Possibly Related Threads…

raiderado · (This post was last modified: Jan 20, 2024, 10:03 PM by raiderado.)

(Jan 20, 2024, 09:33 PM)ajasjas Wrote: It's a DC, it has a DNS server.... you brute force subdomains via DNS using the host as the resolver. If it exists it will resolve it, if not it will return NX or such. gobuster does this, every other tool for DNS bruteforcing does it too.

I have one question. What if the target is not a DNS server, what custom DNS resolver we give in that case with Gobuster. Gateway IP ?

youssefm55 · Jan 20, 2024, 10:00 PM

(Jan 20, 2024, 09:51 PM)Shalabi Wrote:
(Jan 20, 2024, 09:47 PM)youssefm55 Wrote:
(Jan 20, 2024, 09:33 PM)ajasjas Wrote: It's a DC, it has a DNS server.... you brute force subdomains via DNS using the host as the resolver. If it exists it will resolve it, if not it will return NX or such. gobuster does this, every other tool for DNS bruteforcing does it too.

I am doing this but no results are coming out

You have to use dns param not vhost

this was the command I used is there sth wrong about it??
gobuster dns -d analysis.htb -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt

raiderado · (This post was last modified: Jan 20, 2024, 10:02 PM by raiderado.)

(Jan 20, 2024, 10:00 PM)youssefm55 Wrote:
(Jan 20, 2024, 09:51 PM)Shalabi Wrote:
(Jan 20, 2024, 09:47 PM)youssefm55 Wrote:
(Jan 20, 2024, 09:33 PM)ajasjas Wrote: It's a DC, it has a DNS server.... you brute force subdomains via DNS using the host as the resolver. If it exists it will resolve it, if not it will return NX or such. gobuster does this, every other tool for DNS bruteforcing does it too.

I am doing this but no results are coming out

You have to use dns param not vhost
this was the command I used is there sth wrong about it??
gobuster dns -d analysis.htb -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt

include -r DNSIP: PORT

youssefm55 · Jan 20, 2024, 10:04 PM

(Jan 20, 2024, 10:02 PM)raiderado Wrote:
(Jan 20, 2024, 10:00 PM)youssefm55 Wrote:
(Jan 20, 2024, 09:51 PM)Shalabi Wrote:
(Jan 20, 2024, 09:47 PM)youssefm55 Wrote:
(Jan 20, 2024, 09:33 PM)ajasjas Wrote: It's a DC, it has a DNS server.... you brute force subdomains via DNS using the host as the resolver. If it exists it will resolve it, if not it will return NX or such. gobuster does this, every other tool for DNS bruteforcing does it too.

I am doing this but no results are coming out

You have to use dns param not vhost
this was the command I used is there sth wrong about it??
gobuster dns -d analysis.htb -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt

include -r DNSIP: PORT

ok great thanks bro

Art10n · Jan 20, 2024, 10:20 PM

Found: www.analysis.htb
Found: internal.analysis.htb
Found: domaindnszones.analysis.htb
Found: forestdnszones.analysis.htb

youssefm55 · Jan 20, 2024, 10:27 PM

(Jan 20, 2024, 10:20 PM)Art10n Wrote: Found: www.analysis.htb
Found: internal.analysis.htb
Found: domaindnszones.analysis.htb
Found: forestdnszones.analysis.htb

also there is gc._msdcs.analysis.htb

xxxbfacc · Jan 20, 2024, 10:31 PM

list.php?name= is an injectable ldap query.
So far all I can do is get a few usernames, and enumerate a bunch of uninstersting ldap attributes.

Guessing login form is also an ldap injection.

Lights_Out · Jan 20, 2024, 10:49 PM

I found this

http://internal.analysis.htb/employees/login.php

Art10n · Jan 20, 2024, 10:54 PM

[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]

Dr1s · (This post was last modified: Jan 20, 2024, 11:08 PM by Dr1s.)

Also anonymos login is eanbled in port 135 rpc.... use rpcclient

(Jan 20, 2024, 10:54 PM)Art10n Wrote: [+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]
[+] VALID USERNAME: [email protected]

how did u found this?

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[FREE] HackTheBox Academy - CBBH CDSA CPTS All Modules Flags	Techtom	110	14,223	4 hours ago Last Post: Kazahk
	[FREE] HackTheBox All Cheatsheets	Tamarisk	85	11,233	4 hours ago Last Post: Kazahk
	[MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot	htb-bot	165	34,714	Today, 08:27 AM Last Post: groningen1981
	Finding solutions/flags/writeups for challenges	meomeothantai	0	165	Today, 04:13 AM Last Post: meomeothantai
	[FREE] HackTheBox Dante - complete writeup written by Tamarisk	Tamarisk	625	115,385	Today, 03:26 AM Last Post: kevin25hxl