# Probe

{% embed url="<https://miro.medium.com/v2/resize:fit:720/format:webp/1*zdRbs1MdUHvB85fPBt9NGg.png>" %}

We start with a `nmap` scan

`nmap -sV -sS 10.10.196.80 -vv`

**What is the version of the Apache server?**

<figure><img src="https://2070718299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBjKwlEF6AUwYfFhnAf%2Fuploads%2FcJHNrMDTg42sQXqzfg5r%2Fimage.png?alt=media&#x26;token=4cd0b04d-246f-4029-baeb-a779e5678b8f" alt=""><figcaption></figcaption></figure>

With question 1 done, we see that our scan didn't catch a port for FTP

I ran `rustcan -a 10.10.196.80` to scan all the ports fast

**What is the port number of the FTP service?**

<figure><img src="https://2070718299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBjKwlEF6AUwYfFhnAf%2Fuploads%2FiSyzGT2q5EKzG60TtTHg%2Fimage.png?alt=media&#x26;token=626db15c-7c13-44d6-b693-a3c26a696bd6" alt=""><figcaption></figcaption></figure>

**What is the FQDN for the website hosted using a self-signed certificate and contains critical server information as the homepage?**

What is the email address associated with the SSL certificate used to sign the website mentioned in Q3?

<div align="left"><figure><img src="https://2070718299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBjKwlEF6AUwYfFhnAf%2Fuploads%2F8BkAugv5arGSKUydvZwp%2Fimage.png?alt=media&#x26;token=11437729-44e7-4bfa-bc66-01fa00b1246c" alt=""><figcaption></figcaption></figure></div>

**What is the value of the PHP Extension Build on the server?**

<figure><img src="https://2070718299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBjKwlEF6AUwYfFhnAf%2Fuploads%2FgT7yPChKOY8GHPGpWQNE%2Fimage.png?alt=media&#x26;token=edb2a256-cd1c-43f3-8c8d-4a6ffd0953ce" alt=""><figcaption></figcaption></figure>

**What is the banner for the FTP service?**

<div align="left"><figure><img src="https://2070718299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBjKwlEF6AUwYfFhnAf%2Fuploads%2FlmtFN9g76f4YPZPv9WxM%2Fimage.png?alt=media&#x26;token=a1442839-e177-4436-acf9-b9bc1fbd29af" alt=""><figcaption></figcaption></figure></div>

**What software is used for managing the database on the server?**

<figure><img src="https://2070718299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBjKwlEF6AUwYfFhnAf%2Fuploads%2FMiuwBwwVESI7xp2XXwsZ%2Fimage.png?alt=media&#x26;token=299a01f0-1e48-44fa-891d-4e03d7d4b66f" alt=""><figcaption></figcaption></figure>

**What is the Content Management System (CMS) hosted on the server?**

**What is the version number of the CMS hosted on the server?**

<figure><img src="https://2070718299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBjKwlEF6AUwYfFhnAf%2Fuploads%2F6tlMQz2kaYo96AKV2ZDy%2Fimage.png?alt=media&#x26;token=7391ffcb-f469-4f2b-bb6a-63637f7fa1a5" alt=""><figcaption></figcaption></figure>

**What is the username for the admin panel of the CMS?**

`wpscan --url https://10.10.196.80:9007 --disable-tls-checks`

<figure><img src="https://2070718299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBjKwlEF6AUwYfFhnAf%2Fuploads%2F4YV3FxQ8uit2NeC6DBvv%2Fimage.png?alt=media&#x26;token=c3fe0c4f-d239-4513-8be0-e541a2597f15" alt=""><figcaption></figcaption></figure>

**During vulnerability scanning, OSVDB-3092 detects a file that may be used to identify the blogging site software. What is the name of the file?**

**What is the name of the software being used on the standard HTTP port?**

**What is the flag value associated with the web page hosted on port 8000?**

<figure><img src="https://2070718299-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MBjKwlEF6AUwYfFhnAf%2Fuploads%2FYrIS44Zcw8Em7T696yfi%2Fimage.png?alt=media&#x26;token=2e46c80d-c55b-4cdd-9de7-f837765e41ee" alt=""><figcaption></figcaption></figure>
