Nibbles_OffSec_Web

Web

---

Nmap discovered a Web server on the target port 80 The running service is Apache httpd 2.4.38 ((Debian))

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nibbles_offsec]
└─$ curl -I http://$IP/               
HTTP/1.1 200 OK
Date: Sat, 01 Mar 2025 11:46:03 GMT
Server: Apache/2.4.38 (Debian)
Last-Modified: Tue, 14 Apr 2020 13:25:06 GMT
ETag: "4f8-5a34020bc5080"
Accept-Ranges: bytes
Content-Length: 1272
Vary: Accept-Encoding
Content-Type: text/html

Webroot This appears to be a development website Interestingly, there is a database icon

Checking the Burp Suite’s passive crawler shows another demo page

Fuzzing

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nibbles_offsec]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -u http://$IP/FUZZ -ic -e .html,.txt -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.148.47/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt
 :: Extensions       : .html .txt 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
.                       [Status: 200, Size: 1272, Words: 178, Lines: 30, Duration: 18ms]
index.html              [Status: 200, Size: 1272, Words: 178, Lines: 30, Duration: 19ms]
page2.html              [Status: 200, Size: 4115, Words: 617, Lines: 170, Duration: 20ms]
:: Progress: [168879/168879] :: Job [1/1] :: 1769 req/sec :: Duration: [0:01:36] :: Errors: 0 ::
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nibbles_offsec]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ/ -ic -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.148.47/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
                        [Status: 200, Size: 1272, Words: 178, Lines: 30, Duration: 21ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1960 req/sec :: Duration: [0:01:56] :: Errors: 0 ::

N/A