October 24, 2026
TakeOver- TryHackMe room walkthrough
link to the challenge: https://tryhackme.com/room/takeover
By Dipu Basak
1 min read
Looking at the room description, this is definatly a "Subdomain Takeover". letss go
after adding the domain name and IP address in /etc/hosts , curl it with a non-existent subdomain to know the size of the served page.
now using this information, fuzz it for subdomain enumaration. This can be done using either 'ffuf' or 'gobuster'. I'm using ffuf. the -fs flag here filters out all the response containing 4605 size, indicating that subdomain doesn't exist.
2 subdomain found. blog, support.
both were working fine, or it seemed.
So, i asked myself, "where is the vulnerability?"
curl had the answer to this. i noticed, it returned a 302 redirection notice and points to the root domain. why!?
to know the ans, i tried to grab the ssl info on this subdomain, because, apparently you can get the information if the ssl cerificates were issued for other domains too. and yes, it gave me secret subdomain.(security by obsecurity 😉)
curl it and the flag is right there. SUBDOMAIN TAKENOVER!!!
flag: flag{beea0d6edfcee06a59b83fb50ae81b2f}
find me on linkedIn: https://www.linkedin.com/in/0xbasak/
good bye ❤