Web Recon Skill Assessment Question 3

HTB Content Academy
62

Is anyone having the following issues with FinalRecon? I did a clean install from the git repo like in the instructions I just cant get it to work:

image
image950×698 61.9 KB

63

I just had the same problem… I installed it like this:

64

Thanks for the reply but Im getting the same response:

image
image976×711 62.5 KB

65

Ah no… Stop… I also did the following:

  • inside your finalrecon folder create a venv for python
  • syntax = python3 -m venv [choose a name for the folder]
  • then activate it = source [folder name]/bin/activate
  • now on the left side of your cli you should see this name
  • now pip3 install [check requirements for what is needed]
  • now run finalrecon = python3 finalrecon.py --full --url http://target.com

This works for me at least. Credit for the python venv goes to @R19htByt3
You can read more about this here https://docs.python.org/3/tutorial/venv.html

4 Likes
66

woooow this was perfect. Thank you for the clear explanation

image
image930×1079 90.2 KB

67

You are welcome :slight_smile: Oh and to get out of this venv you simply type deactivate in your cli. The folder name should disapear again :+1:

1 Like
68

Thanks again for the great help, were you stuck on #4 or #5? Cant seem to find what subdomain to crawl, I crawled both the original and the w…inlanefreight.htb and no emails. ReconSpider doesnt seem to be giving any results regarding that

69

I hope this hint isn’t too much, but these two are not the only domains. You should look for even “deeper” domains if you know what I meen :slight_smile: Also: one option inside GoBuster that made the difference for me, was the option --append-domain

70

just found on youtube, there is new updated video for this since yesterday.
good luck and thanks!

71

Hi everybody ! I finally had time to finish this assessment. The biggest part of my problems was my antivirus software blocking my gobuster and fuff requests. If you have any question on any part of this assessment I will be glad to help. Thanks everyone and good luck !

72

Virtual Environment: Sometimes, using a virtual environment avoids many issues.
As mentioned before, create the virtual environment, and you can run the tool.

python3 -m venv myenv 
source myenv/bin/activate
73

I was having the same issue “No module named ‘tldextract’”

Following these steps helped me, thank you.

Question - How can you identify when a virtual environment is required? In the event the same issue comes up with a different tool

74

thank you so much! this was driving me insane!

75

Man that one was tough to work out but so easy once you do figure it out! For those seeing this and still stuck, be sure to keep adding new vhosts that you find to your host file and do all your scans on everything you find!

1 Like
76

yes… it was driving me crazy as well :smiley: Credit for the python venv goes to @R19htByt3

77

I will recommend to use the Pwnbox for this exercise.

78

Use -t to increase gobuster thread and speed (i use -t 200 for gobuster it’s really fast Lol)

  1. gobuster inlanefreight
  2. gobuster web****
  3. final recond web**** to get robots.txt
  4. For each new one don’t forget to add them into /etc/hosts (e.g. web****)
  5. run final recon on web**** to obtain the admin_??? folder → get index file to obtain key
  6. gobuster web**** again → found dev domain
  7. Final recon web domain will get the index file of dev domain
  8. then Spider Crawl that index file
79

Hi,
I know this is an old thread but,
I was getting the same error
“AttributeError: ‘TLDExtract’ object has no attribute ‘tldextract’”
It seems there is a mismatch between versions of TLDextract. If you use the requirements files or install it manually you get a newer version of the library.
as a small fix you can change your line 187 with:
parsed_url = extractor(target)
After this my finalRecon works.
:slight_smile: