HTB Academy Write-Up: Virtual Host Enumeration

Objective:

The goal of this lab was to brute-force virtual hosts (vhosts) on the target system to find a specific subdomain prefixed with the word "web" (e.g., web-something.inlanefreight.htb).

Phase: Initial Setup and DNS Resolution Failures

The first attempt to interact with the target involved pinging the domain inlanefreight.htb. This immediately returned a "could not find host" or timeout error.

The Error: The .htb top-level domain is a private, fake domain used exclusively within the Hack The Box environment. The local machine was querying public DNS servers, which had no record of this address.

The Fix:

The target IP address and the domain name had to be manually mapped in the local hosts file.

• On Windows, this meant editing C:\Windows\System32\drivers\etc\hosts as an Administrator.
• On Linux (like the HTB Pwnbox), this meant editing /etc/hosts using sudo nano.

Adding the line 154.57.164.71 inlanefreight.htb allowed the system to properly resolve the domain to the target IP.

Phase: Vhost Routing and Header Misconfigurations

With the ping succeeding, the next step was running Gobuster to brute-force the subdomains. The initial command used was:

gobuster vhost -u http://154.57.164.71:30878 -w [wordlist] --append-domain

The Error:

The scan completed quickly but returned zero results. The mistake was using the IP address in the -u flag instead of the base domain name.

The Fix:

Virtual host routing relies on the HTTP Host header. By providing the IP address, Gobuster was constructing invalid headers (e.g., Host: admin.154.57.164.71). The target server expects headers formatted as Host: admin.inlanefreight.htb. The command was corrected to use the domain name in the URL flag.

Phase: Environment Confusion and Missing Hosts

After updating the Gobuster command to use the domain name, a new error appeared: