Probe

We start with a nmap scan

nmap -sV -sS 10.10.196.80 -vv

What is the version of the Apache server?

With question 1 done, we see that our scan didn't catch a port for FTP

I ran rustcan -a 10.10.196.80 to scan all the ports fast

What is the port number of the FTP service?

What is the FQDN for the website hosted using a self-signed certificate and contains critical server information as the homepage?

What is the email address associated with the SSL certificate used to sign the website mentioned in Q3?

What is the value of the PHP Extension Build on the server?

What is the banner for the FTP service?

What software is used for managing the database on the server?

What is the Content Management System (CMS) hosted on the server?

What is the version number of the CMS hosted on the server?

What is the username for the admin panel of the CMS?

wpscan --url https://10.10.196.80:9007 --disable-tls-checks

During vulnerability scanning, OSVDB-3092 detects a file that may be used to identify the blogging site software. What is the name of the file?

What is the name of the software being used on the standard HTTP port?

What is the flag value associated with the web page hosted on port 8000?