Web
Nmap discovered a Web server on the target port 80
The running service is Microsoft IIS httpd 10.0
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ curl -I -X OPTIONS http://$IP/
HTTP/1.1 200 OK
Transfer-Encoding: chunked
Server: Microsoft-IIS/10.0
Date: Wed, 23 Apr 2025 12:39:04 GMT
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ curl -I http://$IP/
HTTP/1.1 200 OK
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
Date: Wed, 23 Apr 2025 12:39:07 GMT/Practice/Nagoya/2-Enumeration/attachments/{E9DC61CB-DD6A-43DA-8B53-77D5BE9FCF2F}.png)
Webroot
Nagoya Industries is a fishing business
Team
/Practice/Nagoya/2-Enumeration/attachments/{DAF531D1-2AA6-4401-86B6-5A218A889988}.png)
The /Team endpoint contains a list of firstnames and lastnames
This seems to suggest that username generation might be the key
Fuzzing
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt -u http://nagoya.nagoya-industries.com/FUZZ -ic -e .html,.txt -fc 403
________________________________________________
:: Method : GET
:: URL : http://nagoya.nagoya-industries.com/FUZZ
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/big.txt
:: Extensions : .html .txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response status: 403
________________________________________________
Index [Status: 200, Size: 3530, Words: 831, Lines: 79, Duration: 32ms]
error [Status: 200, Size: 3128, Words: 652, Lines: 69, Duration: 32ms]
favicon.ico [Status: 200, Size: 5430, Words: 9, Lines: 1, Duration: 29ms]
index [Status: 200, Size: 3530, Words: 831, Lines: 79, Duration: 31ms]
team [Status: 200, Size: 6896, Words: 3634, Lines: 180, Duration: 49ms]
:: Progress: [61434/61434] :: Job [1/1] :: 536 req/sec :: Duration: [0:00:51] :: Errors: 0 ::
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt -u http://nagoya.nagoya-industries.com/FUZZ/ -ic -fc 403
________________________________________________
:: Method : GET
:: URL : http://nagoya.nagoya-industries.com/FUZZ/
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-lowercase-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response status: 403
________________________________________________
index [Status: 200, Size: 3530, Words: 831, Lines: 79, Duration: 26ms]
team [Status: 200, Size: 6896, Words: 3634, Lines: 180, Duration: 46ms]
error [Status: 200, Size: 3128, Words: 652, Lines: 69, Duration: 30ms]
:: Progress: [207630/207630] :: Job [1/1] :: 1351 req/sec :: Duration: [0:02:44] :: Errors: 0 ::/error
/error
/Practice/Nagoya/2-Enumeration/attachments/{91919B54-7AFC-446D-8D8C-1FCD102949A9}.png)
The /error endpoint reveals that the it’s a ASP.NET web application
Virtual Host / Sub-domain Discovery
┌──(kali㉿kali)-[~/PEN-200/PG_PRACTICE/nagoya]
└─$ ffuf -c -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://$IP/ -H 'Host: FUZZ.nagoya-industries.com' -ic -mc all -fs 3530
________________________________________________
:: Method : GET
:: URL : http://192.168.158.21/
:: Wordlist : FUZZ: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt
:: Header : Host: FUZZ.nagoya-industries.com
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: all
:: Filter : Response size: 3530
________________________________________________
:: Progress: [114437/114437] :: Job [1/1] :: 1098 req/sec :: Duration: [0:01:49] :: Errors: 0 ::N/A