Nukem_Web_5000

Web

---

Nmap discovered a Web server on the target port 5000 The running service is Werkzeug httpd 1.0.1 (Python 3.8.5)

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nukem]
└─$ curl -I http://$IP:5000/  
HTTP/1.0 404 NOT FOUND
Content-Type: text/html; charset=utf-8
Content-Length: 232
Server: Werkzeug/1.0.1 Python/3.8.5
Date: Mon, 10 Mar 2025 14:14:20 GMT

404 on the web root

Fuzzing

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nukem]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -recursion -u http://$IP:5000/FUZZ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.113.105:5000/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
employees               [Status: 500, Size: 37, Words: 4, Lines: 2, Duration: 50ms]
tracks                  [Status: 500, Size: 37, Words: 4, Lines: 2, Duration: 41ms]
:: Progress: [207630/207630] :: Job [1/1] :: 153 req/sec :: Duration: [0:06:47] :: Errors: 0 ::

ffuf discovered 2 endpoints that were also discovered in the Commander share of the target Samba instance

API Endpoints

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nukem]
└─$ curl -i http://$IP:5000/employees  
HTTP/1.0 500 INTERNAL SERVER ERROR
Content-Type: application/json
Content-Length: 37
Server: Werkzeug/1.0.1 Python/3.8.5
Date: Mon, 10 Mar 2025 15:58:41 GMT
 
{"message": "Internal Server Error"}
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nukem]
└─$ curl -i http://$IP:5000/employees/1
HTTP/1.0 500 INTERNAL SERVER ERROR
Content-Type: application/json
Content-Length: 37
Server: Werkzeug/1.0.1 Python/3.8.5
Date: Mon, 10 Mar 2025 15:59:33 GMT
 
{"message": "Internal Server Error"}
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nukem]
└─$ curl -i http://$IP:5000/tracks   
HTTP/1.0 500 INTERNAL SERVER ERROR
Content-Type: application/json
Content-Length: 37
Server: Werkzeug/1.0.1 Python/3.8.5
Date: Mon, 10 Mar 2025 15:59:13 GMT
 
{"message": "Internal Server Error"}

However, both endpoints results in code 500 There must have been an update because the source code shows that it uses Werkzeug 0.15.3, whereas the current instance uses Werkzeug 1.0.1 N/A