Web recon and attack surface
Find the endpoint the challenge is really about: unlinked paths, JavaScript-only routes, exposed .git, and the parameters nobody documented.
Assumes4. Reconnaissance and OSINT
By the end you can
- Map an application's routes from its own JavaScript before running any wordlist
- Choose a content-discovery wordlist from the stack rather than by size
- Recover a source tree from an exposed .git directory, including deleted and dangling objects
- Read response headers and error pages for the framework, and use that to narrow every later probe
- State the authorisation boundary you are testing inside, in one sentence, before you send a request
1. Read
Web recon: finding the endpoint the challenge is really about
The flag on a web challenge is usually behind a route the homepage never links to. Content discovery, JavaScript mining, parameter hunting, and reading the response headers - the reconnaissance that turns a blank page into an attack surface.
Git forensics: an exposed .git is the whole source tree
How to reconstruct a repository from an exposed .git directory over HTTP, find the secret that was committed and then deleted, recover dangling objects from a repo you already have, and read the other version-control leftovers.
2. Use the tools
In the order they come up while solving. Read what each one does, or go straight to the workspace tab that runs it.
- Directory and path scanner
Probe a target for common paths and hidden files with adjustable concurrency, reporting status, type, and timing for each hit.
Open it in the workspace - Exposed .git directory dumper
Reconstruct a repository from an exposed .git directory - recovering source, deleted files, and secrets from the commit history.
Open it in the workspace - HTTP security header analyzer
Analyse CSP, HSTS, X-Frame-Options, and CORS headers on a response - and find the gaps in a Content-Security-Policy that make XSS exploitable.
Open it in the workspace - HTTP request replayer
Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.
Open it in the workspace - Regex tester with match offsets and capture groups
Test regular expressions live against sample text, with every match’s offset, capture groups, and named groups broken out.
Open it in the workspace - Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
Open it in the workspace
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 46 match in total - see the full index.
Common mistakes
The wrong turns this topic reliably produces. Written as the mistake rather than the rule, because the rule is easy to agree with and easy to walk straight past.
- Brute-forcing paths before reading the client. The bundle usually names the routes, and a route named in the source is worth a thousand wordlist entries.
- Reading 404 as 'not there'. Custom error pages return 200, and soft-404 detection has to be calibrated against a path you know is absent.
- Dumping .git and reading only the checked-out tree. The interesting commit is normally the one that removed the secret.
- Running a wordlist built for another stack. A Java application has no .php endpoints, so a scan that finds nothing has answered a question about a different server rather than about this one.
- Reading only the routes the bundle actually calls. Route tables, feature flags and API base paths sit in the same JavaScript, and the endpoint a challenge is built around is usually the one the client never requests.
Checkpoint
From a target application, produce a list of routes with the evidence for each - source reference, header, or wordlist hit - and mark which of them are reachable without authentication.
Teaching note
This is the first module with real-world legal weight. Cover authorisation explicitly before the tools: the same techniques against a system nobody gave you permission to test are a criminal offence, not a lesson. Say it before the first scanner runs, not after.
Go deeper
The lessons above are written to get you through a challenge. These go after the subject instead. Each one opens our notes on that chapter - what it argues, what to take from it and where it stops - so this is somewhere to read now rather than a book to buy first. Nothing here is affiliate-linked or sold by us.
Chapter 5, Web Hacking Reconnaissance
Bug Bounty Bootcamp - Vickie Li
The most complete enumeration checklist in the corpus, and it is organised by what each source can tell you.
Chapter 6, Discovery
Hacking APIs - Corey Ball
Recon aimed at surfaces with no HTML to crawl, which is where most modern applications actually live.
Chapter 4, Reconnaissance
Black Hat Bash - Dolev Farhi and Nick Aleks
The same work as shell pipelines, which is how it gets automated once you have done it by hand twice.
Every book the curriculum cites has a page in the library.