Pebbles_Web_80

Web

---

Nmap discovered a Web server on the target port 80 The running service is Apache httpd 2.4.18 ((Ubuntu))

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/pebbles]
└─$ curl -I -X OPTIONS http://$IP/                          
HTTP/1.1 200 OK
Date: Tue, 11 Mar 2025 17:54:45 GMT
Server: Apache/2.4.18 (Ubuntu)
Vary: Accept-Encoding
Content-Length: 1134
Content-Type: text/html; charset=UTF-8
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/pebbles]
└─$ curl -I http://$IP/        
HTTP/1.1 200 OK
Date: Tue, 11 Mar 2025 17:54:50 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Type: text/html; charset=UTF-8

Webroot It’s a login page to a custom application

It’s a PHP application

Fuzzing

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/pebbles]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ -ic -e .php,.txt
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.209.52/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Extensions       : .php .txt 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
images                  [Status: 301, Size: 317, Words: 20, Lines: 10, Duration: 22ms]
index.php               [Status: 200, Size: 1134, Words: 43, Lines: 38, Duration: 26ms]
                        [Status: 200, Size: 1134, Words: 43, Lines: 38, Duration: 41ms]
css                     [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 21ms]
javascript              [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 23ms]
zm                      [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 25ms]
.php                    [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 30ms]
server-status           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 20ms]
:: Progress: [622890/622890] :: Job [1/1] :: 1408 req/sec :: Duration: [0:06:37] :: Errors: 0 ::
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/pebbles]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.209.52/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 1134, Words: 43, Lines: 38, Duration: 21ms]
images                  [Status: 301, Size: 317, Words: 20, Lines: 10, Duration: 25ms]
css                     [Status: 301, Size: 314, Words: 20, Lines: 10, Duration: 18ms]
javascript              [Status: 301, Size: 321, Words: 20, Lines: 10, Duration: 17ms]
zm                      [Status: 301, Size: 313, Words: 20, Lines: 10, Duration: 23ms]
server-status           [Status: 403, Size: 279, Words: 20, Lines: 10, Duration: 22ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1801 req/sec :: Duration: [0:02:12] :: Errors: 0 ::

zm

zm

---

There is a ZoneMinder instance running at the /zm/ endpoint