BitForge_Web_plan.bitforge.lab

plan.bitforge.lab

---

A virtual host / sub-domain, plan.bitforgee.lab, has been discovered

The /etc/hosts file on Kali has been updated for the plan.bitforge.lab host

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/bitforge]
└─$ curl -I -X OPTIONS http://plan.bitforge.lab/  
HTTP/1.1 302 Found
Date: Sat, 12 Apr 2025 15:00:48 GMT
Server: Apache
Location: www/index.php
Content-Length: 0
Content-Type: text/html; charset=UTF-8
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/bitforge]
└─$ curl -I -X OPTIONS http://plan.bitforge.lab/www/index.php
HTTP/1.1 200 OK
Date: Sat, 12 Apr 2025 15:00:53 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Set-Cookie: soplanningplanning_=jir16lj5t7ifvhlitpgeot2vtn; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/bitforge]
└─$ curl -I http://plan.bitforge.lab/www/index.php        
HTTP/1.1 200 OK
Date: Sat, 12 Apr 2025 15:00:56 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Set-Cookie: soplanningplanning_=fij1lfn7nglvrvil5g94a6o347; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=iso-8859-1

302 to www/index.php

Login page for Simple Online Planning Version information is disclosed; 1.52.01

SOPlanning is an online project management software designed to improve visibility for your team Source code is available for review

Vulnerabilities

---

The target SOPlanning instance suffers from a RCE vulnerability However, it requires authentication