┌──(root㉿kali)-[/home/kali] └─# nmap -sV 10.129.115.172 Starting Nmap 7.93 ( <https://nmap.org> ) at 2023-07-14 03:36 EDT Nmap scan report for 10.129.115.172 Host is up (0.30s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at <https://nmap.org/submit/> . Nmap done: 1 IP address (1 host up) scanned in 108.80 seconds
┌──(root㉿kali)-[/home/kali] └─# echo"10.129.115.172 thetoppers.htb" | tee -a /etc/hosts 10.129.115.172 thetoppers.htb
┌──(kali㉿kali)-[~] └─$ gobuster dns --help Uses DNS subdomain enumeration mode
Usage: gobuster dns [flags]
Flags: -d, --domain string The target domain -h, --helphelpfor dns -r, --resolver string Use custom DNS server (format server.com or server.com:port) -c, --show-cname Show CNAME records (cannot be used with '-i' option) -i, --show-ips Show IP addresses --timeout duration DNS resolver timeout (default 1s) --wildcard Force continued operation when wildcard found
Global Flags: --delay duration Time each thread waits between requests (e.g. 1500ms) --no-color Disable color output --no-error Don't display errors -z, --no-progress Don't display progress -o, --output string Output file to write results to (defaults to stdout) -p, --pattern string File containing replacement patterns -q, --quiet Don't print the banner and other noise -t, --threads int Number of concurrent threads (default 10) -v, --verbose Verbose output (errors) -w, --wordlist string Path to the wordlist
┌──(kali㉿kali)-[~] └─$ gobuster vhost --help Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter)
Usage: gobuster vhost [flags]
Flags: --append-domain Append main domain from URL to words from wordlist. Otherwise the fully qualified domains need to be specified in the wordlist. --client-cert-p12 string a p12 file to use for options TLS client certificates --client-cert-p12-password string the password to the p12 file --client-cert-pem string public key in PEM format for optional TLS client certificates --client-cert-pem-key string private key in PEM format for optional TLS client certificates (this key needs to have no password) -c, --cookies string Cookies to use for the requests --domain string the domain to append when using an IP address as URL. If left empty and you specify a domain based URL the hostname from the URL is extracted --exclude-length ints exclude the following content length (completely ignores the status). Supply multiple times to exclude multiple sizes. -r, --follow-redirect Follow redirects -H, --headers stringArray Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2' -h, --helphelpfor vhost -m, --method string Use the following HTTP method (default "GET") --no-canonicalize-headers Do not canonicalize HTTP header names. If set header names are sent as is. -k, --no-tls-validation Skip TLS certificate verification -P, --password string Password for Basic Auth --proxy string Proxy to use for requests [http(s)://host:port] --random-agent Use a random User-Agent string --retry Should retry on request timeout --retry-attempts int Times to retry on request timeout (default 3) --timeout duration HTTP Timeout (default 10s) -u, --url string The target URL -a, --useragent string Set the User-Agent string (default "gobuster/3.5") -U, --username string Username for Basic Auth
Global Flags: --delay duration Time each thread waits between requests (e.g. 1500ms) --no-color Disable color output --no-error Don't display errors -z, --no-progress Don't display progress -o, --output string Output file to write results to (defaults to stdout) -p, --pattern string File containing replacement patterns -q, --quiet Don't print the banner and other noise -t, --threads int Number of concurrent threads (default 10) -v, --verbose Verbose output (errors) -w, --wordlist string Path to the wordlist