Possibly Related Threads…

raiderado · (This post was last modified: 01-20-2024, 10:03 PM by raiderado.)

(01-20-2024, 09:33 PM)ajasjas Wrote: It's a DC, it has a DNS server.... you brute force subdomains via DNS using the host as the resolver. If it exists it will resolve it, if not it will return NX or such. gobuster does this, every other tool for DNS bruteforcing does it too.

I have one question. What if the target is not a DNS server, what custom DNS resolver we give in that case with Gobuster. Gateway IP ?

youssefm55 · 01-20-2024, 10:00 PM

(01-20-2024, 09:51 PM)Shalabi Wrote:
(01-20-2024, 09:47 PM)youssefm55 Wrote:
(01-20-2024, 09:33 PM)ajasjas Wrote: It's a DC, it has a DNS server.... you brute force subdomains via DNS using the host as the resolver. If it exists it will resolve it, if not it will return NX or such. gobuster does this, every other tool for DNS bruteforcing does it too.

I am doing this but no results are coming out

You have to use dns param not vhost

this was the command I used is there sth wrong about it??
gobuster dns -d analysis.htb -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt

raiderado · (This post was last modified: 01-20-2024, 10:02 PM by raiderado.)

(01-20-2024, 10:00 PM)youssefm55 Wrote:
(01-20-2024, 09:51 PM)Shalabi Wrote:
(01-20-2024, 09:47 PM)youssefm55 Wrote:
(01-20-2024, 09:33 PM)ajasjas Wrote: It's a DC, it has a DNS server.... you brute force subdomains via DNS using the host as the resolver. If it exists it will resolve it, if not it will return NX or such. gobuster does this, every other tool for DNS bruteforcing does it too.

I am doing this but no results are coming out

You have to use dns param not vhost
this was the command I used is there sth wrong about it??
gobuster dns -d analysis.htb -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt

include -r DNSIP: PORT

youssefm55 · 01-20-2024, 10:04 PM

(01-20-2024, 10:02 PM)raiderado Wrote:
(01-20-2024, 10:00 PM)youssefm55 Wrote:
(01-20-2024, 09:51 PM)Shalabi Wrote:
(01-20-2024, 09:47 PM)youssefm55 Wrote:
(01-20-2024, 09:33 PM)ajasjas Wrote: It's a DC, it has a DNS server.... you brute force subdomains via DNS using the host as the resolver. If it exists it will resolve it, if not it will return NX or such. gobuster does this, every other tool for DNS bruteforcing does it too.

I am doing this but no results are coming out

You have to use dns param not vhost
this was the command I used is there sth wrong about it??
gobuster dns -d analysis.htb -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-20000.txt

include -r DNSIP: PORT

ok great thanks bro

Art10n · 01-20-2024, 10:20 PM

Found: www.analysis.htb
Found: internal.analysis.htb
Found: domaindnszones.analysis.htb
Found: forestdnszones.analysis.htb

youssefm55 · 01-20-2024, 10:27 PM

(01-20-2024, 10:20 PM)Art10n Wrote: Found: www.analysis.htb
Found: internal.analysis.htb
Found: domaindnszones.analysis.htb
Found: forestdnszones.analysis.htb

also there is gc._msdcs.analysis.htb

xxxbfacc · 01-20-2024, 10:31 PM

list.php?name= is an injectable ldap query.
So far all I can do is get a few usernames, and enumerate a bunch of uninstersting ldap attributes.

Guessing login form is also an ldap injection.

Lights_Out · 01-20-2024, 10:49 PM

I found this

http://internal.analysis.htb/employees/login.php

Art10n · 01-20-2024, 10:54 PM

[+] VALID USERNAME: jdoe@analysis.htb
[+] VALID USERNAME: ajohnson@analysis.htb
[+] VALID USERNAME: cwilliams@analysis.htb
[+] VALID USERNAME: wsmith@analysis.htb
[+] VALID USERNAME: jangel@analysis.htb
[+] VALID USERNAME: technician@analysis.htb

Dr1s · (This post was last modified: 01-20-2024, 11:08 PM by Dr1s.)

Also anonymos login is eanbled in port 135 rpc.... use rpcclient

(01-20-2024, 10:54 PM)Art10n Wrote: [+] VALID USERNAME: jdoe@analysis.htb
[+] VALID USERNAME: ajohnson@analysis.htb
[+] VALID USERNAME: cwilliams@analysis.htb
[+] VALID USERNAME: wsmith@analysis.htb
[+] VALID USERNAME: jangel@analysis.htb
[+] VALID USERNAME: technician@analysis.htb

how did u found this?

Possibly Related Threads…
Thread		Author	Replies	Views	Last Post
	[MEGALEAK] HackTheBox ProLabs, Fortress, Endgame - Alchemy, 250 Flags, leak htb-bot	htb-bot	106	42,235	10-31-2026, 07:33 PM Last Post: aistax
	[FREE] 300+ Writeups PDF HackTheBox/HTB premium retired	Tamarisk	383	138,755	10-31-2026, 11:47 AM Last Post: thaytoiyeucoay30nam
	HTB PWN- Oxidized ROP	macavitysworld	4	1,042	10-29-2026, 01:01 PM Last Post: A1Raid3r
	HTB - code + titanic walkthrough \| free	tony_boom23	3	7,259	10-25-2026, 06:35 AM Last Post: A1Raid3r
	HTB apt lab note	zapot	14	35,532	10-03-2026, 08:09 PM Last Post: whuuaa