DEV Community

Hassan Elsayed
Hassan Elsayed

Posted on

HackTheBox — Web Fuzzing Skills Assessment

#htb #ffuf #ctf #cybersecurity

Introduction

Walking through my approach to the Web Fuzzing Skills Assessment from HackTheBox Academy — writing this mostly as a personal reference to revisit later, but hopefully it helps someone else too. Genuinely fun challenge that solidified how fuzzing works in a real-world-ish scenario.

The assessment is about discovering hidden endpoints, parameters, virtual hosts, and nested directories through systematic fuzzing. Each discovery unlocks the next clue — a chain leading to the final flag.

Challenge Overview

  • Target: web application
  • Wordlist: common.txt from SecLists (/usr/share/seclists/Discovery/Web-Content/)
  • Goal: discover hidden content and capture the flag
  • Skills tested: directory fuzzing, parameter fuzzing, VHost fuzzing, recursive fuzzing

Step 1: Directory Fuzzing on Root

Started by fuzzing the root to map the attack surface:

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -u http://TARGET:PORT/FUZZ
Enter fullscreen mode Exit fullscreen mode


Result: found /admin with a 301 redirect — worth digging into.

Step 2: Fuzzing Inside /admin

Went deeper into /admin, adding the .php extension to catch PHP files:

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -u http://TARGET:PORT/admin/FUZZ -e .php
Enter fullscreen mode Exit fullscreen mode


Result: panel.php stood out — different response size (58 bytes) than everything else.

Step 3: Discovering the Hidden Parameter

A quick curl on it revealed something useful:

curl http://TARGET:PORT/admin/panel.php
Enter fullscreen mode Exit fullscreen mode

Response:

Invalid parameter, please ensure accessID is set correctly
Enter fullscreen mode Exit fullscreen mode

The app told me exactly what it needed — an accessID parameter. Time to fuzz it.

Step 4: Fuzzing the accessID Parameter

All responses came back 200 with size 58 — classic false positives. Filtered by that size to isolate the real hit:

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -u "http://TARGET:PORT/admin/panel.php?accessID=FUZZ" \
  -fs 58
Enter fullscreen mode Exit fullscreen mode

Result: valid accessID value found ✅

Step 5: Getting the VHost Hint 

curl "http://TARGET:PORT/admin/panel.php?accessID=<found_value>"
Enter fullscreen mode Exit fullscreen mode

Response:

Head on over to the fuzzing_fun.htb vhost for some more fuzzing fun!
Enter fullscreen mode Exit fullscreen mode

The app pointed me at a virtual host. First step, add it to /etc/hosts:

echo "TARGET_IP  fuzzing_fun.htb" | sudo tee -a /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Step 6: VHost / Subdomain Fuzzing

With the vhost in place, I fuzzed for subdomains sitting on top of it, filtering out the noisy 403 responses:

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
  -u http://fuzzing_fun.htb:PORT/ \
  -H 'Host: FUZZ.fuzzing_fun.htb' \
  -fc 403
Enter fullscreen mode Exit fullscreen mode

Result: a subdomain discovered ✅ — added it to /etc/hosts as well:

echo "TARGET_IP  <subdomain>.fuzzing_fun.htb" | sudo tee -a /etc/hosts
Enter fullscreen mode Exit fullscreen mode

Step 7: Following the Clue to /godeep 

curl http://<subdomain>.fuzzing_fun.htb:PORT/
Enter fullscreen mode Exit fullscreen mode

Response:

Wrong path, remember to be looking in /godeep
Enter fullscreen mode Exit fullscreen mode

The app kept dropping breadcrumbs — love it.

Step 8: Recursive Fuzzing on /godeep

Instead of manually fuzzing layer by layer, I used recursive fuzzing. The 301 redirect size was 352, so I filtered that out:

ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -u http://<subdomain>.fuzzing_fun.htb:PORT/godeep/FUZZ \
  -recursion \
  -recursion-depth 2 \
  -fs 352
Enter fullscreen mode Exit fullscreen mode

Result: uncovered a deeply nested path ✅

Step 9: Flag Captured 🎉 

curl http://<subdomain>.fuzzing_fun.htb:PORT/godeep/<nested_path>/
Enter fullscreen mode Exit fullscreen mode 
HTB{wxxx_fxxxxxg_kxxxxxs}
Enter fullscreen mode Exit fullscreen mode

Key Takeaways

  • always filter false positives by response size (-fs) — cuts out a ton of noise
  • apps sometimes leak parameter names in their own error messages — read them carefully
  • VHost fuzzing can reveal entire hidden site trees you'd never find otherwise
  • recursive fuzzing saves real time on deeply nested directories
  • every clue unlocks the next step — follow the breadcrumbs

Top comments (0)