Web
Nmap discovered a Web server on the target port 80
The running service is Microsoft IIS httpd 10.0
Webroot
It’s the default IIS installation page
Fuzzing
┌──(kali㉿kali)-[~/archive/htb/labs/streamio]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://$IP/FUZZ -ic
________________________________________________
:: Method : GET
:: URL : http://10.10.11.158/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
:: Progress: [220547/220547] :: Job [1/1] :: 413 req/sec :: Duration: [0:09:08] :: Errors: 0 ::ffuf found nothing This might be a dummy web server
Virtual Host / Sub-domain Discovery
┌──(kali㉿kali)-[~/archive/htb/labs/streamio]
└─$ ffuf -c -w /usr/share/wordlists/seclists/discovery/dns/subdomains-top1million-110000.txt -u http://$IP/ -H 'Host: FUZZ.streamio.htb' -fs 703
________________________________________________
:: Method : GET
:: URL : http://10.10.11.158/
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
:: Header : Host: FUZZ.streamio.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 703
________________________________________________
:: Progress: [114441/114441] :: Job [1/1] :: 450 req/sec :: Duration: [0:04:41] :: Errors: 0 ::Nothing returns