• As the room description says that it revolves around subdomain enumeration.
• We start with subdomain enumeration.
• First we need to add the address (futurevera.thm) to our /etc/hosts file.

• Then we perform subdomain enumeration using the tool ffuf on http protocol.

$ ffuf -u <http://futurevera.thm/> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.futurevera.thm" -fs 0   
                           
                                                                                                                                                                            
        /'___\\  /'___\\           /'___\\                                                                                                                                     
       /\\ \\__/ /\\ \\__/  __  __  /\\ \\__/                                                                                                                                     
       \\ \\ ,__\\\\ \\ ,__\\/\\ \\/\\ \\ \\ \\ ,__\\                                                                                                                                    
        \\ \\ \\_/ \\ \\ \\_/\\ \\ \\_\\ \\ \\ \\ \\_/                                                                                                                                    
         \\ \\_\\   \\ \\_\\  \\ \\____/  \\ \\_\\                                                                                                                                     
          \\/_/    \\/_/   \\/___/    \\/_/                                                                                                                                     

       v1.5.0 Kali Exclusive <3
________________________________________________

 :: Method           : GET
 :: URL              : <http://futurevera.thm/>
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.futurevera.thm
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
 :: Filter           : Response size: 0

portal                  [Status: 200, Size: 69, Words: 9, Lines: 2, Duration: 487ms]
payroll                 [Status: 200, Size: 70, Words: 9, Lines: 2, Duration: 667ms]
[WARN] Caught keyboard interrupt (Ctrl-C)

• Used the -fs flag to enumerate responses of 0 size.
• Got two subdomains, and added them in the /etc/hosts file
• Visited http://portal.futurevera.thm and http://payroll.futurevera.thm but nothing interesting there.

• Also checked the certificates but got nothing interesting.
• Then performed subdomain enumeration with the https protocol.

• But it was giving many responses with same response size i.e. 4605.
• Hence, used response filter and again run the command.

$ ffuf -u <https://10.10.203.180/> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.futurevera.thm" -fs 4605

        /'___\\  /'___\\           /'___\\       
       /\\ \\__/ /\\ \\__/  __  __  /\\ \\__/       
       \\ \\ ,__\\\\ \\ ,__\\/\\ \\/\\ \\ \\ \\ ,__\\      
        \\ \\ \\_/ \\ \\ \\_/\\ \\ \\_\\ \\ \\ \\ \\_/      
         \\ \\_\\   \\ \\_\\  \\ \\____/  \\ \\_\\       
          \\/_/    \\/_/   \\/___/    \\/_/       

       v1.5.0 Kali Exclusive <3
________________________________________________

 :: Method           : GET
 :: URL              : <https://10.10.203.180/>
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.futurevera.thm
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
 :: Filter           : Response size: 4605
________________________________________________

support                 [Status: 200, Size: 1522, Words: 367, Lines: 34, Duration: 1431ms]
blog                    [Status: 200, Size: 3838, Words: 1326, Lines: 81, Duration: 416ms]

• Got two subdomains and added them in /etc/hosts file.