Recon

Subdomain brute-force reveals admin.forge.htb, but it only responds to requests from localhost:

1
2

curl http://forge.htb -H 'Host: admin.forge.htb'
# Only localhost is allowed!

Enumeration

Nmap

21/tcp filtered ftp
22/tcp open     ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3
80/tcp open     http    Apache httpd 2.4.41

OS: Ubuntu 20.04 (Focal)