Era
Enumeration
nmap -A -p- 10.10.11.79 -T4
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-27 00:02 +05
Nmap scan report for 10.10.11.79
Host is up (0.091s latency).
Not shown: 65533 closed tcp ports (reset)
P
...
Era
Enumeration
nmap -A -p- 10.10.11.79 -T4
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-27 00:02 +05
Nmap scan report for 10.10.11.79
Host is up (0.091s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.5
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://era.htb/
Device type: general purpose
Running: Linux 5.X
OS CPE: cpe:/o:linux:linux_kernel:5
OS details: Linux 5.0 - 5.14
Network Distance: 2 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 22/tcp)
HOP RTT ADDRESS
1 90.52 ms 10.10.14.1
2 90.62 ms 10.10.11.79
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 42.08 seconds
💡 Open Ports and Services:
Port 21/tcp: Running vsftpd 3.0.5 (FTP service).
Port 80/tcp: Running nginx/1.18.0 (Ubuntu) (HTTP service).
Subdomain Enumeration
Action Taken: Performed subdomain enumeration using the fuzz tool with a wordlist to identify valid subdomains
of era.htb:
┌──(grover㉿Grover)-[~/Era]
Era 1└─$ ffuf -w /usr/share/amass/wordlists/bitquark_subdomains_top100K.txt \
-H "Host:FUZZ.era.htb" \
-u http://era.htb/ -mc 200
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://era.htb/
:: Wordlist : FUZZ: /usr/share/amass/wordlists/bitquark_subdomains_top100K.txt
:: Header : Host: FUZZ.era.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200
[Show More]