Machine Info
10.129.228.102 https://app.hackthebox.com/machines/Mentor
Recon
$ nmap -sSV -p- -oA init_nmap 10.129.228.102
Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-23 20:43 -0400
Nmap scan report for 10.129.228.102
Host is up (0.14s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3 (Ubuntu Linux; protocol 2.0)
80/tcp open http Apache httpd 2.4.52
Service Info: Host: mentorquotes.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel
We have a hostname to add to /etc/hosts
80 http
There's nothing interesting on the website - no comments or other links.
Using gobuster, I did a vhost scan. The first run showed every host returning 302 with varying content sizes based off the length of the url being attempted.
$ gobuster vhost -u http://mentorquotes.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt --append-domain -o gobuster_vhost.txt --exclude-length 290-330
...
api.mentorquotes.htb Status: 404 [Size: 22]
...
There is an API endpoint available that returns a different code. Adding this to /etc/hosts reveals a api only returning {"detail":"Not Found"}. There's a header of Server: uvicorn.
$ gobuster dir -u http://api.mentorquotes.htb -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints.txt -o api-endpoints.txt
docs (Status: 200) [Size: 969]
openapi.json (Status: 200) [Size: 7676]
Progress: 269 / 269 (100.00%)
This reveals endpoints for /auth, /users and /quotes. It also reveals an account, [email protected].
Using james:james on the auth API throws a 422 error stating it must be a minimum of 8 characters. Further testing reveals it maxes out at 50 characters