator. Concept lessons do not require external target interaction.

TA0043 · ATT&CK Tactic

Reconnaissance

The adversary is trying to gather information they can use to plan future operations.

T1595 Available

Check basic reachability

One of the first things a security tester may want to know is whether a computer or server on a network is responding. A common first check sends a small network message called an ICMP (Internet Control Message Protocol) echo request, often called a ping, to the target. Use the trainer's authorized lab action to perform this check. If a reply comes back, the request reached the target and the target responded to ICMP. If no reply comes back, do not assume the computer is offline: a firewall or other network control may block ICMP while websites or other network services still work. A ping checks this kind of host reachability; it does not identify which TCP or UDP ports are open. Port and service checks are separate authorized steps that can determine whether particular network services are reachable.

Open lesson

T1595 Available

Survey a small set of common TCP ports

Use the trainer's authorized action to check a small fixed set of TCP ports on the assigned lab target. OPEN means a service accepted a connection. CLOSED usually means the host was reachable but nothing was listening on that port. A port result does not prove a vulnerability. Record the result as an observation and use the lesson context before deciding what it means.

Open lesson

T1595 Available

Identify service versions

Use the trainer's authorized service-identification action on the assigned lab target. The result may show which service or protocol is listening on an open port and may report a version. Treat the result as a clue, not proof of the exact software build, patch level, vulnerability, or exploitability.

Open lesson

T1595 Available

Recognize wordlist-scanning behavior

Wordlist scanning is a systematic way to try many possible names or values from a prepared list. In web testing, repeated requests for candidate paths can help identify resources by comparing HTTP responses. Defenders can recognize the resulting pattern in HTTP or WAF logs, DNS activity, request rates, and response-status patterns. This lesson explains the basic process before showing how individual responses and repeated activity should be interpreted.

Open lesson

T1592 Available

Gather Victim Host Information: recognize the technique

This technique is about learning details about systems linked to an organization. Examples include operating systems, device roles, software, exposed services, host naming patterns, and cloud or virtualization details. Defenders should understand which system details are visible from outside and whether that exposure is necessary. This lesson also prepares you to interpret host-fingerprinting evidence from bounded service/version scans: distinguish what a tool directly observes from what it merely suggests about an operating system or platform.

Open lesson

T1589 Available

Gather Victim Identity Information: recognize the technique

This technique is about learning who works with an organization and how its accounts are named. Useful details can include employee names, job roles, email patterns, contact information, and account identifiers. Defenders should know what identity information is public and reduce details that are not needed.

Open lesson

T1590 Available

Gather Victim Network Information: recognize the technique

This technique is about learning how an organization's network is arranged and exposed. Examples include public IP ranges, DNS relationships, cloud or hosting providers, remote-access services, and network boundaries. An outside view is incomplete, so defenders should compare it with their own current network records.

Open lesson

T1591 Available

Gather Victim Org Information: recognize the technique

This technique is about learning how an organization works. Public information may include business units, leaders, offices, suppliers, partners, technologies, projects, and schedules. Each fact may be harmless by itself, but several facts can be combined to support later targeting. This can help an attacker choose people, systems, or business processes to target.

Open lesson

T1598 Available

Phishing for Information: recognize the technique

This technique uses deceptive messages to persuade someone to reveal information. The request may ask about people, internal processes, technology, credentials, or schedules. The message does not need malware to create risk. This lesson is about recognition and defense, not creating phishing messages.

Open lesson

T1682 Available

Query Public AI Services: recognize the technique

Query Public AI Services means using a public AI service, such as a large language model, to help collect, combine, summarize, or analyze information during reconnaissance. An adversary might ask an AI service about an organization's people, technologies, business relationships, public contact details, or other information that is already available online. The important idea is not that the AI service creates secret facts. It can make public information easier to organize and connect, which may help someone prepare later targeting or social engineering.

Open lesson

T1597 Available

Search Closed Sources: recognize the technique

This technique is about getting information from sources that are not freely available to everyone. Examples include paid databases, subscription services, commercial data, or other restricted information services. Using a paid source is not automatically malicious. These sources can add details that are not visible on ordinary public websites and may make other information more useful.

Open lesson

T1596 Available

Search Open Technical Databases: recognize the technique

This technique is about using public technical data services. Examples include DNS history, certificate records, internet-routing information, and public vulnerability records. These services have many legitimate uses, including troubleshooting and security monitoring. Defenders can use the same public records to check whether their exposed systems match what they intended to publish.

Open lesson

T1593 Available

Search Open Websites/Domains: recognize the technique

This technique is about using public internet sources to learn about a target. Sources can include websites, search engines, social media, public code repositories, and forums. These sources may reveal people, technologies, relationships, projects, or infrastructure without directly contacting an organization-owned system.

Open lesson

T1681 Available

Search Threat Vendor Data: recognize the technique

This technique is about using information from security vendors, researchers, and intelligence providers. Reports may discuss malware, vulnerabilities, infrastructure, campaigns, exposed assets, or attacker behavior. Vendor data is useful context, but it is not automatic proof that an organization is affected.

Open lesson

T1594 Available

Search Victim-Owned Websites: recognize the technique

This technique is about reviewing websites owned by the target organization for public information. A site may reveal contacts, technology, documents, partners, or operational details. This lesson focuses on defensive content review, not on scanning a live website. Public pages and documents can also reveal details that help someone plan later activity.

Open lesson

TA0042 · ATT&CK Tactic

Resource Development

The adversary is trying to establish resources they can use to support operations.

T1650 Available

Acquire Access: recognize the technique

Acquire Access means getting access that already exists, such as an account or remote-access connection, instead of creating a new way into the target. A successful login does not always mean the person logging in is the legitimate user. Defenders should look at where the login came from, which device was used, whether MFA changed, and what happened after the login.

Open lesson

T1583 Available

Acquire Infrastructure: recognize the technique

This technique is about obtaining infrastructure that can support later activity. Examples include domains, hosted servers, virtual private servers, DNS services, web services, or serverless resources. A new domain or rented server is not automatically malicious. Defenders should look for relationships between the infrastructure, enterprise activity, and other signs of suspicious behavior.

Open lesson

T1586 Available

Compromise Accounts: recognize the technique

This technique is about taking control of an existing account for later use. Existing accounts may already have trusted contacts, permissions, or a normal history, so misuse can look legitimate at first. A familiar account can therefore become suspicious when its login pattern, settings, devices, or actions change unexpectedly.

Open lesson

T1584 Available

Compromise Infrastructure: recognize the technique

This technique is about taking control of infrastructure that belongs to someone else and using it later. A previously trusted website, server, or cloud resource can become unsafe after it is compromised. The key clue is a change in control or behavior, not simply the age or reputation of the system.

Open lesson

T1587 Available

Develop Capabilities: recognize the technique

This technique is about creating resources that may support later operations. ATT&CK includes items such as software, exploits, certificates, or other capabilities. This lesson focuses on what defenders may observe and how they can reduce exposure, not on building offensive tools. Defenders should use context and evidence to decide whether the behavior is relevant to their organization.

Open lesson

T1585 Available

Establish Accounts: recognize the technique

This technique is about creating accounts or personas that can support later activity. Accounts may exist on email, social media, collaboration, cloud, developer, or other services. A new account is not automatically suspicious. Defenders should focus on how an account presents itself, what it links to, and how it contacts people connected with the organization.

Open lesson

T1683 Available

Generate Content: recognize the technique

This technique is about creating written, visual, audio, or other material that can support later targeting, impersonation, social engineering, or fraud. The content may look polished or personal. Defenders should verify the sender, source, links, and related activity instead of trusting appearance alone.

Open lesson

T1588 Available

Obtain Capabilities: recognize the technique

This technique is about getting capabilities from another source instead of creating them. Examples can include tools, malware, exploits, certificates, or vulnerability information. This lesson focuses on defender recognition and risk management, not on finding, buying, downloading, or using offensive tools.

Open lesson

T1608 Available

Stage Capabilities: recognize the technique

This technique is about preparing content, tools, or other resources on infrastructure so they are ready for later use. A hosted file, redirect, or newly configured service is not automatically malicious. Defenders should connect those preparation signs with later network or endpoint activity before drawing a conclusion.

Open lesson

Next Stage · Web Security Fundamentals

Learn the web-testing method and vulnerability concepts

After completing the ATT&CK PRE lessons, continue here to learn baseline → change → compare → interpret → document and the common web vulnerabilities used in later practice.

Open Web Security Fundamentals

Common Study Skill · Browser Investigation

Practice how to approach an unfamiliar web page

Before the final assessment, review the common browser-investigation workflow: establish normal behavior, change one input at a time, compare the response, and record observable evidence without overstating what it proves.

Open browser investigation orientation

Final Assessment

DVWA Vulnerability Discovery Capstone

Perform an authorized assessment of the configured DVWA lab target. DVWA contains many modules; work only with the five modules listed in this assessment. Do as much as you can on each required module. You may take notes while you work. Record each module's finding on a separate line, and if you cannot complete a module, record what you tried and observed before moving to the next one. Do not submit between exercises. After working through all five required modules, review your findings and submit once. For each finding, provide the vulnerability name, affected DVWA module, and a short evidence note describing the observation that supports the finding. This is a one-shot independent assessment: additional submissions are not permitted and correctness feedback or AI assistance is not shown during the assessment.

Training is incomplete. You have completed 0 of 24 training lessons. Complete the required training sequence before the final assessment.

Guided Lab Practice is incomplete. Complete the common hands-on lab practice before starting the final assessment.

Complete Guided Lab Practice →