InfoSec LAB

Postfish_Web

Created: 3 min read

Web

Nmap discovered a Web server on the target port 80 The running service is Apache httpd 2.4.41 ((Ubuntu))

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/postfish]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 200 OK
Date: Wed, 26 Mar 2025 10:54:20 GMT
Server: Apache/2.4.41 (Ubuntu)
Allow: HEAD,GET,POST,OPTIONS
Content-Length: 0
Content-Type: text/html
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/postfish]
└─$ curl -i http://$IP/                              
HTTP/1.1 200 OK
Date: Wed, 26 Mar 2025 10:54:43 GMT
Server: Apache/2.4.41 (Ubuntu)
Last-Modified: Tue, 26 Jan 2021 10:32:55 GMT
ETag: "53-5b9cb2d767fad"
Accept-Ranges: bytes
Content-Length: 83
Vary: Accept-Encoding
Content-Type: text/html
 
<head>
  <meta http-equiv='refresh' content='0; URL=http://postfish.off/'>
</head>

Redirect to a domain; postfish.off

The /etc/hosts file on Kali has been updated for local DNS resolution

Webroot

Users

The team.html file contains possible usernames;

Fuzzing

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/postfish]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://postfish.off/FUZZ -ic -e .txt,.html,.php -fc 302
________________________________________________
 :: Method           : GET
 :: URL              : http://postfish.off/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Extensions       : .txt .html .php 
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 302
________________________________________________
.htpasswd               [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 31ms]
.htaccess.php           [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 31ms]
.htaccess               [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 31ms]
.htpasswd.txt           [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 28ms]
.htpasswd.html          [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 27ms]
.htaccess.txt           [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 31ms]
.htaccess.html          [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 31ms]
.htpasswd.php           [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 25ms]
index.html              [Status: 200, Size: 4898, Words: 595, Lines: 101, Duration: 20ms]
server-status           [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 28ms]
team.html               [Status: 200, Size: 6195, Words: 890, Lines: 187, Duration: 21ms]
:: Progress: [81912/81912] :: Job [1/1] :: 1769 req/sec :: Duration: [0:00:47] :: Errors: 0 ::
 
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/postfish]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -recursion -u http://postfish.off/FUZZ -ic
________________________________________________
 :: Method           : GET
 :: URL              : http://postfish.off/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
                        [Status: 200, Size: 4898, Words: 595, Lines: 101, Duration: 30ms]
server-status           [Status: 403, Size: 277, Words: 20, Lines: 10, Duration: 22ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1818 req/sec :: Duration: [0:02:02] :: Errors: 0 ::

N/A

Virtual Hosts / Sub-domain Discovery

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/postfish]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://$IP/ -H 'Host: FUZZ.postfish.off' -ic -mc all -fs 83
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.111.137/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
 :: Header           : Host: FUZZ.postfish.off
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: all
 :: Filter           : Response size: 83
________________________________________________
:: Progress: [114437/114437] :: Job [1/1] :: 1904 req/sec :: Duration: [0:01:09] :: Errors: 0 ::

N/A

Interactive Graph View

Backlinks