# Recon Badge

Pentesterlab's Recon exercises, available in the free tier, help you learn how to gather information about a target before attacking it. You'll use tools to find details about websites, domains, and networks. These exercises teach you how to collect data to help you plan your next steps in a penetration test.

View the exercises here: [PentesterLab: Learn with our Recon Badge](https://pentesterlab.com/badges/recon)

{% hint style="info" %}

### Scope

For this exercise, the current targets are:

* **hackycorp.com**
* **.hackycorp.com**
* **0x\[%02x].a.hackycorp.com**(find the red key)
* **balancer.hackycorp.com**
* **z.hackycorp.com** (DNS-related challenges)
* Github account for Hackycorp
  {% endhint %}

### Exercise Solutions

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>recon_00</strong></td><td>/robots.txt</td><td><a href="/pages/47Pd7Cskr3dpPsNTsK9i">/pages/47Pd7Cskr3dpPsNTsK9i</a></td></tr><tr><td><strong>recon_01</strong></td><td>404 pages</td><td><a href="/pages/I8joKmj7nCIeiEPZ1kq6">/pages/I8joKmj7nCIeiEPZ1kq6</a></td></tr><tr><td><strong>recon_02</strong></td><td>/.well-known/security.txt</td><td><a href="/pages/4jisc5NL0ocS6bYxtaPa">/pages/4jisc5NL0ocS6bYxtaPa</a></td></tr><tr><td><strong>recon_03</strong></td><td>directory listing</td><td><a href="/pages/ER7EA4nVImgzlde6IKcb">/pages/ER7EA4nVImgzlde6IKcb</a></td></tr><tr><td><strong>recon_04</strong></td><td>/admin</td><td><a href="/pages/WA5C3ALPtrgbWXI2VccL">/pages/WA5C3ALPtrgbWXI2VccL</a></td></tr><tr><td><strong>recon_05</strong></td><td>wfuzz</td><td><a href="/pages/Fl9S3kR7y3s5p8MkObAM">/pages/Fl9S3kR7y3s5p8MkObAM</a></td></tr><tr><td><strong>recon_06</strong></td><td>vhost</td><td><a href="/pages/ps8WwffhhxnzHsCUczWo">/pages/ps8WwffhhxnzHsCUczWo</a></td></tr><tr><td><strong>recon_07</strong></td><td>vhost over TLS</td><td><a href="/pages/WThkB9Xf51l7x6x8z2Ls">/pages/WThkB9Xf51l7x6x8z2Ls</a></td></tr><tr><td><strong>recon_08</strong></td><td>alt name</td><td><a href="/pages/KkNQBf1DcTyK73O6KMJE">/pages/KkNQBf1DcTyK73O6KMJE</a></td></tr><tr><td><strong>recon_09</strong></td><td>header</td><td><a href="/pages/POC5A2YJo54Qsqc7VJlm">/pages/POC5A2YJo54Qsqc7VJlm</a></td></tr><tr><td><strong>recon_10</strong></td><td>visual recon</td><td><a href="/pages/FsORa4mW7mh17bQSzSox">/pages/FsORa4mW7mh17bQSzSox</a></td></tr><tr><td><strong>recon_11</strong></td><td>virtual host brute</td><td><a href="/pages/QZPmztpYKpBT9hluS0Oj">/pages/QZPmztpYKpBT9hluS0Oj</a></td></tr><tr><td><strong>recon_12</strong></td><td>load balance</td><td><a href="/pages/PKlS52pK4DSPLKIXZG5z">/pages/PKlS52pK4DSPLKIXZG5z</a></td></tr><tr><td><strong>recon_13</strong></td><td> TXT</td><td><a href="/pages/Hflxh00p84yEM30SI0Vh">/pages/Hflxh00p84yEM30SI0Vh</a></td></tr><tr><td><strong>recon_14</strong></td><td>zone transfer</td><td><a href="/pages/oLoQmQKpEmbZuKwKoShU">/pages/oLoQmQKpEmbZuKwKoShU</a></td></tr><tr><td><strong>recon_15</strong></td><td>int zone transfer</td><td><a href="/pages/rFkNkIGDp31NB0OuHbaD">/pages/rFkNkIGDp31NB0OuHbaD</a></td></tr><tr><td><strong>recon_16</strong></td><td>bind version</td><td><a href="/pages/A2fnj48AGd1eGkHBkzk9">/pages/A2fnj48AGd1eGkHBkzk9</a></td></tr><tr><td><strong>recon_17</strong></td><td>dev name</td><td><a href="/pages/zaFcbsrLVeW3TkHFHHkl">/pages/zaFcbsrLVeW3TkHFHHkl</a></td></tr><tr><td><strong>recon_18</strong></td><td> public repos</td><td><a href="/pages/JtjAoyBofQVp3b6X9fxO">/pages/JtjAoyBofQVp3b6X9fxO</a></td></tr><tr><td><strong>recon_19</strong></td><td>find email</td><td><a href="/pages/sOhEPO9SDpnEAiYz6ElT">/pages/sOhEPO9SDpnEAiYz6ElT</a></td></tr><tr><td><strong>recon_20</strong></td><td>check branches 1</td><td><a href="/pages/x3VRiW4IomjIcOabk6xc">/pages/x3VRiW4IomjIcOabk6xc</a></td></tr><tr><td><strong>recon_21</strong></td><td>check branches 2</td><td><a href="/pages/U5zJf8XlVVTtRktYHASw">/pages/U5zJf8XlVVTtRktYHASw</a></td></tr><tr><td><strong>recon_22</strong></td><td>deleted file</td><td><a href="/pages/33AgMtvBJGN1lGHjYjVG">/pages/33AgMtvBJGN1lGHjYjVG</a></td></tr><tr><td><strong>recon_23</strong></td><td>commit message</td><td><a href="/pages/ctCb4Q4BOmTMsKCF6yoI">/pages/ctCb4Q4BOmTMsKCF6yoI</a></td></tr><tr><td><strong>recon_24</strong></td><td>assets</td><td><a href="/pages/4zFxLeK3LG7NTgkdBS6H">/pages/4zFxLeK3LG7NTgkdBS6H</a></td></tr><tr><td><strong>recon_25</strong></td><td>S3</td><td><a href="/pages/UfkIqe5a3t4z2810yiI6">/pages/UfkIqe5a3t4z2810yiI6</a></td></tr><tr><td><strong>recon_26</strong></td><td>JS</td><td><a href="/pages/7Mdzq6QMfauP3TvKgPIT">/pages/7Mdzq6QMfauP3TvKgPIT</a></td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.marialc.com/pentesterlab-labs/recon-badge.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.