Map the target
Profile the target before attacking it. Fingerprint the server from its headers and run a content-discovery sweep over a small wordlist, saving both to map.txt in your home: the server banner and the paths that exist.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
A few headers named the stack, and a short wordlist loop turned up real endpoints that nothing links to — the map you build in recon decides where the rest of the test goes. Defenders can't stop recon, so they shrink the surface: inventory assets, hide stack details, keep internal APIs off the internet, and watch for the 404 storm that content discovery leaves in the logs.
Show solution
cd /home/student
: > map.txt
for p in '' api/ping app/login app/search app/admin graphql app/upload app/panel nope123; do
echo "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/$p) /$p" >> map.txt
done
curl -s -I http://127.0.0.1:8080/ >> map.txt
cat map.txt