DEV Community

maz4l
maz4l

Posted on • Updated on

HTB Academy: Information Gathering - Web Edition Module: Skills Assessment (Part II, Question 5)

Image description

HTB Academy: Information Gathering - Web Edition Module(Updated): Skills Assessment

(Part II, Question 5)

To complete this skills assessment, you will need to apply various techniques learned in this module, including:

  • Using whois
  • Analyzing robots.txt
  • Performing subdomain brute-forcing
  • Crawling and analyzing results

Demonstrate your proficiency by effectively utilizing these techniques. Remember to add subdomains to your hosts file as you discover them.

Questions:

vHosts needed for these questions:

  • inlanefreight.htb

Answer:

Question 5: What is the API key the inlanefreight.htb developers will be changing to?

Step 1: Add TARGET_IP and vhost to hosts



sudo nano /etc/hosts
<TARGET_IP>   inlanefreight.htb


Enter fullscreen mode Exit fullscreen mode

Step 2: Find subdomains with gobuster



gobuster vhost -u http://inlanefreight.htb:$PORT -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain


Enter fullscreen mode Exit fullscreen mode

Step 3: Add new domain to hosts



sudo nano /etc/hosts
<TARGET_IP>  web1337.inlanefreight.htb


Enter fullscreen mode Exit fullscreen mode

Step 4: Use gobuster with new subdomain and add result to hosts



gobuster vhost -u http://web1337.inlanefreight.htb:$PORT -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain


Enter fullscreen mode Exit fullscreen mode

Result:



Found: dev.web1337.inlanefreight.htb:PORT Status: 200


Enter fullscreen mode Exit fullscreen mode

Step 5: Install scrapy and ReconSpider



pip3 install scrapy

wget -O ReconSpider.zip https://academy.hackthebox.com/storage/modules/144/ReconSpider.v1.2.zip

unzip ReconSpider.zip

python3 ReconSpider.py http://dev.web1337.inlanefreight.htb:$PORT 


Enter fullscreen mode Exit fullscreen mode

Step 6: Analyze the results



cat results.json


Enter fullscreen mode Exit fullscreen mode

Extracted Comments:



{
    "emails": [
        "1337testing@inlanefreight.htb"
    ],
    "links": [
        "http://dev.web1337.inlanefreight.htb:58951/index-808.html",
        "http://dev.web1337.inlanefreight.htb:58951/index-829.html",
...
...
 ],
    "external_files": [],
    "js_files": [],
    "form_fields": [],
    "images": [],
    "videos": [],
    "audio": [],
    "comments": [
"<!-- Remember to change the API key to ba****************************** -->"


Enter fullscreen mode Exit fullscreen mode

Great! Happy Hunting!
To get more Academy cubes: subscribe!

HTB ACADEMY Badge

Go to Module

Top comments (0)