Subdomain Enumeration

Task 1: Brief

The answers to the questions in this task, were all in the written portion:

Task 2: OSINT - SSL/TLS Certificates

I went to, and searched for "". This got me a list:

I then ran a Control-F for the date they mentioned, and found this:

This was the answer to the question.

Task 3: OSINT - Search Engines

If you type " site:*" on, then you will find this:

This is the answer for the question.

Task 4: DNS Bruteforce

For this question, THM provides a link to View Site, which leads to a panel:

The answer was in the output.

Task 5: OSINT - Sublist3r

Similar panel to the previous question:

The answer was in the output as well.

Task 6: Virtual Hosts

I ran the command ffuf -w namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u -fs 2395 and I got the solution eventually (after 13 minutes):

Last updated