October 10, 2026

Article on Introduction to web Hacking a Tryhackme .

Module 1. Walking An application

By Prince Kumar

4 min read

NO Needed

Task 2. Exploring The Website

" Crawl the each page on the website that link inside the href "

Anser no needed

Task 3. Viewing the page source

"View the Source by putting view-source: on each page or if your browser support press ctrl+u "

Q. What is the flag from the html comment ?

Solution step

  1. view source page of lab host .
None
  1. go to the path/new-home-beta
  2. flag — THM{HTML_COMMENTS_ARE_DANGEROUS

Q What is the flag from the secret link?

  1. Check for the secret page on the /
  2. request to secret link path
  3. THM{NOT_A_SECRET_ANYMORE}

Q. What is the directory listing flag?

  1. visit the /assets path

  2. THM{INVALID_DIRECTORY_PERMISSIONS}

Q What is the framework flag?

  1. check for the flag.txt
  2. THM{KEEP_YOUR_SOFTWARE_UPDATED}

Task 4. Developers Tool — Inspector

"Edit & change web page on client side through inpector "

Q. What is the flag behind the paywall?

  1. go to /news & open the dev tool
  2. the 3 article is premium click on it and inpect the page
  3. div premium-customer-block click on it to see link css file ,
  4. change the display= block to display= none &
  5. THM{NOT_SO_HIDDEN}

Task 5 Developers tool — Debugger

"Enable dev to run instruction step by step by creating the breakpoint"

  1. on the contact page something flash red quicly
  2. go to Dev tool & click on the debugger
  3. find the flash.min.js file & at the end you can see the flash remove somthing .
  4. make the breakpoint and reload the site to see the flag
  5. THM{CATCH_ME_IF_YOU_CAN}

Task 6 Developers tool — Network

"Monitor the Network traffic "

Q What is the flag shown on the contact-msg network request?

  1. open the network tab on dev tool
  2. send the message on contact
  3. check for the Respose for the send request
  4. THM{GOT_AJAX_FLAG}

Module : Content Discovery

Task 1.

"content — anything such as audi , video , image , backup etc .

but content discovery is addressing the detail of page like page for staff , older versioin of website , backup , configuration , administration panel etc "

"The method for content discovery manual , automated , osint '

Q task 1. Do it YourSelf

Task 2. manual discovery — robots.txt

"robots.txt file basically configuration file for the search engine it tell the search engine which path can show or not ior ban specific search engine to show result "

Q What is the directory in the robots.txt that isn't allowed to be viewed by web crawlers?

  1. visit the website and /robots.txt
  2. /staff-portal

Task 3. Manual Discovery — favicon

"favicon is small icon display in the browser or tab "

Q What framework did the favicon belong to?

  1. inpect the page https://static-labs.tryhackme.cloud/sites/favicon/
curl https://static-labs.tryhackme.cloud/sites/favicon/images/favicon.ico | md5sum
f276b19aabcb4ae8cda4d22625c6735f

Then check find f276b19aabcb4ae8cda4d22625c6735f

on

https://wiki.owasp.org/index.php/OWASP_favicon_database.

  1. cgiirc

Task 4 . Manual discovery — sitemap.xml

" more detailed version of robots.txt"

Q What is the path of the secret area that can be found in the sitemap.xml file?

  1. labadd/sitemap.xml
  2. /s3cr3t-area

Task 5 Manual Discovery — Http Headers

"http header tell more detailed about the server like the server version , name which we can search it for vulnerability "

Q What is the flag value from the X-FLAG header?

  1. curl http://10.48.179.144 -v
  2. Read the header & you will able to find the flag
  3. THM{HEADER_FLAG}

Task 6 Manual Discovery — Framework Stack

" check for website framework "

Q What is the flag from the framework's administration portal?

  1. visit https://static-labs.tryhackme.cloud/sites/thm-web-framework.
  2. check the documentation , find /thm-framework-login
  3. back to lab ip//thm-framework-login username admin password admin
  4. THM{CHANGE_DEFAULT_CREDENTIALS}

Task 7 OSINT Google hacking /Dorking

" Google Dorking is an advanced google search operator use for specific search" " use domain specific result use site:example.com , filetype:pdf for file , inurl:test search url that contain test , intitle: contain word in link "

Q What Google dork operator can be used to only show results from a particular site?

Do it Yourself

Task 8 OSINT — wappalyzer

" A content discovery open source intelligence "

Q What online tool can be used to identify what technologies a website is running?

Do it Yourself

Task 9 OSINT — Wayback machine

" wayback machine store previos or older version of page "

Q What is the website address for the Wayback Machine?

Do it Yourself

Task 10 OSINT — Github

" Git is version control system and github which host the page which can public , private "

Q What is Git ?

Do it YourSelf

Task 11 . S3 Buckets

" S3 are a storage service provide by amazon aws.

Q What URL format do Amazon S3 buckets end in?

Do it Yourself

Task 12 Automated Discovery

"Automated discovery is the process of using tool to discover content "

" Their is lot of discovery tool like ffuf , dirb and gobuster you can use "

"for tool guidance use manual page "

Q What is the name of the directory beginning "/mo…." that was discovered?

/monthly

Q What is the name of the log file that was discovered?

/development.log

Module Subdomain Enumeration

Task 1. Brief

"subdomain enumerate using the brute force , osint , virtual host "

Do it yourself

Task 2 . ssl/tls certificate

" from here we can enumerate the subdomain when ssl/tls certificate created by CA , CA Take a part in what is called Certificate Transparency logs . which is publicaly available on https://cert.sh"

Q What domain was logged on crt.sh at 2020–12–26?

A store.tryhackme.com

Task 3 OSINT — Search Engine

" You need learn google dorking, or every search engine offer advance search operator for advanced search . you have find them for google dork here it is "

site:"*.com" filetype:pdf "google dorking" | "google hacking" "

Q What is the TryHackMe subdomain beginning with S discovered using the above Google search?

A store.tryhackme.com

Task 4 DNS Bruteforce

"using bruteforce , to check the name in wordlist has subdomain on domain"

Q What is the first subdomain found with the dnsrecon tool?

A api.acmeitsupport.thm

Task 5 OSINT Sublist3r tool

Q What is the first subdomain discovered by sublist3r?

A web55.acmeitsupport.thm

Task 6 virtual Hosts

"some /etc/host or C:\windows\system32\drivers\etc\hosts"

Q What is the first subdomain discovered?

A Delta

Q What is the second subdomain discovered?

A yellow

That it .. i'll cover next module in other article .

Thanks for Reading .

if You learn something just say thanks to me