PentesterLab — Recon 10: Visual Reconnaissance

Objective

"وَقُل رَّبِّ زِدْنِي عِلْمًا"

The objective of this challenge is to use Visual Reconnaissance to identify the website that contains a red-colored key.

The challenge provides the following pattern:

0x["%02x"].a.hackycorp.com

0x["%02x"].a.hackycorp.com

At first, this notation looked confusing, so I started by understanding what %02x means.

Understanding %02x

The format specifier %02x represents a decimal number as a two-digit hexadecimal value, padding it with a leading zero when necessary.

For example :

| Decimal | Hex |
| - - - - -:|: - -:|
| 0 | `00` |
| 1 | `01` |
| 10 | `0a` |
| 15 | `0f` |
| 16 | `10` |
| 255 | `ff` |

| Decimal | Hex |
| - - - - -:|: - -:|
| 0 | `00` |
| 1 | `01` |
| 10 | `0a` |
| 15 | `0f` |
| 16 | `10` |
| 255 | `ff` |

Initially, I couldn't understand why the challenge required exactly 256 subdomains. After understanding %02x, I realized it represents every hexadecimal value from 00 to ff.

Since each hexadecimal digit has 16 possible values (0-9 and a-f), two hexadecimal digits produce:

16 × 16 = 256

16 × 16 = 256

Therefore, the challenge contains 256 possible subdomains.

Generating the Subdomains

Instead of creating every subdomain manually, I generated them using Python.

with open("domain.txt", "w") as file:
    for i in range(256):
        domain = f"http://0x{i:02x}.a.hackycorp.com"
        file.write(domain + "\n")

with open("domain.txt", "w") as file:
    for i in range(256):
        domain = f"http://0x{i:02x}.a.hackycorp.com"
        file.write(domain + "\n")

The script generated a file similar to:

http://0x00.a.hackycorp.com
http://0x01.a.hackycorp.com
...
http://0xff.a.hackycorp.com

http://0x00.a.hackycorp.com
http://0x01.a.hackycorp.com
...
http://0xff.a.hackycorp.com

Visual Reconnaissance

Opening 256 websites manually would be slow and inefficient, so I used a screenshot-based reconnaissance approach.

My first attempt was with Aquatone, but it crashed due to a concurrency-related error.

I then switched to GoWitness, which successfully captured screenshots for all responsive websites.

Using GoWitness, I generated screenshots for all responsive websites. Reviewing those screenshots made it easy to identify the page containing the red-colored key.

## Flag
483f8b15-e4a8-4387-b052-4b2204c7eb69

## Flag
483f8b15-e4a8-4387-b052-4b2204c7eb69

Lessons Learned

• Understood how %02x works.
• Learned why the challenge contains 256 subdomains.
• Practiced automating enumeration with Python.
• Used GoWitness for visual reconnaissance.
• Learned to troubleshoot tool failures and switch to alternatives.