> For the complete documentation index, see [llms.txt](https://www.marialc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.marialc.com/pentesterlab-labs/recon-badge/recon_10-visual-recon.md).
# recon\_10 (visual recon)
View the exercise here: [PentesterLab: Recon 10](https://pentesterlab.com/exercises/recon_10/course)
### **OBJECTIVE**
For this challenge, your goal is to use visual reconnaissance. You will need to find the website with the key in **red**.
### **VISUAL RECONNAISSANCE**
For this challenge, the web applications are hosted under: **`0x["%02x"].a.hackycorp.com`** as in:
* **0x00.a.hackycorp.com**
* **0x01.a.hackycorp.com**
* **...**
* **0x0a.a.hackycorp.com**
* **0x0b.a.hackycorp.com**
* **...**
If you haven't done visual reconnaissance before, you can try to use the tool [**Aquatone**](https://github.com/michenriksen/aquatone) to get images that you can browse easily to find the right key (in red).
### **SOLUTION**
Let’s first try to check manually the first 4 links of the sequence.
We notice that the output color of the keys is **`blue`** and **`black`**.
The keys in the website are images, so we can solve this challenge by saving the output image of each site and then checking them visually after visiting all sites to find the text in **`red`**.
It would be very tedious to manually do this, so we’ll use a script to automate the saving of the output.
Click the tabs to see the thought process on how we arrived at the final code used to automate the printing process of the key on each page for easy viewing later.
{% tabs %}
{% tab title="Final Code" %}
For each line, the script uses `curl` to download a file named `logo.png` from the specified URL and saves it with the filename `.png`. This script helps automate the process of downloading and saving files from multiple URLs listed in a text file.
```bash
for i in `cat hosts.txt`;
do curl $i/logo.png -o $i.png
done
```
Wait until all is done.
{% endtab %}
{% tab title="Step 1" %}
We’ll first try to generate a sequence of numbers. Let’s try generating 1 to 10.
```bash
seq 1 10
```
{% endtab %}
{% tab title="Step 2" %}
We'll use a `for` loop to count from 0 to 150. The script prints each number, showing how you can easily loop through a range of numbers in a shell script.
```bash
for i in `seq 0 150`; do
echo $i
done
```
{% endtab %}
{% tab title="Step 3" %}
This `for` loop to count from 0 to 150 and print each number in its hexadecimal (base 16) format. The script converts each number to hexadecimal and displays it on a new line.
```bash
for i in `seq 0 150`; do
printf " %x\n" $i
done
```
* **`%x`** — treats the input as hex
{% endtab %}
{% tab title="Step 4" %}
Each hostname will be formatted with a hexadecimal number and appended to a file named `hosts.txt`. This script creates a list where each line follows the format `0x````.a.hackycorp.com`.
```bash
for i in `seq 0 150`; do
printf "0x%02x.a.hackycorp.com\n" $i >> hosts.txt
```
* `%02`
* `2` — means 2 digits
* `0` — as padding (e.g. `01`)
* `>>` — if just single `>`, the last line of the sequence will only be printed
{% endtab %}
{% tab title="Step 5" %}
When we print the final output, we get the desired format of the URL.
```bash
vi hosts.txt
```
{% endtab %}
{% endtabs %}
Once everything is saved, open all photos at once.
{% hint style="success" %}
Visually scan the photos to check for the key in red text.
{% endhint %}
{% hint style="success" %}
You can also open the image name back in the browser to view the key.
{% endhint %}
