# DevArea Writeup - HackTheBox

- **URL:** https://hackindex.io/writeups/devarea
- **Platform:** HackTheBox
- **Difficulty:** Medium
- **Operating system:** Linux
- **Machine:** https://hacktheboxltd.sjv.io/devarea
- **Access:** Partly password protected
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Published:** 2026-03-31
- **Updated:** 2026-05-10

## Discovery

### Port Scan

```bash
scan_tcp_full $TARGET_IP
# PORT     STATE SERVICE    VERSION
# 21/tcp   open  ftp        vsftpd 3.0.5
# | ftp-anon: Anonymous FTP login allowed (FTP code 230)
# |_drwxr-xr-x    2 ftp      ftp          4096 Sep 22  2025 pub
# 22/tcp   open  ssh        OpenSSH 9.6p1 Ubuntu 3ubuntu13.15
# 80/tcp   open  http       Apache httpd 2.4.58
# |_http-title: DevArea - Connect with Top Development Talent
# 8080/tcp open  http       Jetty 9.4.27.v20200227
# |_http-title: Error 404 Not Found
# 8500/tcp open  http       Golang net/http server
# |_  This is a proxy server. Does not respond to non-proxy requests.
# 8888/tcp open  http       Golang net/http server
# |_http-title: Hoverfly Dashboard
```

HTTP on port 80 redirects to `devarea.htb`. Add it to `/etc/hosts`:

```bash
echo "$TARGET_IP devarea.htb" | sudo tee -a /etc/hosts
```

Port 8080 is a Jetty instance returning 404, 8888 is a Hoverfly Dashboard, and 8500 is a proxy server that rejects direct connections.

Related

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.