Web Reconnaissance

wsos-6-operations-management web-security reconnaissance offensive area-offensive-operations wsos-7-intelligenceReviewed 2026-10-29

Scope

What this is: Enumerating web application structure, discovering hidden files/directories, and identifying technologies.

Competition relevance: Offensive operations (red team CTF): the essential first step. Recon before exploitation.

Why it matters: Hidden admin pages, backup files, and config files often contain flags or credentials.

WSOS 2026 alignment: This topic directly supports Section 6: Operations and management (reconnaissance phase) and Section 7: Intelligence collection and analysis (systematically discovering attack surface).

Competition area: Core to the offensive operations area, where you enumerate applications to find hidden resources.

Offline competence: gobuster/ffuf/dirb work offline with local wordlists (SecLists). Browser DevTools requires no network. Maintain offline wordlist collection.

Competency Matrix

Level	Expectation
Regional	Use gobuster/dirb to find hidden directories. Basic manual browsing.
National	Custom wordlists. Recursive enumeration. Technology fingerprinting.
Squad/Team Selection	Parameter fuzzing. Subdomain enumeration. API endpoint discovery.
International	Custom fuzzing logic. Automated workflow integration.

Technical Content

Directory Fuzzing

gobuster:

# Basic directory brute-force
gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt

# With extensions
gobuster dir -u http://example.com -w wordlist.txt -x php,html,txt,bak

# Ignore 404 status
gobuster dir -u http://example.com -w wordlist.txt -b 404

# Follow redirects
gobuster dir -u http://example.com -w wordlist.txt -r

# Faster (more threads)
gobuster dir -u http://example.com -w wordlist.txt -t 50

ffuf (faster alternative):

# Directory fuzzing
ffuf -u http://example.com/FUZZ -w wordlist.txt

# Filter by status code
ffuf -u http://example.com/FUZZ -w wordlist.txt -fc 404

# Filter by size
ffuf -u http://example.com/FUZZ -w wordlist.txt -fs 1234

# Recursive
ffuf -u http://example.com/FUZZ -w wordlist.txt -recursion

Common findings:

/admin, /administrator, /adminpanel
/backup, /old, /test, /dev
/.git, /.svn, /.env
/config.php.bak, /database.sql

Competition context: Hidden admin pages often contain flags or credentials. Check everything.

File Discovery

Backup files:

config.php.bak
database.sql.old
index.php~
.htaccess.bak

Source code disclosure:

.git/
.svn/
.DS_Store
WEB-INF/

Sensitive files:

robots.txt (reveals hidden paths)
sitemap.xml
.env (environment variables, credentials)
phpinfo.php
test.php

Git disclosure exploitation:

# If .git/ is exposed
wget -r http://example.com/.git/

# Extract repository
git-dumper http://example.com/.git/ output/

# View source code
cat output/config.php

Technology Fingerprinting

Identify web server and frameworks:

# Wappalyzer (browser extension)
# Or use whatweb
whatweb http://example.com

# curl headers
curl -I http://example.com

# nmap script
nmap -p 80 --script http-enum example.com

CMS detection:

WordPress: /wp-admin, /wp-content
Joomla: /administrator
Drupal: /user/login

Frameworks:

Laravel: /vendor, /.env
Django: /admin, settings.py
Flask: app.py

Parameter Fuzzing

Find hidden GET parameters:

# ffuf
ffuf -u 'http://example.com/page?FUZZ=test' -w params.txt -fs 1234

# wfuzz
wfuzz -u 'http://example.com/page?FUZZ=test' -w params.txt --hh 1234

Common parameters:

id, user, page, file, cat
debug, test, admin
redirect, url, next

Competition Strategy & Marking

What gets marked:

Hidden directories discovered
Sensitive files found (config, backups)
Credentials extracted from disclosed files
Flags found in hidden pages

Evidence requirements:

Screenshot of hidden directory listing
URL of discovered resource
File contents showing flag/credentials

Time allocation:

Initial enumeration: 15 minutes
Technology fingerprinting: 5 minutes
Deep enumeration of interesting paths: 15 minutes

Evidence and reporting requirements:

Screenshot of gobuster/ffuf output showing discovered directories
List of all discovered endpoints with HTTP status codes
Technology fingerprinting results (Wappalyzer, whatweb)
Source code comments or hidden fields discovered
Clear naming: recon_gobuster_results.png, recon_discovered_admin_panel.png

Time-boxed drill suggestion: 30-minute web reconnaissance sprint: Given a target URL, run gobuster with common.txt and extensions (php,txt,bak,old), check robots.txt and sitemap.xml, inspect page source for comments and hidden fields, use Wappalyzer to fingerprint technologies, discover at least 3 hidden directories or files, and document findings with screenshots.

False Flags / Wrong Paths

Practice Checklist

Can use gobuster/ffuf for directory enumeration
Can identify web technologies (whatweb, Wappalyzer)
Can exploit .git disclosure
Can find backup and config files
Can fuzz parameters
Know common admin panel paths
Complete recon in under 20 minutes

References

Regional Roadmap: Offensive operations
National Roadmap: Offensive operations

Unofficial study guide, not endorsed by WorldSkills International or WorldSkills UK. Topics are example areas to prepare for, not the content of any test project: competition tasks are confidential, competitions are closed book, and formats change between competitions. More about this site.