In this video, we are going to solve the takeover room from Tryhackme, which is focused on Linux subdomain
enumeration.
The room description is very clear.
We are given a website and we only have to first enumerate the subdomains and then find the flag from
there.
And there is only one question, which is to submit the flag.
So click on access machines and download your OpenVPN credentials.
I already have my credentials in my box.
So open the terminal and connect to tryhackme VPN with sudo openvpn command.
Now start your machine.
It takes around a minute to start up.
So on our Kali machine, we are connected with OpenVPN.
Open a new tab and type in ifconfig.
So we have a new interface with the name of Tunnel Zero.
Now the next step is to have some word lists so that we can brute force the subdirectories and subdomains.
You can install it with sudo apt install command.
I already have checklists installed.
So our target machine has started up this copy its IP address and try to ping it.
Your target machine is up.
Now let's scan the target with Nmap.
The S is for stealth scan.
S V is for version enumeration, and O is OS enumeration.
We need to run this command with sudo privileges.
Repeat the command with sudo.
Now in another terminal, open your host file.
Add the IP address of the machine and the domain name.
They'll save it.
For Nmap scan or back.
And we can see that there are only three ports open for 2280 and 443.
Now open the web browser.
Let's visit the target website.
So there is only a home page on the website.
Let's try to brute force the subdomains.
Let's first do it with go-buster.
Just use the command Go-buster Vhost with and the dictionary file which is top 1 million from cyclist
dash k flag ignores all certificate errors and dash dash.
Append domain add domains to the word list.
And we get to subdomains which are blog and support.
Now let's try to enumerate subdomains with f.
This.
Use the command as shown on the screen.
We are using the same word list Dash is for host.
We are getting a lot of false positives.
Just filter these results with dash flag and give it a size of 4605.
And you can see that it has also listed blog and support subdomains.
Let's try to enumerate Http version of the website.
Does remove edge from https and repeat the command.
Now change the filter size to zero.
And we get two additional subdomains.
Now let's add these subdomains to our host file.
Open your host file and add these.
Let's first of all, open the blog.
If you get an error, click on advance and accept the risk.
There is nothing important here.
Let's just check its certificate.
You can go to security and view certificate.
There is nothing here as well.
Now let's just visit the support page.
The jacket certificate.
And you can see that we get an additional sub domain in DNS name.
Just visit it and you will get the flag.
If you cannot visit the subdomain, just add the subdomain to your host file.
Now just copy this flag and paste it in.
Try hack me.
And click submit and we have successfully completed takeover room from Tryhackme.