Getting Started | Web Enumeration | Quick Solve
Tags: writeup, hackthebox, htbacademy, webenumeration
Published: 2023-12-25 22:00:54

Today's post is going to be a walkthrough of the steps I took to find the flag for the challenge question in the [Web Enumeration](https://academy.hackthebox.com/module/77/section/728) section of the [Getting Started](https://academy.hackthebox.com/module/details/77) module on Hack The Box Academy.

You can also watch the walkthrough here:
{% youtube oFSiiHpoOSU %}

### Quick Overview
This section talks about file/directory & DNS enumeration using tools such as [ffuf](https://github.com/ffuf/ffuf) or [GoBuster](https://github.com/OJ/gobuster), and provides some helpful tips for web enumeration.  It dives into different sources and tools that can be used to find helpful information about a target.  I encourage you to read through the module and attempt the challenge on your own first.

### The Task and Target

*Try running some of the web enumeration techniques you learned in this section on the server above, and use the info you get to get the flag.*

Target: 94.237.56.188:34678 (I save this right away to my notes for this lab)

![Target](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zxirfei8xqutpy27fzuo.png)

Hack The Box Academy gives you an instance of their virtual machine in order to do these questions.  I prefer to use my own Kali Linux virtual machine, so I'll be using that during this walkthrough.

My approach to these tasks since I'm still very new is to basically try everything and see what happens.  Since all of my efforts don't always lead to anything of use, I won't include those steps in this post. I do, however, keep extensive notes on everything I do.  That way, if I come across something similar in the future, I can reference back to what I did.  Also, since this is more just a walkthrough, I'll let you refer to the module for more information on the specifics of the commands and such.

Anyway, let's dive in! 😊

### The Walkthrough

In lieu of using the provided Pwnbox which uses an instance of Parrot Linux, I will use my own Kali Linux virtual machine. Since I am using Parallels, my machine is setup with a default user that I log in with. To make things easier, I want to switch to the root user.  To do this, I just run the command `sudo su` and enter my password.

![sudo su command terminal image](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l233p097y42h7e2iarqt.png)

Now that I'm the root user, I want to `cd` into `/` (Root directory) and run a scan on the target using GoBuster and the `dirb common.txt` wordlist.

`gobuster dir -u http://94.237.56.188:34678 -w /usr/share/dirb/wordlists/common.txt`

This can take several minutes, but once it's done you should have an output that looks similar to this:

![command output image](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jbm9dolao7fqp2qgkdr3.png)

I save the output to my notes, since it's easier to reference back to than scrolling back up in the command line.

Checking out the results of the output, we can see that there is a `/robots.txt` file with an HTTP status code of `200`, which is a standard response for successful HTTP requests.  You can find a handy cheat sheet of HTTP status codes [here](https://en.wikipedia.org/wiki/List_of_HTTP_status_codes).

Let's next navigate to the target url in the browser, and append the `/robots.txt` to the end to see what we can come up with there.

![navigate to robots.txt in browser](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7cbfte1rabnu2apgzc1u.png)

Here, we can see that the `robots.txt` file contains one disallowed entry.  Navigating to http://94.237.56.188:34678/admin-login-page.php in the browser brings us to an Admin Panel login page.

![navigate to admin panel in browser](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/myg1w7wd55vo0c9cjg1q.png)

Let's take a look at the source code. You can either right-click and choose "Inspect" to open developer tools, or hit `CTRL + U` on your keyboard.

Inspecting the code, I can see a comment at the bottom that contains some test credentials.

![source code screenshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wzv4rzre7z8obch3429s.png)

I go back to the login page and enter the credentials, which brings us to the flag to submit and complete the challenge. 😊 

I hope you enjoyed this walkthrough and found it helpful.  Thanks for reading!

Connect with me:
Twitter: [@sarah_schlueter](https://twitter.com/sarah_schlueter)
Discord: [sarahmarie73](discordapp.com/users/529736403530285076)