> For the complete documentation index, see [llms.txt](https://www.marialc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.marialc.com/pentesterlab-labs/recon-badge/recon_26-js.md).

# recon\_26 (JS)

View the exercise here: [PentesterLab: Recon 26](https://pentesterlab.com/exercises/recon_26/course)

**OBJECTIVE**

For this challenge, your goal is to look at the server used to load assets (JavaScript, CSS) and find a hardcoded key in one of the JavaScript files.

**WHY?**

It's essential to inspect JavaScript files for hardcoded keys.

**SOLUTION**

When we `View Page Source` of hackycorp.com, we’ll see the Javascript files in this format `//assets.hackycorp.com/js/…`

Click all three links with the prefix mentioned.

<figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2FNBXlFJg8FCfPsBgKNGKb%2FScreenshot_2024-08-22_at_17.52.03.png?alt=media&amp;token=8dcabb65-c203-4c35-bbf3-42f68d9f8296" alt=""><figcaption></figcaption></figure>

{% hint style="success" %}
We’ll see the flag in the **`//assets.hackycorp.com/js/script.js`**
{% endhint %}

<figure><img src="https://290105472-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F89FZKOizBQcf0e0Qdrp8%2Fuploads%2Fwsvff4CuH5j19fehfXcA%2Fimage.png?alt=media&amp;token=8cb1a3c6-3c02-4afd-8fdc-095750bf0bb0" alt=""><figcaption></figcaption></figure>