CTF Reconnaissance & Enumeration

Web Reconnaissance

Initial Checks

# Fetch and inspect
curl -v http://target/
curl -s http://target/ | head -100

# Check common paths
for path in robots.txt sitemap.xml .env .git/HEAD .well-known/ admin api debug; do
    code=$(curl -s -o /dev/null -w "%{http_code}" "http://target/$path")
    [ "$code" != "404" ] && echo "[+] /$path -> $code"
done

# Response headers
curl -sI http://target/ | grep -iE "(server|x-|powered|content-type|set-cookie)"