┌─[parrot@parrot]─[~]└──╼ $nmap -oA 10.0.2.28 -sV -p- -Pn -n --version-all --open 10.0.2.28
Starting Nmap 7.94 ( https://nmap.org ) at 2024-03-06 13:31 GMT
Stats: 0:03:24 elapsed;0 hosts completed (1 up), 1 undergoing Connect Scan
Connect Scan Timing: About 43.68% done; ETC: 13:39 (0:04:23 remaining)Nmap scan report for 10.0.2.28
Host is up (0.0038s latency).
Not shown: 65524 filtered tcp ports (no-response), 3 closed tcp ports (conn-refused)Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE VERSION
21/tcp open ftp ProFTPD 1.3.5
22/tcp open ssh OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)80/tcp open http Apache httpd 2.4.7
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)631/tcp open ipp CUPS 1.7
3306/tcp open mysql MySQL (unauthorized)6697/tcp open irc UnrealIRCd
8080/tcp open http Jetty 8.1.7.v20120910
Service Info: Hosts: 127.0.2.1, METASPLOITABLE3-UB1404, irc.TestIRC.net; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 384.36 seconds
Metasploit
Load WMAP
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
[msf](Jobs:0 Agents:0) >> load wmap
.-.-.-..-.-.-..---..---.
|||||||||||||-'
`-----'`-'-'-'`-^-'`-'[WMAP 1.5.1]=== et [] metasploit.com 2012[*] Successfully loaded plugin: wmap
[msf](Jobs:0 Agents:0) >> wmap_sites -a
[-] No site provided.
[msf](Jobs:0 Agents:0) >> wmap_sites
[*] Usage: wmap_sites [options] -h Display this help text
-a [url] Add site (vhost,url) -d [ids] Delete sites (separate ids with space) -l List all available sites
-s [id] Display site structure (vhost,url|ids)(level)(unicode output true/false)
Add Site to Scan
1
2
3
4
5
6
7
8
9
[msf](Jobs:0 Agents:0) >> wmap_sites -a 10.0.2.28
[*] Site created.
[msf](Jobs:0 Agents:0) >> wmap_sites -l
[*] Available sites=============== Id Host Vhost Port Proto # Pages # Forms -- ---- ----- ---- ----- ------- -------
0 10.0.2.28 10.0.2.28 80 http 00
Specify Target URL
Set the specific target URL we want to scan using wmap_targets.
[msf](Jobs:0 Agents:0) >> wmap_run -e
[*] Using ALL wmap enabled modules.
[-] NO WMAP NODES DEFINED. Executing local modules
[*] Testing target:
[*] Site: 10.0.2.28 (10.0.2.28)[*] Port: 80 SSL: false============================================================[*] Testing started. 2024-03-05 05:17:53 +0000
[*]=[ SSL testing ]=============================================================[*] Target is not SSL. SSL modules disabled.
[*]=[ Web Server testing ]=============================================================[*] Module auxiliary/scanner/http/http_version
[+] 10.0.2.28:80 Apache/2.4.7 (Ubuntu)[*] Module auxiliary/scanner/http/open_proxy
[*] Module auxiliary/admin/http/tomcat_administration
[*] Module auxiliary/admin/http/tomcat_utf8_traversal
[*] Attempting to connect to 10.0.2.28:80
[-] No File(s) found
[*] Module auxiliary/scanner/http/drupal_views_user_enum
[-] 10.0.2.28 does not appear to be vulnerable, will not continue[*] Module auxiliary/scanner/http/frontpage_login
[*] 10.0.2.28:80 - http://10.0.2.28/ may not support FrontPage Server Extensions
[*] Module auxiliary/scanner/http/host_header_injection
[+] 10.0.2.28:80/ (10.0.2.28)(200)(GET)(evidence into body) is vulnerable to HTTP Host header injection
[*] Module auxiliary/scanner/http/options
[+] 10.0.2.28 allows GET,HEAD,POST,OPTIONS methods
[*] Module auxiliary/scanner/http/robots_txt
[*] Module auxiliary/scanner/http/scraper
[+][10.0.2.28] / [Index of /][*] Module auxiliary/scanner/http/svn_scanner
[*] Using code '404' as not found.
[*] Module auxiliary/scanner/http/trace
[*] Module auxiliary/scanner/http/vhost_scanner
[*][10.0.2.28] Sending request with random domain YnEnK.
[*][10.0.2.28] Sending request with random domain EILCC.
[-][10.0.2.28] Unable to identify error response
[*] Module auxiliary/scanner/http/webdav_internal_ip
[*] Module auxiliary/scanner/http/webdav_scanner
[*] 10.0.2.28 (Apache/2.4.7 (Ubuntu)) WebDAV disabled.
[*] Module auxiliary/scanner/http/webdav_website_content
[*]=[ File/Dir testing ]=============================================================[*] Module auxiliary/scanner/http/backup_file
[*] Module auxiliary/scanner/http/brute_dirs
[*] Path: /
[*] Using code '404' as not found.
[*] Module auxiliary/scanner/http/copy_of_file
[*] Module auxiliary/scanner/http/dir_listing
[*] Path: /
[+] Found Directory Listing http://10.0.2.28:80/
[*] Module auxiliary/scanner/http/dir_scanner
[*] Path: /
[*] Detecting error code
[*] Using code '404' as not found for 10.0.2.28
[+] Found http://10.0.2.28:80/cgi-bin/ 403(10.0.2.28)[+] Found http://10.0.2.28:80/chat/ 200(10.0.2.28)[+] Found http://10.0.2.28:80/icons/ 403(10.0.2.28)[+] Found http://10.0.2.28:80/phpmyadmin/ 200(10.0.2.28)[+] Found http://10.0.2.28:80/uploads/ 200(10.0.2.28)[*] Module auxiliary/scanner/http/dir_webdav_unicode_bypass
[*] Path: /
[*] Using code '404' as not found.
[*] Module auxiliary/scanner/http/file_same_name_dir
[*] Path: /
[-] Blank or default PATH set.
[*] Module auxiliary/scanner/http/files_dir
[*] Path: /
[*] Using code '404' as not found for files with extension .null
[*] Using code '404' as not found for files with extension .backup
[*] Using code '404' as not found for files with extension .bak
[*] Using code '404' as not found for files with extension .c
[*] Using code '404' as not found for files with extension .cfg
[*] Using code '404' as not found for files with extension .class
[*] Using code '404' as not found for files with extension .copy
[*] Using code '404' as not found for files with extension .conf
[*] Using code '404' as not found for files with extension .exe
[*] Using code '404' as not found for files with extension .html
[*] Using code '404' as not found for files with extension .htm
[*] Using code '404' as not found for files with extension .ini
[*] Using code '404' as not found for files with extension .log
[*] Using code '404' as not found for files with extension .old
[*] Using code '404' as not found for files with extension .orig
[*] Using code '404' as not found for files with extension .php
[*] Using code '404' as not found for files with extension .tar
[*] Using code '404' as not found for files with extension .tar.gz
[*] Using code '404' as not found for files with extension .tgz
[*] Using code '404' as not found for files with extension .tmp
[*] Using code '404' as not found for files with extension .temp
[*] Using code '404' as not found for files with extension .txt
[*] Using code '404' as not found for files with extension .zip
[*] Using code '404' as not found for files with extension ~
[*] Using code '404' as not found for files with extension
[+] Found http://10.0.2.28:80/chat 301[+] Found http://10.0.2.28:80/phpmyadmin 301[+] Found http://10.0.2.28:80/uploads 301[*] Using code '404' as not found for files with extension
[+] Found http://10.0.2.28:80/chat 301[+] Found http://10.0.2.28:80/phpmyadmin 301[+] Found http://10.0.2.28:80/uploads 301[*] Module auxiliary/scanner/http/http_put
[*] Path: /
[-] 10.0.2.28: File doesn't seem to exist. The upload probably failed
[*] Module auxiliary/scanner/http/ms09_020_webdav_unicode_bypass
[*] Path: /
[-] 10.0.2.28:80 Folder does not require authentication. [405][*] Module auxiliary/scanner/http/prev_dir_same_name_file
[*] Path: /
[-] Blank or default PATH set.
[*] Module auxiliary/scanner/http/replace_ext
[*] Module auxiliary/scanner/http/soap_xml
[*] Path: /
[*] Starting scan with 0ms delay between requests
[*] Server 10.0.2.28:80 returned HTTP 404for /. Use a different one.
[*] Module auxiliary/scanner/http/trace_axd
[*] Path: /
[*] Module auxiliary/scanner/http/verb_auth_bypass
[*]=[ Unique Query testing ]=============================================================[*] Module auxiliary/admin/vmware/vcenter_forge_saml_token
[*] Module auxiliary/scanner/http/blind_sql_query
[*] Module auxiliary/scanner/http/error_sql_injection
[*] Module auxiliary/scanner/http/http_traversal
[*] Module auxiliary/scanner/http/rails_mass_assignment
[*] Module exploit/multi/http/lcms_php_exec
[*]=[ Query testing ]=============================================================[*]=[ General testing ]=============================================================++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Launch completed in 226.5683000087738 seconds.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[*] Done.
[msf](Jobs:0 Agents:0) >>
Type the wmap_vulns -l command to display the results of the scan