CTT - Compare Tree&Text for Windows
(C) 1991-2024 Giuliano Artico
ffuf -u http://10.10.10.200/FUZZ -w common.txt # Finds: /assets (301), /hidden (200), /index.php (200)
Finds : ?id=
-fs 1495 : This is the most important flag. It hides responses that have a specific byte size (like the default "404" or "Welcome" page), allowing the unique vhosts to pop up. Phase C: Parameter Fuzzing (GET/POST) htb skills assessment - web fuzzing
For this assessment, you are encouraged to use a variety of tools such as: ffuf -u http://10
to uncover hidden subdomains, directory structures, and parameters to retrieve a final flag. Key steps include VHost discovery, recursive directory enumeration, and fuzzing for specific parameter values to bypass security filters. For a detailed walkthrough of the assessment, visit Demacia's blog Web Fuzzing Course - HTB Academy recursive directory enumeration
Typical findings & remediation (examples)