Web
Nmap CyberLens a Web server on the port 80 of the CyberLens(10.10.53.112) host.
The running service is Apache httpd 2.4.57 ((Win64))
┌──(kali㉿kali)-[~/archive/thm/cyberlens]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 200 OK
Date: Sat, 05 Jul 2025 11:02:25 GMT
Server: Apache/2.4.57 (Win64)
Allow: HEAD,GET,POST,OPTIONS,TRACE
Content-Length: 0
Content-Type: text/html
┌──(kali㉿kali)-[~/archive/thm/cyberlens]
└─$ curl -I http://$IP/
HTTP/1.1 200 OK
Date: Sat, 05 Jul 2025 11:02:27 GMT
Server: Apache/2.4.57 (Win64)
Last-Modified: Wed, 11 Oct 2023 18:13:36 GMT
ETag: "224c-60774c8383bc8"
Accept-Ranges: bytes
Content-Length: 8780
Content-Type: text/html
Webroot
/about.html
There is a file upload feature at the /about.html endpoint.
CyberLens Image Extractor claims to be extract metadata
Testing reveals that it just sends a OPTIONS request to the /meta endpoint on the port 61777 of the CyberLens(10.10.53.112) host.
While no response was received, there is a web server running on the port 61777
/contact.html
A form submission at the /contact.html endpoint, but it’s a dummy page.
Domain
Initial note reveals a domain; cyberlens.thm
The domain information has been appended to the /etc/hosts file on Kali for local DNS resolution.
Fuzzing
┌──(kali㉿kali)-[~/archive/thm/cyberlens]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -ic -e .html,.txt,.php -fs 1046 -fs 199
________________________________________________
:: Method : GET
:: URL : http://10.10.53.112/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
:: Extensions : .html .txt .php
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 199
________________________________________________
About.html [Status: 200, Size: 6254, Words: 1595, Lines: 189, Duration: 46ms]
Contact.html [Status: 200, Size: 4880, Words: 1231, Lines: 161, Duration: 38ms]
Images [Status: 301, Size: 235, Words: 14, Lines: 8, Duration: 40ms]
Index.html [Status: 200, Size: 8780, Words: 2728, Lines: 233, Duration: 41ms]
about.html [Status: 200, Size: 6254, Words: 1595, Lines: 189, Duration: 40ms]
contact.html [Status: 200, Size: 4880, Words: 1231, Lines: 161, Duration: 44ms]
css [Status: 301, Size: 232, Words: 14, Lines: 8, Duration: 35ms]
images [Status: 301, Size: 235, Words: 14, Lines: 8, Duration: 40ms]
index.html [Status: 200, Size: 8780, Words: 2728, Lines: 233, Duration: 38ms]
js [Status: 301, Size: 231, Words: 14, Lines: 8, Duration: 40ms]
:: Progress: [81912/81912] :: Job [1/1] :: 403 req/sec :: Duration: [0:02:09] :: Errors: 0 ::
┌──(kali㉿kali)-[~/archive/thm/cyberlens]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://$IP/FUZZ/ -ic -fs 199
________________________________________________
:: Method : GET
:: URL : http://10.10.53.112/FUZZ/
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 199
________________________________________________
[Status: 200, Size: 8780, Words: 2728, Lines: 233, Duration: 55ms]
images [Status: 200, Size: 1546, Words: 73, Lines: 38, Duration: 55ms]
css [Status: 200, Size: 458, Words: 29, Lines: 16, Duration: 45ms]
js [Status: 200, Size: 384, Words: 25, Lines: 14, Duration: 38ms]
:: Progress: [207630/207630] :: Job [1/1] :: 966 req/sec :: Duration: [0:04:41] :: Errors: 0 ::N/A
Virtual Host / Sub-domain Discovery
┌──(kali㉿kali)-[~/archive/thm/cyberlens]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://$IP/ -H 'Host: FUZZ.cyberlens.thm' -ic -mc all -fs 8780
________________________________________________
:: Method : GET
:: URL : http://10.10.53.112/
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
:: Header : Host: FUZZ.cyberlens.thm
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: all
:: Filter : Response size: 8780
________________________________________________
:: Progress: [114438/114438] :: Job [1/1] :: 1047 req/sec :: Duration: [0:02:03] :: Errors: 0 ::N/A