Questions

Target(s): 94.237.56.224:56139

inlanefreight.htb

1. What is the IANA ID of the registrar of the inlanefreight.com domain?

whois inlanefreight.com | grep "IANA"

2. What http server software is powering the inlanefreight.htb site on the target system? Respond with the name of the software, not the version, e.g., Apache.

curl -I inlanefreight.htb

3. What is the API key in the hidden admin directory that you have discovered on the target system?

Since the server is using nginx that utilizes vhosts, the first step is to use gobuster to enumerate the vhosts of the domain

gobuster vhost -u http://inlanefreight.htb:56139/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain -t 100

found the vhosts

web1337.inlanefreight.htb:56139

Need to now add this vhosts to my etc/hosts document

sudo sh -c "echo '94.237.53.146 web1337.inlanefreight.htb' >> /etc/hosts"

I can enumerate further and crawl this subdomain by testing the robots.txt to see if there are any hidden directories

The /admin_h1dd3n seems to be available, we can check that out

There is no luck

We can try and curl this hidden directory

┌─[✗]─[root@parrot]─[/home/z3tssu/Downloads]
└──╼ #curl -I web1337.inlanefreight.htb:56139/admin_h1dd3n
HTTP/1.1 301 Moved Permanently
Server: nginx/1.26.1
Date: Tue, 18 Mar 2025 16:27:41 GMT
Content-Type: text/html
Content-Length: 169
Location: http://web1337.inlanefreight.htb/admin_h1dd3n/
Connection: keep-alive

We see a status code 301, that mentions that this address has been moved permanently to:

http://web1337.inlanefreight.htb/admin_h1dd3n/

If we try to visit this webpage it does not work, so lets try a curl GET request

┌─[✗]─[root@parrot]─[/home/z3tssu/Downloads]
└──╼ #curl http://web1337.inlanefreight.htb:56139/admin_h1dd3n/

<!DOCTYPE html><html><head><title>web1337 admin</title></head><body><h1>Welcome to web1337 admin site</h1><h2>The admin panel is currently under maintenance, but the API is still accessible with the key e963d863ee0e82ba7080fbf558ca0d3f</h2></body></html>

PreviousWeb Archives NextQuestion 4

Last updated 2 months ago

Questions

Target(s): 94.237.56.224:56139

inlanefreight.htb

1. What is the IANA ID of the registrar of the inlanefreight.com domain?

whois inlanefreight.com | grep "IANA"

2. What http server software is powering the inlanefreight.htb site on the target system? Respond with the name of the software, not the version, e.g., Apache.

curl -I inlanefreight.htb

3. What is the API key in the hidden admin directory that you have discovered on the target system?

Since the server is using nginx that utilizes vhosts, the first step is to use gobuster to enumerate the vhosts of the domain

gobuster vhost -u http://inlanefreight.htb:56139/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain -t 100

found the vhosts

web1337.inlanefreight.htb:56139

Need to now add this vhosts to my etc/hosts document

sudo sh -c "echo '94.237.53.146 web1337.inlanefreight.htb' >> /etc/hosts"

I can enumerate further and crawl this subdomain by testing the robots.txt to see if there are any hidden directories

The /admin_h1dd3n seems to be available, we can check that out

There is no luck

We can try and curl this hidden directory

┌─[✗]─[root@parrot]─[/home/z3tssu/Downloads]
└──╼ #curl -I web1337.inlanefreight.htb:56139/admin_h1dd3n
HTTP/1.1 301 Moved Permanently
Server: nginx/1.26.1
Date: Tue, 18 Mar 2025 16:27:41 GMT
Content-Type: text/html
Content-Length: 169
Location: http://web1337.inlanefreight.htb/admin_h1dd3n/
Connection: keep-alive

We see a status code 301, that mentions that this address has been moved permanently to:

http://web1337.inlanefreight.htb/admin_h1dd3n/

If we try to visit this webpage it does not work, so lets try a curl GET request

┌─[✗]─[root@parrot]─[/home/z3tssu/Downloads]
└──╼ #curl http://web1337.inlanefreight.htb:56139/admin_h1dd3n/

<!DOCTYPE html><html><head><title>web1337 admin</title></head><body><h1>Welcome to web1337 admin site</h1><h2>The admin panel is currently under maintenance, but the API is still accessible with the key e963d863ee0e82ba7080fbf558ca0d3f</h2></body></html>

PreviousWeb Archives NextQuestion 4

Last updated 2 months ago