TryHackMe Takeover Walkthrough | How I found a hidden subdomain with ffuf

Did a quick TryHackMe Takeover box and wanted to share a tiny, practical subdomain trick that saved me time.

What I did (high-level)

• Added the target domain + IP to /etc/hosts so my browser + tools resolve the custom name.

• Used ffuf to fuzz the Host: header with a large SecLists DNS wordlist. The initial scan returned tons of hits that were just the same default page — so I used ffuf’s -fs (filter-by-size) to ignore the common noise and reveal the real, differing responses.

• Found blog.futurevera.thm and support.futurevera.thm. No flags on those pages.

• Inspected the SSL certificate for support.futurevera.thm and noticed an extra DNS entry: secret.helpdesk.support.futurevera.thm. Added it to /etc/hosts.

• Visiting the HTTPS site redirected to the main page — but hitting HTTP (http://secret.helpdesk.support...) returned an error page where the flag was printed in the error description.

Why this worked

• Many hunks of noise are identical default pages , using -fs to filter out identical response sizes is an easy way to focus on interesting responses.

• Certificates can leak internal or longer subdomains in their SANs , always check cert details for extra names.

• Try both HTTPS and HTTP. Sometimes HTTPS is configured to redirect, while HTTP returns a diagnostic error or different content that leaks information.

Full breakdown from here