Web recon and attack surface

Before the session

• Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
• Read the lesson yourself first - about 9 minutes.
• Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.

Objectives

Written as things a student can do afterwards, so they can be assessed rather than asserted.

1. Map an application's routes from its own JavaScript before running any wordlist
2. Choose a content-discovery wordlist from the stack rather than by size
3. Recover a source tree from an exposed .git directory, including deleted and dangling objects
4. Read response headers and error pages for the framework, and use that to narrow every later probe
5. State the authorisation boundary you are testing inside, in one sentence, before you send a request

Running order (90 min)

Tools used

• Directory and path scanner - Probe a target for common paths and hidden files with adjustable concurrency, reporting status, type, and timing for each hit.https://ctfpal.com/?tool=directory-scanner
• Exposed .git directory dumper - Reconstruct a repository from an exposed .git directory - recovering source, deleted files, and secrets from the commit history.https://ctfpal.com/?tool=git-leak-dumper
• HTTP security header analyzer - Analyse CSP, HSTS, X-Frame-Options, and CORS headers on a response - and find the gaps in a Content-Security-Policy that make XSS exploitable.https://ctfpal.com/?tool=security-header-analyzer
• HTTP request replayer - Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.https://ctfpal.com/?tool=http-request-replayer
• Regex tester with match offsets and capture groups - Test regular expressions live against sample text, with every match’s offset, capture groups, and named groups broken out.https://ctfpal.com/?tool=regex-tester
• Strings extractor for binaries and blobs - Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.https://ctfpal.com/?tool=strings-extractor

Reading

• Web recon: finding the endpoint the challenge is really about - 4 min. The flag on a web challenge is usually behind a route the homepage never links to. Content discovery, JavaScript mining, parameter hunting, and reading the response headers - the reconnaissance that turns a blank page into an attack surface.
• Git forensics: an exposed .git is the whole source tree - 5 min. How to reconstruct a repository from an exposed .git directory over HTTP, find the secret that was committed and then deleted, recover dangling objects from a repo you already have, and read the other version-control leftovers.

Practice set

Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.

1. Blame Game - picoCTF 2024, easy
2. Bookmarklet - picoCTF 2024, easy
3. Collaborative Development - picoCTF 2024, easy
4. Commitment Issues - picoCTF 2024, easy
5. dont-use-client-side - picoCTF 2019, easy
6. GET aHEAD - picoCTF 2021, easy
7. Client-side-again - picoCTF 2019, medium
8. credstuff - picoCTF 2022, medium
9. dont-you-love-banners - picoCTF 2024, medium
10. Java Script Kiddie - picoCTF 2019, hard
11. Java Script Kiddie 2 - picoCTF 2019, hard
12. Pachinko Revisited - picoCTF 2025, hard

Checkpoint (gradeable)

From a target application, produce a list of routes with the evidence for each - source reference, header, or wordlist hit - and mark which of them are reachable without authentication.

Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.

Where the room gets stuck

This is the first module with real-world legal weight. Cover authorisation explicitly before the tools: the same techniques against a system nobody gave you permission to test are a criminal offence, not a lesson. Say it before the first scanner runs, not after.

• Brute-forcing paths before reading the client. The bundle usually names the routes, and a route named in the source is worth a thousand wordlist entries.
• Reading 404 as 'not there'. Custom error pages return 200, and soft-404 detection has to be calibrated against a path you know is absent.
• Dumping .git and reading only the checked-out tree. The interesting commit is normally the one that removed the secret.
• Running a wordlist built for another stack. A Java application has no .php endpoints, so a scan that finds nothing has answered a question about a different server rather than about this one.
• Reading only the routes the bundle actually calls. Route tables, feature flags and API base paths sit in the same JavaScript, and the endpoint a challenge is built around is usually the one the client never requests.

If a student wants the subject, not the answer

Chapter-level references, so a student can be pointed at twenty pages rather than at a book. Nothing here is required to complete the module.

• Bug Bounty Bootcamp, Vickie Li. Chapter 5, Web Hacking Reconnaissance. The most complete enumeration checklist in the corpus, and it is organised by what each source can tell you.
• Hacking APIs, Corey Ball. Chapter 6, Discovery. Recon aimed at surfaces with no HTML to crawl, which is where most modern applications actually live.
• Black Hat Bash, Dolev Farhi and Nick Aleks. Chapter 4, Reconnaissance. The same work as shell pipelines, which is how it gets automated once you have done it by hand twice.

If you finish early

• Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
• Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
• Ask a student to break their own example - construct an input that defeats the tool, and explain why.