Shifty_Web_5000

Web

---

Nmap discovered a Web server on the target port 5000 The running service is Werkzeug httpd 1.0.1 (Python 3.5.3)

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shifty]
└─$ curl -I http://$IP:5000/
HTTP/1.0 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 897
Set-Cookie: session=0feaead2-d0fb-4288-a675-5713e0380c9d; Expires=Sat, 05-Apr-2025 09:55:21 GMT; HttpOnly; Path=/
Server: Werkzeug/1.0.1 Python/3.5.3
Date: Wed, 05 Mar 2025 09:55:21 GMT

Webroot It’s a Flask demo site

Login

---

There is a credential disclosure; admin:admin

Authenticated as the admin user and redirected to the /admin endpoint

Additionally, debugging doesn’t seem to be enabled

Fuzzing

---

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shifty]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt  -u http://$IP:5000/FUZZ -ic -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.219.59:5000/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
admin                   [Status: 302, Size: 209, Words: 22, Lines: 4, Duration: 26ms]
login                   [Status: 200, Size: 1572, Words: 576, Lines: 42, Duration: 41ms]
logout                  [Status: 302, Size: 209, Words: 22, Lines: 4, Duration: 38ms]
:: Progress: [20478/20478] :: Job [1/1] :: 714 req/sec :: Duration: [0:00:32] :: Errors: 0 ::
 
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/shifty]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP:5000/FUZZ/ -ic -fc 403
________________________________________________
 :: Method           : GET
 :: URL              : http://192.168.219.59:5000/FUZZ/
 :: Wordlist         : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response status: 403
________________________________________________
:: Progress: [207630/207630] :: Job [1/1] :: 749 req/sec :: Duration: [0:04:50] :: Errors: 0 ::

N/A