Stapler_Web_80

Web

---

Nmap [[Stapler_Recon#|discovered]] a Web server on the target port 80 The running service is PHP cli server 5.5 or later

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/stapler]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 404 Not Found
Host: 192.168.239.148
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 533
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/stapler]
└─$ curl -I http://$IP/        
HTTP/1.1 404 Not Found
Host: 192.168.239.148
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 533

Webroot 404

Fuzzing

---

┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/stapler]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .html,.txt,.php -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.239.148/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .html .txt .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
.bashrc                 [Status: 200, Size: 3771, Words: 522, Lines: 118, Duration: 43ms]
.profile                [Status: 200, Size: 675, Words: 107, Lines: 23, Duration: 29ms]
:: Progress: [81912/81912] :: Job [1/1] :: 682 req/sec :: Duration: [0:01:59] :: Errors: 0 ::
 
┌──(kali㉿kali)-[~/PEN-200/PG_PLAY/stapler]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ/ -ic -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.239.148/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
:: Progress: [207630/207630] :: Job [1/1] :: 754 req/sec :: Duration: [0:04:58] :: Errors: 0 ::

The presence of .bashrc and .profile files suggest that the web root directory is someone’s home directory