Now I wanna discover their assets and find the old doors

That is a lot of doors for use to.test
But those are doors that has been indexed on the web
What if we look for the hidden ones and see if we can find something

The technique I'm about to use is for finding certificate transparency

Then to find hidden assets of this website..
Go to censys.io/ipv4

And boom we have a bunch of internal ip addresses

See that we are moving from knowing no doors to knowing some semi protected doors to finding hidden doors

Now you should see it has services that we can check for vulnerabilities

We even found a hidden login system

On the network side.... let me scan the ip address with nmap and see what services it has open

Now that we have a special ip address then lets scan it

We have discovered 5 open port

There's a vulnerability that we can exploit to take over the database or at least crash it

There is also a host header injection vulnerability: passing an invalid host header and getting a 200 ok

We can use that to reset another users password , poison the web content of the website

We will stop there for tonight...any attack is illegal ...this is for educational purpose only

How to Hack the "Hackthebox" page to get an invite code