recon_07 (vhost over TLS)
Last updated
Last updated
View the exercise here: PentesterLab: Recon 07
For this challenge, your goal is to access the default virtual host ("vhost") over TLS.
When accessing a new webserver, it often pays off to replace the hostname with the IP address or to provide a random Host header in the request. To do this, you can either modify the request in a web proxy or use:
This time you need to check the TLS version of the website to get the key
This command performs a DNS lookup to retrieve the IP address associated with the domain hackycorp.com.
curl is used to send HTTP requests to the given IP address. In this case, you're trying to access the site using its IP directly over TLS (https://). However, because the IP address does not match the hostname in the SSL certificate, this step is likely to fail with an SSL error.
This ignores SSL certificate verification and forces the connection.
--insecure allows curl to bypass SSL certificate validation. This is necessary because the certificate is tied to the domain name (hackycorp.com), not the IP address.
The request should succeed, but you won't get the default virtual host because it still assumes you're accessing via the IP address rather than the expected hostname.
-v flag enables verbose mode, showing you detailed information about the request, including SSL/TLS handshake details, headers, and response.
some targets may allow us to access another version of the website, so it is important to check the behavior of an application when using a hostname that is not the one the application is expecting
