Outdated_Web_8530

Web

---

Nmap discovered a Web server on the target port 8530 The running service is Microsoft IIS httpd 10.0

┌──(kali㉿kali)-[~/archive/htb/labs/outdated]
└─$ curl http://$IP:8530/ -I -S
HTTP/1.1 200 OK
content-length: 0
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
date: Wed, 03 Jan 2024 19:56:48 GMT

Webroot appears empty

Fuzzing

---

┌──(kali㉿kali)-[~/archive/htb/labs/outdated]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -t 200 -u http://$IP:8530/FUZZ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://10.10.11.175:8530/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 200
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 130ms]
content                 [Status: 403, Size: 0, Words: 1, Lines: 1, Duration: 172ms]
inventory               [Status: 301, Size: 158, Words: 9, Lines: 2, Duration: 647ms]
:: Progress: [207630/207630] :: Job [1/1] :: 576 req/sec :: Duration: [0:08:35] :: Errors: 800 ::

ffuf found 2 endpoints; content and inventory

/content

---

It’s empty

┌──(kali㉿kali)-[~/archive/htb/labs/outdated]
└─$ curl http://$IP:8530/content -I -S
HTTP/1.1 403 Forbidden
content-length: 0
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
date: Wed, 03 Jan 2024 19:58:46 GMT

Sending a GET request to the endpoint via curl , however, shows the 403

Fuzzing /content

---

┌──(kali㉿kali)-[~/archive/htb/labs/outdated]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -t 200 -u http://$IP:8530/content/FUZZ -ic -fc 403 -fs 1
________________________________________________
 :: Method           : GET
 :: URL              : http://10.10.11.175:8530/content/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 200
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
 :: Filter           : Response size: 1
________________________________________________
:: Progress: [207630/207630] :: Job [1/1] :: 411 req/sec :: Duration: [0:08:17] :: Errors: 0 ::

Nothing found

/inventory

---

Same goes for the inventory directory. It’s empty

┌──(kali㉿kali)-[~/archive/htb/labs/outdated]
└─$ curl http://$IP:8530/inventory -I -S
HTTP/1.1 301 Moved Permanently
content-length: 158
content-type: text/html; charset=UTF-8
location: http://10.10.11.175:8530/inventory/
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
date: Wed, 03 Jan 2024 19:59:28 GMT
 
 
┌──(kali㉿kali)-[~/archive/htb/labs/outdated]
└─$ curl http://$IP:8530/inventory/ -I -S
HTTP/1.1 200 OK
content-length: 0
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
date: Wed, 03 Jan 2024 19:59:35 GMT

The inventory endpoint also does provide some level of information when requested via **curl

Fuzzing /inventory

---

┌──(kali㉿kali)-[~/archive/htb/labs/outdated]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -t 200 -u http://$IP:8530/inventory/FUZZ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://10.10.11.175:8530/inventory/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 200
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 379ms]
:: Progress: [207630/207630] :: Job [1/1] :: 635 req/sec :: Duration: [0:09:17] :: Errors: 0 ::

Nothing found

Virtual Host / Sub-domain Discovery

---

┌──(kali㉿kali)-[~/archive/htb/labs/outdated]
└─$ ffuf -c -w /usr/share/wordlists/seclists/discovery/dns/subdomains-top1million-110000.txt -t 200 -u http://$IP:8530/ -H 'Host: FUZZ.outdated.htb' -ic -fs 0 -mc all
________________________________________________
 :: Method           : GET
 :: URL              : http://10.10.11.175:8530/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.outdated.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 200
 :: Matcher          : Response status: all
 :: Filter           : Response size: 0
________________________________________________
xn--nckxa3g7cq2b5304djmxc-biz [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 156ms]
xn--cckcdp5nyc8g2837ahhi954c-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 28ms]
xn--7ck2d4a8083aybt3yv-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 37ms]
xn--u9jxfma8gra4a5989bhzh976brkn72bo46f-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--y8jvc027l5cav97szrms90clsb-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 26ms]
xn--t8j3b111p8cgqtb3v9a8tm35k-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 25ms]
xn--68j4bva0f0871b88tc-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 25ms]
xn--new-h93bucszlkray7gqe-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--2-uc7a56k9z0ag5f2zfgq0d-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--68jza6c5o5cqhlgz994b-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 31ms]
xn--u9j5h1btf1e9236atkap9eil-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 31ms]
xn--zck3adi4kpbxc7d2131c5g2au9css5o-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 31ms]
xn--u9j5h1btf1en15qnfb9z6hxg3a-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--54qq0q0en86ikgxilmjza-biz [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 33ms]
xn--qckr4fj9ii2a7e-jp   [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 330ms]
xn--u9j5h1btf1eo45u111ac9hf95c-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 53ms]
xn--fdkc8h2az097bv1wbh4e-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 26ms]
xn--yckvb0d4245c-jp     [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 38ms]
xn--39ja4cb4nqb6d4fu546bkkucpl7d-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 35ms]
xn--u9j0goar6iyfrb7809ddyvakw0e2vh-biz [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 33ms]
xn--nckuad2au4azb6dvd8fna2594hb0sc-biz [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--eckm3b6d2a9b3gua9f2d6658ehctafoz-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 31ms]
xn--line-yn4ckbymxil606bodya-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 36ms]
xn--pride-ym4dqj0d4g-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 26ms]
xn--u9jxhkb1qu36p2lc-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 30ms]
xn--cckueqa6319czn9a-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 27ms]
xn--zck9awe6d692p972a905d-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 26ms]
xn--tor55ycb159b1ndz7ifa3356d-biz [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 28ms]
xn--y8j2eb0209aooq-biz  [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--news-4c4cuuha3z9b3580f16c-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 161ms]
xn--ujqp84atlah52f-com  [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 164ms]
xn--u9j5h1btf1e330r917aok7b5id-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 182ms]
xn--n9j8gnb1bza2am-jp   [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 36ms]
xn--9ckkn5226aut1aee3bgbf6ma-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--88j6ea1a4250bdrdi9am84bkx5cbp2b8xe-asia [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--ruqr59dpuht2t50er1m-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 28ms]
xn--zck9awe6d418qo4jbw1c-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--hckqzd2f3dwc2d3a-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 41ms]
xn--kckwar5itb7grc-com  [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 28ms]
xn--00-bh4a8cuhme-jp    [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--n9jxild6c580r9ygq36b1ocor6evm4b39d-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--p8j5cxcyjlcygn342e-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--zck9awe6d4687a257a-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 44ms]
xn--t8jo4884a-jp        [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 35ms]
xn--cck0a2a1dug6be8l-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 31ms]
xn--nbkzdraq9b9dtevlv08xj5b1vh-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 33ms]
xn--kckb1c4m-jp         [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 35ms]
xn--n8jvdsa6soa5jz01vtb9bg6lk11hdbi-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 37ms]
xn--n8j4mybtf1e2217b-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 314ms]
xn--jprz31c82x93etka-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 319ms]
xn--qiq69x-saitamajp    [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 80ms]
xn--z9j3g6bzc7bxc8c4074d4nud-biz [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 70ms]
xn--pcka4lj0a1as2jf5847fr93b-net [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 57ms]
xn--28jzf747o512b-jp    [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 57ms]
xn--zck9awe6dr30vedfmxiwrkn2c-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 38ms]
xn--zck9awe6d872rezhp3y9g1f-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 97ms]
xn--w8j6ctc930wo9za2qf-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 91ms]
xn--cckcdp5nyc8g2745a3y4a-biz [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 80ms]
xn--dckix0be3bww9s3erh-net [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 36ms]
xn--t8j0a6ivbyo0d2h2g2785a340f-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--zck9awe6d5989b6fc-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 33ms]
xn--hckp3ac2l-jp        [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 35ms]
xn--vck5d6ae0cyc7801bnpyb-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 125ms]
xn--7-kgu4es24uf5q-jp   [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 146ms]
xn--t8j0a6ivbyo0d2h2g-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 141ms]
xn--u9j360h32opa140d-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 144ms]
xn--u9j5h1btf1e613xpbuzkc252m-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 138ms]
xn--elq250e1mhg47a-jp   [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--88j6ea1a3393bcta1uk721ac9l-asia [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 34ms]
xn--av-693a1dpa20aaa2gsa2gd1bd4a8bzooolevh5230egdpb-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 31ms]
xn--n8j9cqo2a0nk59oghe-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 70ms]
xn--eckm3b6d2a9b3gua9f2dz124ebp0a-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 78ms]
xn--88j6ea1a0780bctddtas67ckx5cbp2b8xe-asia [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 40ms]
xn--pckwb0cua2ei-jp     [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--p8judqlpc9fsf-jp    [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 31ms]
xn--edktc2a4827cket59b-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 31ms]
xn--pckwbo6k815nvjfp43bt81d-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--n8j4mybtf1e613xwn2bc64b-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--tckybd3guczb1829b7ghx6trhlupd-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 34ms]
xn--u9j0c604kneons8a-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 155ms]
xn--eck6e6b987uy7i-jp   [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 152ms]
xn--b9j6am4izjxd2h2gq122d-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 159ms]
xn--u9j1hsdzb9d9bv308dff9c-net [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 153ms]
xn--88j2foda3h0b8ny00x2i5adx6d-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 166ms]
xn--mdko7702aecw-com    [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 35ms]
xn--yckc2auxd4b1246f4y1b-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 34ms]
xn--line-tk4c0cf2ooiyhod-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--lurea-mm4dysia-jp   [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 26ms]
xn--akb-fu0e63gwsk9wi4dt38bp4bk6ivrnww8e2uwcils-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 208ms]
xn--3kqu3oh0b77g34dt2lxzn4mre5ohlvlx1c-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 210ms]
xn--y8jua4a3aa5irgf4841fknvi-asia [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 52ms]
xn--u8jua8gqbf5b9c-com  [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 40ms]
xn--u9j0c2f2crdwc2cwdv219fiuc-biz [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--u9j5h1btf1es15qifb9z6hcj5d-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 66ms]
xn--68je3c7dsev110a6cu7y0e6xk71t-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 46ms]
xn--ols92risjhpv-asia   [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 73ms]
xn--u9jb5p4ctkpbzdu307a19ai49kda-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 38ms]
xn--icko4ae3d6o-jp      [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 117ms]
xn--vsqv9lppf53f-com    [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 106ms]
xn--line-ym4cqkvg9752bcyva-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 113ms]
xn--zckqft4pu73w8go-jp  [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 186ms]
xn--30r99m89hxoam8ze2n05l-biz [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 186ms]
xn--navi-ul4c1e8bg9i0h4h-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 38ms]
xn--t8j3b4ef5oa1c8e1srau1b8r-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 55ms]
xn--3-4eu4ewb4f-jp      [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 40ms]
xn--t8jg7fsgvi0d2h2g-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 59ms]
xn--nckgh0pyb4cb0662e3ze8mpt2h2w6bmjzaoh9a-net [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 36ms]
xn--cgi-qs9d423tgelegd-net [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 57ms]
xn--u9j5h1btf1e9236ag6b1v8idc0a-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 28ms]
xn--pcktab2b3dta2oze-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 26ms]
xn--t8j3b4ef5mpcvq0dvb-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 38ms]
xn--eckle2a3a6k5eucvec7hu028b33tg-net [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 34ms]
xn--x8jc3d5hp94mb34d3m4a-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 36ms]
xn--eckg4cd6wc6i-com    [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 36ms]
xn--t8jxd7cyb-jp        [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 35ms]
xn--24-zb4aym5cqhlgl55v9p2b-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 37ms]
xn--p8jn4h6d6kxd2h2g-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 36ms]
xn--gckvas0t2a-biz      [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 36ms]
xn--yckc2auxd4b6564dogvcf7g-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 43ms]
xn--58j5bk8cwnpc8czq6095c-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 44ms]
xn--pckj3hf8gj-biz      [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 45ms]
xn--4gr53rqoa84h99wywlvrxf7n-net [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 28ms]
xn--swqq1zt9i4xa94dl3f-net [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--y8jp0mua-jp         [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 36ms]
xn--cckj1c2j2bwf6044bomgf76b-net [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 38ms]
xn--zckwa8eyf040sre5d-jp [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 32ms]
xn--n8j0ao7f9a7304bz1zayk3ai7h-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 24ms]
xn--czr78lt57a-jp       [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--ecki1b5br0ae8iyd3due-jpnet [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 29ms]
xn--qckyd1cv50v-jp      [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 269ms]
xn--n8jl84alc9fsf5446c-com [status: 400, Size: 334, Words: 21, Lines: 7, Duration: 259ms]
:: Progress: [114437/114437] :: Job [1/1] :: 5813 req/sec :: Duration: [0:00:41] :: Errors: 0 ::

Nothing found