TakeOver Tryhackme Walkthrough | Nasir Ahim

5 min readJan 21, 2026

This is my TryHackMe Takeover walkthrough (CTF writeup) where I demonstrate use of ffuf tool in subdomain enumeration and directory discovery.

Room Link: https://tryhackme.com/room/takeover

Review: This is one of the easiest room on Tryhackme. If you are new to CTF challenges then this room will definitely help you to understand the basic concept of using ffuf tool to enumerate subdomains and directories. I tried to use basic and simple commands so that you have the understanding rather than using memorized advanced commands.

Step 01: Add Host and IP to the /etc/hosts

In this room we will be working on the website named “https://futurevera.thm”. This website is private domain dedicated only for this room and is not publicly available on the internet. So, the first thing we need to do is to add this host name and its dedicated IP address to the /etc/hosts file on our attack box. Type [ nano /etc/hosts ] and add the IP and host as shown in the picture 01 below.

Step 02: Use curl command to reveal the Content-Length of incorrect subdomains

Now we can do a nmap scan but its not necessary in our case. Because we are doing DNS enumeration so we will use “ffuf” tool. This tool will help us to enumerate subdomains. But before doing that lets determine the size of the response that will be returned to us with a subdomain that cannot exist on the server. For that we will use [ curl -I -k -H “Host: randomname.futurevera.thm” https://10.81.164.192 ]. Here flag -I is to get only the headers to see the Content-Length, -k is to allow insecure ssl connection and -H adds a custom host header [-H tricks the server to think you are requesting a specific subdomain].

As we can see, we use a fake host name: “randomname” in our command and got a reply of Content-Length of 4605. What it means is all the errors we might receive will be of 4605 bytes. Now we can filter out our command that we don’t want responses of 0 or 4605 bytes.

Step 03: FFUF tool for finding out available subdomains

Now, let’s start our fuzzing process. We will use the command [ffuf -H “Host: FUZZ.futurevera.thm” -u https://10.81.164.192 -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-110000.txt -fs 0,4605 ] . Here the flag -u is for URL, -w is for the wordlist we want to use and -fs (Filter Size) is to use a filter that we dont want response with 0, 4605 bytes. Here notice that in the host name we used ‘FUZZ’ before the actual domain. This tell ffuf tool to replace FUZZ with all the possible subdomain names from our wordlist. Shown in Picture 03

We just got 2 subdomains, Blog and Support. Now lets add these subdomains again on our /etc/hosts file so that we can access it from our attack box. Remember these are subdomains so make sure you type it correctly like blog.futurevera.thm while adding to /etc/hosts. Shown in Picture 04.

Step 04: Use ffuf to discover directories on the new subdomains

Get Nasir Ahim’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Lets see what directories or pages we have in support.futurevera.thm. For this we will use the command [ ffuf -u https://support.futurevera.thm/FUZZ -w /usr/share/wordlists/rockyou.txt ]. Here we use FUZZ at the end of the url with a “/” because we want to check the paths available on this subdomain. Shown in Picture 05

After running the command we got a lot of fake response. How do we know these are fake? Simply because they all are of same size of 1522 bytes. So, We need to again filter out the size using -fs flag that we did in Step 03. Use the same command with -fs 0, 1522. Shown in Picture 06.

This time we only got directory ‘assets’. But if we check the assets directory you will see that we got nothing useful, no progress.

Step 05: Using curl to get into details

In this situation we feel the need of using curl command to get into more details of the directories. While examining the directories, we notice that the [ curl https://support.futurevera.thm -verbose ] command makes us wait for a long time and eventually gives a certificate error, while the “curl http://support.futurevera.thm — verbose” command returns an immediate response. Shown in Picture 07.

Step 06: Reviewing certificates from the browser

Upon reviewing the Certificate of support.futurevera.thm on the browser we get a DNS name ‘secrethelpdesk934752.support.futurevera.thm’. Lets add this to /etc/hosts and recheck to see where is takes us. Shown in Picture 08.