InfoSec LAB

Fish_Web_8080

Created: 2 min read

Web

Nmap discovered a Web server on the target port 8080 The running service is Sun GlassFish Open Source Edition 4.1

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/fish]
└─$ curl -I -X OPTIONS http://$IP:8080/
HTTP/1.1 200 OK
Server: GlassFish Server Open Source Edition  4.1 
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition  4.1  Java/AdoptOpenJDK/1.8)
Allow: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS
Date: Sat, 30 Oct 2021 04:15:22 GMT
Content-Length: 0
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/fish]
└─$ curl -I http://$IP:8080/        
HTTP/1.1 200 OK
Server: GlassFish Server Open Source Edition  4.1 
X-Powered-By: Servlet/3.1 JSP/2.3 (GlassFish Server Open Source Edition  4.1  Java/AdoptOpenJDK/1.8)
Accept-Ranges: bytes
ETag: W/"12113-1621220744000"
Last-Modified: Mon, 17 May 2021 03:05:44 GMT
Content-Length: 12113
Content-Type: text/html
Date: Sat, 30 Oct 2021 04:15:25 GMT

Webroot Data Web application The instance is also hosted on the target port 8181 over TLS

Fuzzing

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/fish]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP:8080/FUZZ -ic -e .html,.txt -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.219.168:8080/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .html .txt 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
css                     [Status: 301, Size: 182, Words: 8, Lines: 7, Duration: 25ms]
images                  [Status: 301, Size: 185, Words: 8, Lines: 7, Duration: 32ms]
index.html              [Status: 200, Size: 12113, Words: 4670, Lines: 285, Duration: 26ms]
j_security_check        [Status: 401, Size: 1090, Words: 55, Lines: 1, Duration: 25ms]
js                      [Status: 301, Size: 181, Words: 8, Lines: 7, Duration: 25ms]
:: Progress: [61434/61434] :: Job [1/1] :: 1639 req/sec :: Duration: [0:00:41] :: Errors: 0 ::
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/fish]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP:8080/FUZZ/ -ic -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.219.168:8080/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
                        [Status: 200, Size: 12113, Words: 4670, Lines: 285, Duration: 22ms]
%c0                     [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 38ms]
external%5cx-news       [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 22ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1369 req/sec :: Duration: [0:02:17] :: Errors: 0 ::

/j_security_check

j_security_check Endpoint

Basic HTTP authentication at the j_security_check endpoint Likely linked to the admin console on the targe port 4848

Interactive Graph View

Backlinks