> For the complete documentation index, see [llms.txt](https://morell-tony.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://morell-tony.gitbook.io/home/capture-the-flag/pentesterlab/pl-overview/recon-badge/badge-solutions.md).
# Badge Solutions
A solutions guide for obtaining this badge.
## PentesterLab Recon Badge Solution
**1. Recon 00 - The goal is to retrieve the robots.txt from the main website for hackycorp.com**
* Open hackycorp.com/robots.txt
**2. Recon 01 - To generate a 404/"Not Found" error on the main website for hackycorp.com**
* Open hackycorp.com/kjhfdbsgkdjhf *(you can type almost anything here)*
**3. Recon 02 - To retrieve the security.txt from the main website for hackycorp.com**
* Open hackycorp.com/.well-known/security.txt
*
**4. Recon 03-05 - to find a directory that is not directly accessible.**
* dirb
* From recon 03-05 will be solved using this command.
**5. Recon 06 - to access the default virtual host ("vhost").**
* curl -H "Host: 51.158.147.132"
**6. Recon 07 - To access the default virtual host ("vhost") over TLS.**
* curl -H "Host: 51.158.147.132"
**7. Recon 08 - To access the alternative names in the certificate.**
* Open
* Open the certificate
* Goto View Certificate > hackycorp.com > Subject Alt Names
* You'll see three DNS names
* Enter or curl
**8. Recon 09 - To access the headers from responses.**
* curl -I
**9. Recon 10 - To use visual reconnaissance. You will need to find the website with the key in red**
* Create a script to iterate the domains for you, as mentioned in the challenge.
```python
# python3
import urllib.request
# 0x00 to 0xc7 (this is 0 to 199)
for i in range(200):
if i <= 0xf:
url = "http://0x0{:x}.a.hackycorp.com/logo.png".format(i)
response = urllib.request.urlopen(url)
data = response.read()
response.close()
with open("logo.png{}".format(i), "wb") as f:
f.write(data)
else:
url = "http://0x{:x}.a.hackycorp.com/logo.png".format(i)
response = urllib.request.urlopen(url)
data = response.read()
response.close()
with open("logo.png{}".format(i), "wb") as f:
f.write(data)
```
* Find the image which has the key in red color. I just viewed the previews in my explorer once my script finished. Be sure to have a lot of files in a directory if you use my method.
**10. Recon 11 - To brute a virtual host**
* You have to bruteforce the vhosts. `ffuf -u https://hackycorp.com/ -w /usr/share/seclists/Discovery/DNS/fierce-hostlist.txt -H "host: FUZZ.hackycorp.com" -fs 107`
* curl -i -H "Host: admin.hackycorp.com" ;
**11. Recon 12 - To access a load-balanced application hosted at the address balancer.hackycorp.com**
* Go to and refresh the page several times.
**12. Recon 13 - To retrieve the TXT record for key.z.hackycorp.com.**
* dig key.z.hackycorp.com TXT
**13. Recon 14 - To perform a zone transfer on z.hackycorp.com**
* dig axfr z.hackycorp.com @z.hackycorp.com
* For more information: and
**14. Recon 15 - To perform a zone transfer on the internal zone: "int" using the nameserver of z.hackycorp.com**
* dig int @z.hackycorp.com axfr
**15. Recon 16 - To get the version of bind used by z.hackycorp.com**
* dig -t txt -c chaos VERSION.BIND @z.hackycorp.com
* For more information:
**16. Recon 17 - Look at the name of the developer used in the repository test1**
*
**17. Recon 18 - Look at the public repository of the developers of the organisation**
*
**18. Recon 19 - Look at the email addresses used for commits in the repository repo7**
* git clone
* cd repo7
* git log
**19. Recon 20 - Look at the branches in repo3**
* Open
* Click on branches
**20. Recon 21 - Look at the information in the branches for repo4**
* Open
* Choose a branch from "Active branches"
* Click on KEY file
**21. Recon 22 - Look in repo9 for deleted files**
* git clone
* cd repo9
* git log --diff-filter=D --summary | grep delete
* git log --all -- File\_name
* Copy the commit ID
* Go to
* Click on Load diff
**22. Recon 23 - Look for sensitive information in commit messages**
* git clone
* cd repo0a
* git log | grep -
**23. Recon 24 - Look for a file named key.txt in the place used to serve the assets for the main website.**
* Open hackycorp.com
* Open DevTools > Network
* Look at the domain name assets.hackycorp.com
* assets.hackycorp.com/key.txt
**24. Recon 25 - Look for a file named key2.txt in the place used to serve the assets for the main website.**
* Open
* Install aws cli and configure it with your own aws account
* Use below commad:\
`aws s3 cp s3://assets.hackycorp.com/key2.txt .`
**25. Recon 26 - Look for a key in the JavaScript used by the main website.**
* Open assets.hackycorp.com
* Open DevTools > Network
* Filter JS traffic
* Goto
* Search for recon