Web
Nmap discovered a Web server on the port 80 of the BLUEPRINT(10.10.136.191) host.
The running service is Microsoft IIS httpd 7.5
┌──(kali㉿kali)-[~/archive/thm]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 200 OK
Allow: OPTIONS, TRACE, GET, HEAD, POST
Server: Microsoft-IIS/7.5
Public: OPTIONS, TRACE, GET, HEAD, POST
Date: Sat, 05 Jul 2025 09:52:51 GMT
Content-Length: 0
┌──(kali㉿kali)-[~/archive/thm]
└─$ curl -I http://$IP/
HTTP/1.1 404 Not Found
Content-Length: 1245
Server: Microsoft-IIS/7.5
Date: Sat, 05 Jul 2025 09:52:54 GMT
Webroot
404
Fuzzing
┌──(kali㉿kali)-[~/archive/thm/blueprint]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .html,.txt,.asp
________________________________________________
:: Method : GET
:: URL : http://10.10.136.191/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
:: Extensions : .html .txt .asp
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
:: Progress: [81912/81912] :: Job [1/1] :: 146 req/sec :: Duration: [0:08:41] :: Errors: 0 ::
┌──(kali㉿kali)-[~/archive/thm/blueprint]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ/ -ic
________________________________________________
:: Method : GET
:: URL : http://10.10.136.191/FUZZ/
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
:: Progress: [207630/207630] :: Job [1/1] :: 459 req/sec :: Duration: [0:21:31] :: Errors: 0 ::N/A