Web Application Reconnaissance and Enumeration
What this domain tests
Web Application Reconnaissance and Enumeration on the HTB CWPE exam tests whether you can turn a single URL into a defensible attack-surface map: hosts, routes, parameters, technologies, and hidden API surfaces. The goal is evidence-led discovery before exploitation.
Core rules and concepts
- Start passive: certificate transparency, DNS records,
robots.txt,sitemap.xml, and archived URLs reveal naming conventions and forgotten paths. - Use active content discovery with calibrated filters. Compare status, size, word count, and redirect target; a 200 is not automatically interesting and a 403 can be a real endpoint.
- Parse JavaScript bundles and source maps for API base paths, feature flags, and parameter names that do not appear in HTML.
- Enumerate virtual hosts with the Host header and TLS SNI, not only DNS. Wildcard responses require a baseline.
- Fingerprint frameworks from headers, cookie names, error formats, and static asset paths so later payloads match the stack.
- Keep a request log with method, auth state, and response fingerprint so findings are reproducible.
Worked example
A target returns the same 4,242-byte page for random subdomains. You run ffuf -w vhosts.txt -u https://10.10.10.10 -H 'Host: FUZZ.example.htb' -fs 4242 and find dev.example.htb, which exposes /api/v2/swagger.json. Reading that spec reveals an unauthenticated /api/v2/users/export route. The reasoning is: establish the wildcard baseline, filter by size, then follow the new host into documentation rather than brute-forcing paths blindly.
Traps that cost marks
- Ignoring 401, 403, and 405 responses; they often mark real protected routes.
- Forgetting URL decoding, case variants, and trailing-slash differences.
- Trusting a WAF block page as a 404 and abandoning a directory.
- Failing to test the discovered host with its own Host header and cookies.