Information Gathering - Web Edition

HTB Content
1

Hey guys

I managed to get to the last question in the Skills Assement of the updated Information Gathering - Web Edition
" What is the API key the inlanefreight.htb developers will be changing too?"

I tried to use FinalRecon to enumerate the inlanefreight.htb in order to find the api key.

Does anyone has any hint?

2

I have the same problem, im only see the inlanefreight.htb
image

I tried searching for subdomains and so on but no luck.

3

Use FinalRecon to find more subdoamins and then to find robots.txt

4

Hey bro, i did it and i don’t get it, this is what i did:

python3 FinalRecon/finalrecon.py --full --url http://inlanefreight.htb:33423

5

What didn’t you get?

6

more subdoamins

7

And now find the robots.txt (:

8

Sorry man, but I don’t understand. I can only see the “inlanefreight.htb:33423” domain. I’ve tried ffuf and virtual host…

imagen
imagen1011Ă—848 93.5 KB

9

Go over the following process:

  1. add inlanefreight.htb to hosts
  2. gobuster vhost inlanefreight.htb and find the subdomain
  3. add the subdomain to hosts
  4. use finalrecon to see what you find
  5. use gobuster the next subdoamin
    and go on
    you will see the link to robots.txt from there.

If you are having more issues, DM me

Good luck

3 Likes
10

Try use ReconSpider for the second subdomain to find the API key for the developers.

11

I’m not finding anything with gobuster any other hints?

image
image1592Ă—684 183 KB

thi is the command i’m using gobuster vhost -u http://inlanefreight.htb:52951 -w /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt --append-doma
in

12

Looks like the target has expired. I am able to retrieve the first subdomain with your command.

13

Yeah I’m not sure what happened but I kept trying and eventually got it lol… for anyone else stuck once you find the correct vhost re read the crawling section there’s a new tool that instantly finds the api key. The robots.txt is bait. Good luck dm or reply if you need more help

1 Like
14

HTB changed the files names and the directories name in the new update of the pwnbox.
I urge you to check the path and the file names.
For example, see how they change the following path:
/usr/share/seclists/Discovery/DNS - see seclists

Best of luck

15

try dnsenum

16

After tryhard, i’m finish this module, this 's difficult for me. I have read and consulted many people’s instructions.
to be able to solve it, let’s add first target ip and vHost domain to /etc/hosts, brute force vhost to find new vhost, add it to /etc/hosts and do it again See if you can find anything new.
use crawing tools and reconnaise tools learned in the lesson applies to all domain, directory path found to find flag.
Finally, try hard and you will succeed

1 Like
17

Morning, Everyone.

I managed to complete all the points on the assestment, except for the question

What is the API key in the hidden admin directory that you have discovered on the target system?

I would like to request a hint to solve it, I’ve already managed to get all the other questions but i could not get the API key based on the robots.txt file.

Thanks.
Edit: I tried to use Gobuster on the robots.txt admin domain, but still didnt got any answer.
Edit 2: Found it. Used gobuster with the common.txt

1 Like
18

Find the subdomain and and “finalize” the recon :wink:

19

Hi @Jomomo05 ,can you kindly give a tip about this gobuster with common.txt you used?
I tried with gobuster or ffuf with this wordlist but no success (to look for subdomain or endpoint)
Is there a third subdomain or where to look for this admin URL ??

20

Assuming that you already found the robots.txt file, you have to use gobuster on dir mode using the URL of the disallowed domain AND the disallowed directory. As an example: .htb:12345/thisdirectory/