Splodge_Web_8080

Web

---

Nmap discovered a Web server on the target port 8080 The running service is nginx 1.16.1

┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/splodge]
└─$ curl -I http://$IP:8080/                                         
HTTP/1.1 200 OK
Server: nginx/1.16.1
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.6.40
Cache-Control: no-cache, private
Date: Mon, 03 Mar 2025 15:25:26 GMT
Set-Cookie: XSRF-TOKEN=eyJpdiI6IjNlSVBOUUVnNTBXNGV0QlhGRE5TM0E9PSIsInZhbHVlIjoiWFpZcFVPQ29seTVhMzA2amdLNWRSSjQ5SXpQblFWb1pOdFJPNHoyclNSbjBKMml4Z3NKcVNDQ0RlbVg4T1UwdUtZcVpxYXN5SU1cLzhYSlwvbmVLdXJmQT09IiwibWFjIjoiZTI4OWQ2OGNjY2EyZTBiNzc3Y2RlMGFlMmViYjZmZWE0ZTNhNDIxNzA2Y2U2YTZlNGY1YzYyZDkyZjFhOGFhOCJ9; expires=Mon, 03-Mar-2025 17:25:26 GMT; Max-Age=7200; path=/
Set-Cookie: laravel_session=eyJpdiI6IlF1djdaQmIxNDdna2c3UlEzdTlXK2c9PSIsInZhbHVlIjoiMVRWMDU5QUJRT0dkTnYyU1hzSXFKTGQ1aTVvekRsczVyUU1FUUYxa2x2VUdScDRzZW1RY3pGZ3NaMEhocVk3VVBSZ2ZoaXpxNlB4Uzg1b01ZbzV6a1E9PSIsIm1hYyI6IjdiNTllNWI3NGI4NDFmZjNkZTM4MTViZDg2ZDBhMWIzYmFlN2YwZWJkOGQ1ZjI4MWQwNmEwOGM1MTNlZmY1YzcifQ%3D%3D; expires=Mon, 03-Mar-2025 17:25:26 GMT; Max-Age=7200; path=/; httponly

Webroot

While it appears to be a blog, the application is built on Laravel This appears to be the application of the source code found in the .git directory present in other web server

Admin Panel

---

Attempting to access the /admin page, redirects to a login page at /login

Using the found credential works; “ According to the source code, the admin page uses AdminController, and

Profanity Filter

---

As enumerated by reading the source code, the Profanity Filter feature here replaces the filter keyword with the replacement Setting up a regex filter,\test\, should replace any string containing test with replaced!

It works on the comment feature However, it uses the potentially dangerous PHP’s preg_replace function to replace filter keyword with the replacement