Lab: Web Server Attack — EHE

Objectives ▲

Phase 1 — Reconnaissance

Scan the target for open services

Identify the FTP service version

Phase 10/2

Phase 2 — Credential Cracking

Launch a dictionary attack against FTP

Successfully crack FTP credentials

Phase 20/2

Phase 3 — FTP Access

Download the database backup via FTP

Extract database credentials from config.php

Phase 30/2

Phase 4 — Web Server

Discover hidden directories on the web server

Find the exposed server-status page

Phase 40/2

Command Reference ▲

                        nmap -sV <ip>

                        nmap --script ftp-anon <ip>

                        hydra -L users.txt -P passwords.txt ftp://<ip>

                        medusa -h <ip> -U users.txt -P passwords.txt -M ftp

                        ftp <ip> (then: ls, get, cd, pwd, quit)

                        cat <file>

                        curl http://<ip>[/path]

                        dirb http://<ip>

                        gobuster dir -u http://<ip> -w <wordlist>

                        help — list all commands

                        objectives — show progress

                        clear — clear terminal

[ ]Phase 1: Recon

[ ]Phase 2: Cracking

[ ]Phase 3: FTP

[ ]Phase 4: Web Server

pentester@kali:~$