03. Recon

Before attacking anything, map it. The more of the app you've seen, the more places you have to look for bugs.

What Are We Looking For?

Pages and endpoints: every URL, form, and API route
Parameters: every input the app accepts (?id=, form fields, JSON keys, headers)
Technology: framework, server, libraries. Old versions have known bugs.
Leftovers: comments, debug pages, backups, test accounts

Developers leave notes in HTML comments that never show on the rendered page:

<!-- TODO: remove test account admin/admin123 before launch -->

Frontend JS often contains API endpoints, feature flags, hardcoded keys, and admin routes. Check the Sources tab in DevTools.

/robots.txt tells search engines what not to index. That's also a list of places the owner didn't want people looking.

User-agent: *
Disallow: /admin-old/
Disallow: /backup/

Path	Why
`/robots.txt`, `/sitemap.xml`	Lists of paths
`/.git/`	Exposed source code repository
`/.env`	Environment file with secrets
`/backup/`, `.bak`, `.old`	Forgotten copies
`/api/`, `/swagger`, `/graphql`	API docs and endpoints

For real targets, tools brute-force paths from a wordlist to find unlinked pages:

# ffuf: fast web fuzzer
ffuf -u https://target.example/FUZZ -w wordlist.txt

# gobuster
gobuster dir -u https://target.example -w wordlist.txt

Only with permission Brute-forcing sends thousands of requests. Only point these tools at targets you're authorized to test.

Try it Lab 01 (TrailMart) has a flag split into 3 pieces, hidden in the places covered on this page.