FEAT:๐ฉ HTBใVariaTypeใMedium
Easy, Linux
FEAT:๐ฉ HTBใVariaTypeใMedium
ใใฎใใทใณใฏ
2026/04/07็พๅจใขใฏใใฃใใงใ๏ผ่งฃๆณใฎๅ ฑๆใฏ็ฆๆญขใใใฆใใพใ๏ผ
Reconnaissance & Initial Enumeration
ssh ใจ http nginx ใฎใทใณใใซใชใตใผใในใๅไฝใใฆใใพใ๏ผ
ใใผใในใญใฃใณ
1
2
3
4
5
6
7
8
9
10
11
12
$ nmap variatype.htb -p- -sV --min-rate 1000
Starting Nmap 7.98 ( https://nmap.org ) at 2026-04-06 20:37 +0900
Nmap scan report for variatype.htb (10.129.244.202)
Host is up (0.14s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
80/tcp open http nginx 1.22.1
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 77.36 seconds
ๅญๅจใใชใVHOSTใงใฎใฌในใใณในใตใคใบ (Content-Length: 169) ใงใใฃใซใฟใชใณใฐใใพใ๏ผ portal ใจใใไปฎๆณใในใ (VHOST) ใ็บ่ฆใใพใใ๏ผ/etc/hosts ใซ่ฟฝๅ ใใฆใใใพใ๏ผ
VHOST & ใตใใใกใคใณๆข็ดข
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
$ curl -s -i -H "Host: xxx.variatype.htb" http://variatype.htb
HTTP/1.1 301 Moved Permanently
Server: nginx/1.22.1
Date: Tue, 07 Apr 2026 01:59:33 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: http://variatype.htb/
<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.22.1</center>
</body>
</html>
$ ffuf -u http://variatype.htb -H "Host: FUZZ.variatype.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -fs 169 -t 200
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://variatype.htb
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt
:: Header : Host: FUZZ.variatype.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 200
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 169
________________________________________________
portal [Status: 200, Size: 2494, Words: 445, Lines: 59, Duration: 146ms]
:: Progress: [20000/20000] :: Job [1/1] :: 1517 req/sec :: Duration: [0:00:13] :: Errors: 0 ::
$ ffuf -u http://FUZZ.variatype.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -mc all -ac
# None
ใใฃใฌใฏใใชๆข็ดข
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
$ feroxbuster -u http://variatype.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -C 404,400 -t 50
by Ben "epi" Risher ๐ค ver: 2.13.1
โโโโโโโโโโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโโโโ
๐ฏ Target Url โ http://variatype.htb/
๐ฉ In-Scope Url โ variatype.htb
๐ Threads โ 50
๐ Wordlist โ /usr/share/seclists/Discovery/Web-Content/common.txt
๐ข Status Code Filters โ [404, 400]
๐ฅ Timeout (secs) โ 7
๐ฆก User-Agent โ feroxbuster/2.13.1
๐ Extract Links โ true
๐ HTTP methods โ [GET]
๐ Recursion Depth โ 4
โโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโ
๐ Press [ENTER] to use the Scan Management Menuโข
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
404 GET 5l 31w 207c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200 GET 84l 304w 3339c http://variatype.htb/services
200 GET 250l 501w 5030c http://variatype.htb/static/css/corporate.css
200 GET 65l 166w 2104c http://variatype.htb/tools/variable-font-generator
200 GET 60l 215w 2321c http://variatype.htb/
[####################] - 14s 4758/4758 0s found:4 errors:1
[####################] - 14s 4752/4752 337/s http://variatype.htb/
$ feroxbuster -u http://portal.variatype.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt -C 404,400 -t 50
by Ben "epi" Risher ๐ค ver: 2.13.1
โโโโโโโโโโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโโโโ
๐ฏ Target Url โ http://portal.variatype.htb/
๐ฉ In-Scope Url โ portal.variatype.htb
๐ Threads โ 50
๐ Wordlist โ /usr/share/seclists/Discovery/Web-Content/common.txt
๐ข Status Code Filters โ [404, 400]
๐ฅ Timeout (secs) โ 7
๐ฆก User-Agent โ feroxbuster/2.13.1
๐ Extract Links โ true
๐ HTTP methods โ [GET]
๐ Recursion Depth โ 4
โโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโ
๐ Press [ENTER] to use the Scan Management Menuโข
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
404 GET 7l 11w 153c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
301 GET 7l 11w 169c http://portal.variatype.htb/.git => http://portal.variatype.htb/.git/
200 GET 2l 5w 187c http://portal.variatype.htb/.git/index
200 GET 1l 2w 23c http://portal.variatype.htb/.git/HEAD
200 GET 8l 21w 143c http://portal.variatype.htb/.git/config
403 GET 7l 9w 153c http://portal.variatype.htb/.git/logs/
200 GET 369l 818w 8789c http://portal.variatype.htb/styles.css
200 GET 58l 200w 2494c http://portal.variatype.htb/
301 GET 7l 11w 169c http://portal.variatype.htb/files => http://portal.variatype.htb/files/
200 GET 58l 200w 2494c http://portal.variatype.htb/index.php
301 GET 7l 11w 169c http://portal.variatype.htb/.git/hooks => http://portal.variatype.htb/.git/hooks/
301 GET 7l 11w 169c http://portal.variatype.htb/.git/info => http://portal.variatype.htb/.git/info/
301 GET 7l 11w 169c http://portal.variatype.htb/.git/logs => http://portal.variatype.htb/.git/logs/
301 GET 7l 11w 169c http://portal.variatype.htb/.git/objects => http://portal.variatype.htb/.git/objects/
301 GET 7l 11w 169c http://portal.variatype.htb/.git/objects/03 => http://portal.variatype.htb/.git/objects/03/
301 GET 7l 11w 169c http://portal.variatype.htb/.git/objects/50 => http://portal.variatype.htb/.git/objects/50/
200 GET 6l 43w 240c http://portal.variatype.htb/.git/info/exclude
301 GET 7l 11w 169c http://portal.variatype.htb/.git/objects/info => http://portal.variatype.htb/.git/objects/info/
301 GET 7l 11w 169c http://portal.variatype.htb/.git/objects/pack => http://portal.variatype.htb/.git/objects/pack/
[####################] - 33s 52276/52276 0s found:18 errors:3
[####################] - 15s 4752/4752 320/s http://portal.variatype.htb/
[####################] - 14s 4752/4752 333/s http://portal.variatype.htb/.git/
[####################] - 14s 4752/4752 334/s http://portal.variatype.htb/.git/logs/
[####################] - 14s 4752/4752 333/s http://portal.variatype.htb/files/
[####################] - 15s 4752/4752 326/s http://portal.variatype.htb/.git/hooks/
[####################] - 14s 4752/4752 329/s http://portal.variatype.htb/.git/info/
[####################] - 14s 4752/4752 332/s http://portal.variatype.htb/.git/objects/
[####################] - 14s 4752/4752 334/s http://portal.variatype.htb/.git/objects/03/
[####################] - 14s 4752/4752 329/s http://portal.variatype.htb/.git/objects/50/
[####################] - 15s 4752/4752 327/s http://portal.variatype.htb/.git/objects/info/
[####################] - 14s 4752/4752 339/s http://portal.variatype.htb/.git/objects/pack/
This post is licensed under CC BY 4.0 by the author.