ctf-web-recon

CTF Web Reconnaissance Methodology

CTF reconnaissance and real penetration testing reconnaissance are fundamentally different:

Real penetration testing: large numbers of assets, requiring subdomain enumeration, port scanning, and fingerprinting
CTF：A single Web application, with the challenge author intentionally leaving clues, and the goal of reconnaissance is to find these clues

Core principles:Complete reconnaissance within 2-3 rounds, do not spend too many rounds on reconnaissance.

Phase 1: Reconnaissance Process

1.1 Homepage Analysis

Use http_request GET the homepage and carefully inspect the response:

HTTP Response Headers

Server — Server type and version (Apache/Nginx/Express)
X-Powered-By — Backend language (PHP/Express/ASP.NET)
Set-Cookie — Cookie format (PHPSESSID=PHP, connect.sid=Node, JSESSIONID=Java)
Non-standard Header — the challenge author may provide hints through custom Headers

HTML Content

 — CTF challenge authors often leave hints in comments (passwords, paths, vulnerability types)
<input type="hidden"> — Hidden fields may be tamperable
<form action="..."> — Form submission addresses expose backend interfaces
<script src="..."> — JS file paths expose project structure
Page text — sometimes the hint is right in the page content ("Try harder", "Look deeper")

1.2 Key Path Checks

Check in order of priority (analyze if anything is found, do not mechanically check everything):

Information leakage paths

/robots.txt          — 最常见的提示位置，Disallow 的路径往往是关键
/.git/HEAD           — Git 源码泄露（存在则用 githacker --brute 恢复完整仓库，含 stash/所有分支）
/.svn/entries        — SVN 泄露
/.DS_Store           — macOS 目录文件泄露
/crossdomain.xml     — Flash 跨域策略（可能暴露内部域名）
/.env                — 环境变量文件（数据库密码、API 密钥）
/composer.json       — PHP 依赖（暴露框架版本）
/package.json        — Node.js 依赖

Backup files

/www.zip, /www.tar.gz, /backup.zip     — 整站打包
/index.php.bak, /index.php~, /index.php.swp  — 编辑器备份
/flag.txt, /flag, /flag.php             — 直接读 flag（有时就这么简单）
/.index.php.swp                         — Vim swap 文件

Admin entry points

/admin, /admin.php, /login, /login.php
/console, /dashboard, /phpmyadmin
/api, /api/v1, /graphql

1.3 JavaScript Analysis

If the homepage references JS files, use http_request to fetch them, and search for:

API endpoint paths (/api/, fetch(, axios.）
Hardcoded credentials (password, token, secret, key）
Hidden functionality (admin, debug, test）
Hints in comments

Tip: Minified/obfuscated JS does not need to be fully understood; just search for key strings.

1.4 Technology Stack Confirmation

Confirm the technology stack based on the preceding information, as this determines the direction of subsequent vulnerability exploitation:

Clue	Technology Stack	Common Vulnerabilities
`.php` suffix, PHPSESSID	PHP	LFI, deserialization, file upload
`express`, connect.sid	Node.js	Prototype chain pollution, SSTI(EJS)
JSESSIONID, `.jsp`	Java	Deserialization, JNDI, SpEL
`_csrf_token`, `csrfmiddlewaretoken`	Python Django	SSTI(Jinja2)
`session=eyJ`	Python Flask	Flask session forgery

Phase 2: Reconnaissance Supplement

2.1 Things Not to Do

❌ Do not perform subdomain enumeration on a CTF target (there is only one application)
❌ Do not perform large-scale port scanning (there is usually only one port)
❌ Do not spend more than 3 rounds on reconnaissance (if the clue is not in reconnaissance, it is in the functionality)

2.2 Technology Fingerprint Determination

NoSQL/MongoDB characteristics: try $gt、$ne NoSQL injection operators, etc.

2.3 CTF Efficiency

CTF single application: do not perform subdomain enumeration, do not perform large-scale port scanning