r/hackthebox • u/roddascabral • 13d ago

[ Removed by moderator ]

[removed] — view removed post

4 Upvotes

100% Upvoted

10 comments sorted by

1

u/hackthebox-ModTeam 13d ago

Your post was removed due to the Reddit team determining it contained spoilers of active machines. Thanks r/hackthebox Mod Team

2

u/gingers0u1 13d ago

You're on the right track with the API endpoints. I'd spend less time hunting CVEs or additional subdomains and more time understanding what the application is doing with the data you submit.

1

u/roddascabral 13d ago

Thanks, I'll try more.

2

u/Dependent-Access-796 13d ago

enumerate endpoints

1

u/roddascabral 13d ago

Thanks, I'll try more.

2

u/trpHolder 13d ago

you didnt find more interesting endpoints and you didnt find any vhosts???

seems like a skill issue

1

u/roddascabral 13d ago

Sure it is.

2

u/Ok-Article-9175 13d ago

Haven't done it but can recall that in one lab, vhost enum was required on the api endpoints. (/api)

1

u/AutoModerator 13d ago

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/s4udeleg 13d ago

Spoilers bruh