Hawat_Web_30455

Web

---

Nmap discovered a Web server on the target port 30455 The running service is nginx 1.18.0

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hawat]
└─$ curl -I -X OPTIONS http://$IP:30455/
HTTP/1.1 405 Not Allowed
Server: nginx/1.18.0
Date: Sat, 08 Mar 2025 14:27:58 GMT
Content-Type: text/html
Content-Length: 157
Connection: keep-alive
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hawat]
└─$ curl -I http://$IP:30455/        
HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Sat, 08 Mar 2025 14:28:05 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/7.4.15

Webroot

It’s a PHP application

Comment

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hawat]
└─$ curl -s http://$IP:30455/index.php | tail -n 5
</div>
 
</div>
</body>
</html><!-- Test adds with URL/?title=test -->

There is an interesting comment at the bottom of the index.php file

title Parameter

---

Interestingly, when the ?title=test string is appended to the index.php file, it is reflected to all the titles within the index.php file

Fuzzing

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hawat]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP:30455/FUZZ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.162.147:30455/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
4                       [Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 26ms]
:: Progress: [20478/20478] :: Job [1/1] :: 1550 req/sec :: Duration: [0:00:13] :: Errors: 0 ::
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/hawat]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP:30455/FUZZ -ic -e .php
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.162.147:30455/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Extensions       : .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 3356, Words: 409, Lines: 122, Duration: 33ms]
index.php               [Status: 200, Size: 3356, Words: 409, Lines: 122, Duration: 33ms]
4                       [Status: 301, Size: 169, Words: 5, Lines: 8, Duration: 29ms]
phpinfo.php             [Status: 200, Size: 68627, Words: 3339, Lines: 744, Duration: 39ms]
:: Progress: [415260/415260] :: Job [1/1] :: 1492 req/sec :: Duration: [0:04:47] :: Errors: 0 ::

ffuf discovered the phpinfo.php file

phpinfo.php

---

The phpinfo.php file reveals that it uses PHP 7.4.15

Application Root Directory Disclosure

---

It also reveals the web application root; /srv/http