80/tcp open http Apache httpd |_http-server-header: Apache |_http-title: Site doesn't have a title (text/html).
└─# nikto -host 192.168.240.132 -p 80 - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 192.168.240.132 + Target Hostname: 192.168.240.132 + Target Port: 80 + Start Time: 2024-12-0109:14:42 (GMT8) --------------------------------------------------------------------------- + Server: Apache + /: The X-Content-Type-Options header isnot set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + /3TVZlj5i.asmx: Retrieved x-powered-by header: PHP/5.5.29. + No CGI Directories found (use '-C all' toforce check all possible dirs) + /index: Uncommon header 'tcn' found, with contents: list. + /index: Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute forcefile names. The following alternatives for'index' were found: index.html, index.php. See: http://www.wisec.it/sectou.php?id=4698ebdc59d15,https://exchange.xforce.ibmcloud.com/vulnerabilities/8275 + /admin/: This might be interesting. + /image/: Drupal Link header found with value: <http://192.168.240.132/?p=23>; rel=shortlink. See: https://www.drupal.org/ + /wp-links-opml.php: This WordPress script reveals the installed version. + /license.txt: License file found may identify site software. + /admin/index.html: Admin login page/section found. + /wp-login/: Cookie wordpress_test_cookie created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + /wp-login/: Admin login page/section found. + /wordpress/: A Wordpress installation was found. + /wp-admin/wp-login.php: Wordpress login found. + /wordpress/wp-admin/wp-login.php: Wordpress login found. + /blog/wp-login.php: Wordpress login found. + /wp-login.php: Wordpress login found. + /wordpress/wp-login.php: Wordpress login found. + /#wp-config.php#: #wp-config.php# file found. This file contains the credentials. + 8102 requests: 0error(s) and18 item(s) reported on remote host + EndTime: 2024-12-0109:16:26 (GMT8) (104 seconds) 存在robots.txt,找到一个字典还有一个密钥
443/tcp open ssl/http Apache httpd |_http-title: Site doesn't have a title (text/html). |_http-server-header: Apache | ssl-cert: Subject: commonName=www.example.com | Not valid before: 2015-09-16T10:45:03 |_Not valid after: 2025-09-13T10:45:03
└─# nikto -host 192.168.240.132 -p 443 - Nikto v2.5.0 --------------------------------------------------------------------------- + Target IP: 192.168.240.132 + Target Hostname: 192.168.240.132 + Target Port: 443 --------------------------------------------------------------------------- + SSL Info: Subject: /CN=www.example.com Ciphers: ECDHE-RSA-AES256-GCM-SHA384 Issuer: /CN=www.example.com + Start Time: 2024-12-0109:15:21 (GMT8) --------------------------------------------------------------------------- + Server: Apache + /: The site uses TLS and the Strict-Transport-Security HTTP header isnot defined. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security + /: The X-Content-Type-Options header isnot set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/ + /uN3ftIqo.sys: Retrieved x-powered-by header: PHP/5.5.29. + No CGI Directories found (use '-C all' toforce check all possible dirs) + /index: Uncommon header 'tcn' found, with contents: list. + /index: Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute forcefile names. The following alternatives for'index' were found: index.html, index.php. See: http://www.wisec.it/sectou.php?id=4698ebdc59d15,https://exchange.xforce.ibmcloud.com/vulnerabilities/8275 + /: The Content-Encoding header is set to"deflate" which may mean that the server is vulnerable to the BREACH attack. See: http://breachattack.com/ + Hostname '192.168.240.132' does not match certificate's names: www.example.com. See: https://cwe.mitre.org/data/definitions/297.html + /admin/: This might be interesting. + /image/: Drupal Link header found with value: <https://192.168.240.132/?p=23>; rel=shortlink. See: https://www.drupal.org/ + /wp-links-opml.php: This WordPress script reveals the installed version. + /license.txt: License file found may identify site software. + /admin/index.html: Admin login page/section found. + /wp-login/: Cookie wordpress_test_cookie created without the secure flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + /wp-login/: Cookie wordpress_test_cookie created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies + /wp-login/: Admin login page/section found. + /wordpress/: A Wordpress installation was found. + /wp-admin/wp-login.php: Wordpress login found. + /wordpress/wp-admin/wp-login.php: Wordpress login found. + /blog/wp-login.php: Wordpress login found. + /wp-login.php: Wordpress login found. + /wordpress/wp-login.php: Wordpress login found. + /#wp-config.php#: #wp-config.php# file found. This file contains the credentials. + 8103 requests: 0error(s) and22 item(s) reported on remote host + EndTime: 2024-12-0109:18:55 (GMT8) (214 seconds) --------------------------------------------------------------------------- + 1 host(s) tested 也有robots.txt以及字典文件
