TryHackMe - Content Discovery

Task 1 - What Is Content Discovery?

What is the Content Discovery method that begins with M?

Manually

What is the Content Discovery method that begins with A?

Automated

What is the Content Discovery method that begins with O?

OSINT

Task 2 - Manual Discovery - Robots.txt

visiting /robots.txt gives us a directory

User-agent: *
Allow: /
Disallow: /staff-portal

/staff-portal

Task 3 - Manual Discovery - Favicon

curling the favicon and checking its md5sum

❯ curl https://static-labs.tryhackme.cloud/sites/favicon/images/favicon.ico | md5sum
  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                 Dload  Upload  Total   Spent   Left   Speed
100   1406 100   1406   0      0   4010      0                              0
f276b19aabcb4ae8cda4d22625c6735f  -

f276b19aabcb4ae8cda4d22625c6735f is the md5 hash now comparing it on https://wiki.owasp.org/index.php/OWASP_favicon_database we get

f276b19aabcb4ae8cda4d22625c6735f:cgiirc (0.5.9)

What framework did the favicon belong to?

cgiirc

Task 4 - Manual Discovery - Sitemap.xml

checking the /sitemap.xml we observe a secret directory

<url>
<loc>http://MACHINE-IP/s3cr3t-area</loc>
<lastmod>2021-07-19T13:07:32+00:00</lastmod>
<priority>0.80</priority>
</url>

What is the path of the secret area that can be found in the sitemap.xml file?

/s3cr3t-area

Task 5 - Manual Discovery - HTTP Headers

What is the flag value from the X-FLAG header?

THM{HEADER_FLAG}

Task 6 - Manual Discovery - Framework Stack

visiting https://static-labs.tryhackme.cloud/sites/thm-web-framework we can see Documentation section

Documentation

The documentation for the framework is pre-installed on your websites administration portal.

Once you've installed the framework navigate to the **/thm-framework-login** path on your website.

You can login with the username **admin** and password **admin** ( make sure you change this password )

now visiting /thm-framework-login on the server and logging in with admin:admin (default credentials) we get our flag

What is the flag from the framework’s administration portal?

THM{CHANGE_DEFAULT_CREDENTIALS}

Task 7 - OSINT - Google Hacking / Dorking

What Google dork operator can be used to only show results from a particular site?

site:

Task 8 - OSINT - Wappalyzer

What online tool can be used to identify what technologies a website is running?

Wappalyzer

Task 9 - OSINT - Wayback Machine

What is the website address for the Wayback Machine?

https://archive.org/web/

Task 10 - OSINT - GitHub

What is Git?

version control system

Task 11 - OSINT - S3 Buckets

What URL format do Amazon S3 buckets end in?

.s3.amazonaws.com

Task 12 - Automated Discovery

running gobuster against the machine with common.txt web content seclists this is the output at least I got

❯ gobuster dir --url http://MACHINE-IP/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://MACHINE-IP/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
assets               (Status: 301) [Size: 178] [--> http://MACHINE-IP/assets/]
contact              (Status: 200) [Size: 3108]
customers            (Status: 302) [Size: 0] [--> /customers/login]
development.log      (Status: 200) [Size: 27]
monthly              (Status: 200) [Size: 28]
news                 (Status: 200) [Size: 2538]
private              (Status: 301) [Size: 178] [--> http://MACHINE-IP/private/]
robots.txt           (Status: 200) [Size: 46]
sitemap.xml          (Status: 200) [Size: 1391]
Progress: 4751 / 4751 (100.00%)
===============================================================
Finished
===============================================================

What is the name of the directory beginning “/mo….” that was discovered?

/monthly

What is the name of the log file that was discovered?

/development.log