Heal-HTB

Oceanzbz

2025-02-05

攻防渗透

信息收集

nmap -sC -sV -T4 -Pn 10.10.11.48

记得添加下host映射然后访问

ffuf -w /usr/share/dnsrecon/dnsrecon/data/subdomains-top1mil-20000.txt -u http://heal.htb/ -H "Host:FUZZ.heal.htb" -fc 301 子域名爆破扫到一个api

可以看到是用的ruby先记录留着

在http://heal.htb/suery看到一个新的子域名加入host里面

访问一下发现一个用户名，先记录一下

扫一下这个子域名的目录

dirsearch -u "http://take-survey.heal.htb/index.php/" -t 50 -i 200
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
  from pkg_resources import DistributionNotFound, VersionConflict
 
  _|. _ _  _  _  _ _|_    v0.4.3                                                                                                                            
 (_||| _) (/_(_|| (_| )                                                                                                                                     
                                                                                                                                                            
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 50 | Wordlist size: 11460
 
Output File: /home/kali/Desktop/reports/http_take-survey.heal.htb/_index.php__24-12-15_19-42-06.txt
 
Target: http://take-survey.heal.htb/
 
[19:42:06] Starting: index.php/                                                                                                                             
[19:42:19] 200 -   75KB - /index.php/admin/mysql/index.php                  
[19:42:23] 200 -   74KB - /index.php/apc/index.php                          
[19:42:42] 200 -   74KB - /index.php/pma/index.php                          
[19:42:54] 200 -   75KB - /index.php/web/phpMyAdmin/index.php