InfoSec LAB

Cockpit_Web_80

Created: 4 min read

Web

Nmap discovered a Web server on the target port 80 The running service is Apache httpd 2.4.41 ((Ubuntu))

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/cockpit]
└─$ curl -I -X OPTIONS http://$IP/                                      
HTTP/1.1 200 OK
Date: Mon, 24 Mar 2025 20:36:12 GMT
Server: Apache/2.4.41 (Ubuntu)
Allow: GET,POST,OPTIONS,HEAD
Content-Length: 0
Content-Type: text/html
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/cockpit]
└─$ curl -I http://$IP/       
HTTP/1.1 200 OK
Date: Mon, 24 Mar 2025 20:36:16 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Wed, 29 Mar 2023 06:51:19 GMT
ETag: "d15-5f8046741ae2b"
Accept-Ranges: bytes
Content-Length: 3349
Vary: Accept-Encoding
Content-Type: text/html

Webroot

Fuzzing

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/cockpit]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic 
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.152.10/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
.htaccess               [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 2378ms]
.htpasswd               [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 4408ms]
css                     [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 20ms]
img                     [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 21ms]
js                      [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 19ms]
server-status           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 20ms]
:: Progress: [20478/20478] :: Job [1/1] :: 1904 req/sec :: Duration: [0:00:15] :: Errors: 0 ::
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/cockpit]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -recursion -u http://$IP/FUZZ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.152.10/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 3349, Words: 971, Lines: 79, Duration: 33ms]
css                     [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 18ms]
[INFO] Adding a new job to the queue: http://192.168.152.10/css/FUZZ
 
js                      [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 21ms]
[INFO] Adding a new job to the queue: http://192.168.152.10/js/FUZZ
 
img                     [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 3934ms]
[INFO] Adding a new job to the queue: http://192.168.152.10/img/FUZZ
 
                        [Status: 200, Size: 3349, Words: 971, Lines: 79, Duration: 27ms]
server-status           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 19ms]
[INFO] Starting queued job on target: http://192.168.152.10/css/FUZZ
 
                        [Status: 200, Size: 1323, Words: 80, Lines: 19, Duration: 46ms]
                        [Status: 200, Size: 1323, Words: 80, Lines: 19, Duration: 25ms]
[INFO] Starting queued job on target: http://192.168.152.10/js/FUZZ
 
                        [Status: 200, Size: 932, Words: 65, Lines: 17, Duration: 46ms]
                        [Status: 200, Size: 932, Words: 65, Lines: 17, Duration: 18ms]
[INFO] Starting queued job on target: http://192.168.152.10/img/FUZZ
 
                        [Status: 200, Size: 935, Words: 61, Lines: 17, Duration: 21ms]
                        [Status: 200, Size: 935, Words: 61, Lines: 17, Duration: 21ms]
:: Progress: [207630/207630] :: Job [4/4] :: 1515 req/sec :: Duration: [0:02:07] :: Errors: 0 ::
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/cockpit]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .txt,.html,.php
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.152.10/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .txt .html .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
.htaccess               [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 20ms]
.htaccess.txt           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 21ms]
.htaccess.php           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 18ms]
.htaccess.html          [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 20ms]
.htpasswd               [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 21ms]
.htpasswd.txt           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 21ms]
.htpasswd.html          [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 21ms]
.htpasswd.php           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 21ms]
blocked.html            [Status: 200, Size: 233, Words: 31, Lines: 11, Duration: 21ms]
css                     [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 19ms]
img                     [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 18ms]
index.html              [Status: 200, Size: 3349, Words: 971, Lines: 79, Duration: 22ms]
js                      [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 19ms]
login.php               [Status: 200, Size: 769, Words: 69, Lines: 29, Duration: 18ms]
logout.php              [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 22ms]
server-status           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 24ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1801 req/sec :: Duration: [0:00:45] :: Errors: 0 ::
  • /blocked.html
  • /login.php

/blocked.html

The /blocked.html is a static endpoint that appears to be a possibly redirected page

/login.php

There is a login page at /login.php It reveals a possible username, JDgodd, and a domain; blaze.offsec

Appended the TLD to the blaze

SQLi

The login page appear to be vulnerable to SQL injection

Interactive Graph View

Backlinks