Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-02 20:37 CST Warning: 192.168.56.114 giving up on port because retransmission cap hit (10). Nmap scan report for 192.168.56.114 Host is up (0.00050s latency). Not shown: 37405 filtered tcp ports (no-response), 28127 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http 111/tcp open rpcbind 49405/tcp open unknown MAC Address: 08:00:27:70:CC:B2 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 116.67 seconds
TCP, Service, OS Scan:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-02 20:39 CST Nmap scan report for 192.168.56.114 Host is up (0.00093s latency).
PORT STATE SERVICE VERSION 80/tcp open http nginx 1.6.2 111/tcp open rpcbind 2-4 (RPC #100000) 49405/tcp open status 1 (RPC #100024) MAC Address: 08:00:27:70:CC:B2 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running: Linux 3.X|4.X OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 OS details: Linux 3.2 - 4.9 Network Distance: 1 hop
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.06 seconds
UDP Scan:
1 2 3 4 5 6 7 8 9 10 11
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-02 20:39 CST Warning: 192.168.56.114 giving up on port because retransmission cap hit (10). Nmap scan report for 192.168.56.114 Host is up (0.0016s latency). Not shown: 65458 open|filtered udp ports (no-response), 75 closed udp ports (port-unreach) PORT STATE SERVICE 111/udp open rpcbind 40520/udp open unknown MAC Address: 08:00:27:70:CC:B2 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 72.85 seconds
Simple Vuln Scan:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-02 20:40 CST Nmap scan report for 192.168.56.114 Host is up (0.00022s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 80/tcp open http |_http-stored-xss: Couldn't find any stored XSS vulnerabilities. |_http-dombased-xss: Couldn't find any DOM based XSS. | http-csrf: | Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.56.114 | Found the following possible CSRF vulnerabilities: | | Path: http://192.168.56.114:80/contact.php | Form id: fname |_ Form action: thankyou.php 111/tcp open rpcbind MAC Address: 08:00:27:70:CC:B2 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 74.57 seconds
nikto Vuln Scan:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
- Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 192.168.56.114 + Target Hostname: 192.168.56.114 + Target Port: 80 + Start Time: 2023-06-02 20:41:49 (GMT8) --------------------------------------------------------------------------- + Server: nginx/1.6.2 + /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + No CGI Directories found (use '-C all' to force check all possible dirs) + /#wp-config.php#: #wp-config.php# file found. This file contains the credentials. + 8102 requests: 0 error(s) and 3 item(s) reported on remote host + End Time: 2023-06-02 20:42:12 (GMT8) (23 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
┌──(kali㉿kali)-[~] └─$ sudo nc -lvp 443 [sudo] password for kali: listening on [any] 443 ... 192.168.56.114: inverse host lookup failed: Unknown host connect to [192.168.56.144] from (UNKNOWN) [192.168.56.114] 53100 bash: cannot set terminal process group (482): Inappropriate ioctl for device bash: no job control in this shell www-data@dc-5:~/html$
