┌──(kali㉿kali)-[~/Downloads/HASTEVM] └─$ sudo nmap --min-rate 10000 -p- 192.1.1.150 [sudo] password for kali: Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-12 09:28 EDT Nmap scan report for 192.1.1.150 Host is up (0.0023s latency). Not shown: 65534 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http MAC Address: 00:0C:29:B3:82:58 (VMware)
┌──(kali㉿kali)-[~/Downloads/HASTEVM] └─$ sudo nmap -sT -sV -sC -O -p80 192.1.1.150 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-12 09:39 EDT Nmap scan report for 192.1.1.150 Host is up (0.00035s latency).
PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.18 ((Ubuntu)) |_http-title: H.A.S.T.E | http-robots.txt: 1 disallowed entry |_/spukcab |_http-server-header: Apache/2.4.18 (Ubuntu) MAC Address: 00:0C:29:B3:82:58 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.42 seconds
┌──(kali㉿kali)-[~/Downloads/HASTEVM] └─$ sudo nmap --script=vuln -p80 192.1.1.150 Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-12 09:39 EDT Nmap scan report for 192.1.1.150 Host is up (0.00028s latency).
PORT STATE SERVICE 80/tcp open http |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug) | http-stored-xss: | Found the following stored XSS vulnerabilities: | | Payload: ghz>hzx | Uploaded on: http://192.1.1.150:80/receipt.php |_ Description: Unfiltered '>' (greater than sign). An indication of potential XSS vulnerability. | http-slowloris-check: | VULNERABLE: | Slowloris DOS attack | State: LIKELY VULNERABLE | IDs: CVE:CVE-2007-6750 | Slowloris tries to keep many connections to the target web server open and hold | them open as long as possible. It accomplishes this by opening connections to | the target web server and sending a partial request. By doing so, it starves | the http server's resources causing Denial Of Service. | | Disclosure date: 2009-09-17 | References: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750 |_ http://ha.ckers.org/slowloris/ |_http-phpself-xss: ERROR: Script execution failed (use -d to debug) | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.1.1.150 | Found the following possible CSRF vulnerabilities: | | Path: http://192.1.1.150:80/ | Form id: | Form action: receipt.php | | Path: http://192.1.1.150:80/layout/scripts/jquery.mobilemenu.js | Form id: | Form action: # | | Path: http://192.1.1.150:80/index.php | Form id: |_ Form action: receipt.php |_http-dombased-xss: Couldn't find any DOM based XSS. | http-fileupload-exploiter: | | Couldn't find a file-type field. | |_ Couldn't find a file-type field. | http-enum: | /robots.txt: Robots file | /images/: Potentially interesting directory w/ listing on 'apache/2.4.18 (ubuntu)' |_ /pages/: Potentially interesting directory w/ listing on 'apache/2.4.18 (ubuntu)' MAC Address: 00:0C:29:B3:82:58 (VMware)
www-data@ConverterPlus:/tmp$ cat /etc/crontab cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
