InfoSec LAB

DC-9_Web

Created: 3 min read

Web

Nmap discovered a Web server on the port 80 of the 192.168.207.209 host. The running service is Apache httpd 2.4.38 ((Debian))

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/dc-9]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 200 OK
Date: Wed, 02 Jul 2025 19:36:52 GMT
Server: Apache/2.4.38 (Debian)
Vary: Accept-Encoding
Content-Length: 917
Content-Type: text/html; charset=UTF-8
 
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/dc-9]
└─$ curl -I http://$IP/        
HTTP/1.1 200 OK
Date: Wed, 02 Jul 2025 19:36:54 GMT
Server: Apache/2.4.38 (Debian)
Content-Type: text/html; charset=UTF-8

Webroot This appears to be a custom website.

/display.php Endpoint

The /display.php endpoint shows a list that seems to have been fetched from a SQL query.

/search.php Endpoint

Search function is available at the /search.php endpoint.

SQLi

Testing for SQL injection.

SQLi confirmed.

/manage.php Endpoint

Authentication at the /manage.php endpoint. No credential is known at this time.

Authentication

The credential of the admin user has been exfiltrated and cracked from the SQL injection.

Validating the credential against the /manage.php endpoint.

Successfully authenticated. Missed out LFI opportunity here

Fuzzing

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/dc-9]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .html,.txt,.php
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.207.209/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .html .txt .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
.htaccess               [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
.htaccess.html          [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
.htaccess.txt           [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 21ms]
.htaccess.php           [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
.htpasswd               [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 20ms]
.htpasswd.html          [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
.htpasswd.txt           [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
.htpasswd.php           [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
config.php              [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 22ms]
css                     [Status: 301, Size: 316, Words: 20, Lines: 10, Duration: 22ms]
display.php             [Status: 200, Size: 2961, Words: 199, Lines: 42, Duration: 21ms]
includes                [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 19ms]
index.php               [Status: 200, Size: 917, Words: 43, Lines: 43, Duration: 20ms]
logout.php              [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 21ms]
manage.php              [Status: 200, Size: 1210, Words: 43, Lines: 51, Duration: 23ms]
results.php             [Status: 200, Size: 1056, Words: 43, Lines: 55, Duration: 26ms]
search.php              [Status: 200, Size: 1091, Words: 47, Lines: 50, Duration: 22ms]
server-status           [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 21ms]
session.php             [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 28ms]
welcome.php             [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 23ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1904 req/sec :: Duration: [0:00:55] :: Errors: 0 ::
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/dc-9]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ/ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.207.209/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 917, Words: 43, Lines: 43, Duration: 22ms]
icons                   [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 22ms]
css                     [Status: 200, Size: 934, Words: 61, Lines: 17, Duration: 20ms]
includes                [Status: 200, Size: 748, Words: 52, Lines: 16, Duration: 19ms]
server-status           [Status: 403, Size: 280, Words: 20, Lines: 10, Duration: 19ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1960 req/sec :: Duration: [0:02:02] :: Errors: 0 ::

N/A

Interactive Graph View

Backlinks