Web
Nmap discovered a Web server on the target port 45332
The running service is Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.3.23)
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/medjed]
└─$ curl -I -X OPTIONS http://$IP:45332/
HTTP/1.1 200 OK
Date: Fri, 11 Apr 2025 16:46:29 GMT
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.3.23
Allow: GET,POST,OPTIONS,HEAD,TRACE
Content-Length: 0
Content-Type: text/html
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/medjed]
└─$ curl -I http://$IP:45332/
HTTP/1.1 200 OK
Date: Fri, 11 Apr 2025 16:46:32 GMT
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.3.23
Last-Modified: Tue, 03 Nov 2020 19:13:21 GMT
ETag: "377-5b338a7ff72a5"
Accept-Ranges: bytes
Content-Length: 887
Content-Type: text/html/Practice/Medjed/2-Enumeration/attachments/{5CE1C1AE-C9C1-4A41-9695-B458010F8928}.png)
Webroot
It claims to be a quiz app
It appears to be a mirror instance of web server on the target port 45443
/Practice/Medjed/2-Enumeration/attachments/{ACF4758F-80EB-46D8-B2F2-B0E075864675}.png)
Wappalyzer identified technologies involved
Fuzzing
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/medjed]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP:45332/FUZZ -ic -e .html,.txt,.php -fc 403
________________________________________________
:: Method : GET
:: URL : http://192.168.156.127:45332/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
:: Extensions : .html .txt .php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response status: 403
________________________________________________
index.html [Status: 200, Size: 887, Words: 130, Lines: 28, Duration: 22ms]
phpinfo.php [Status: 200, Size: 90847, Words: 4597, Lines: 1065, Duration: 25ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1923 req/sec :: Duration: [0:00:45] :: Errors: 0 ::
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/medjed]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP:45332/FUZZ/ -ic
________________________________________________
:: Method : GET
:: URL : http://192.168.156.127:45332/FUZZ/
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
[Status: 200, Size: 887, Words: 130, Lines: 28, Duration: 34ms]
cgi-bin [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 37ms]
icons [Status: 200, Size: 74798, Words: 7383, Lines: 1005, Duration: 57ms]
licenses [Status: 403, Size: 427, Words: 37, Lines: 12, Duration: 22ms]
%20 [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 20ms]
*checkout* [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 22ms]
phpmyadmin [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 23ms]
webalizer [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 22ms]
*docroot* [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 24ms]
* [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 65ms]
con [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 31ms]
http%3a [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 19ms]
**http%3a [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 24ms]
*http%3a [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 21ms]
aux [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 23ms]
%c0 [Status: 403, Size: 308, Words: 22, Lines: 10, Duration: 17ms]
server-status [Status: 403, Size: 427, Words: 37, Lines: 12, Duration: 19ms]
:: Progress: [207630/207630] :: Job [1/1] :: 2061 req/sec :: Duration: [0:02:02] :: Errors: 0 ::N/A