Hack The Box-Codify，1307页阿里网络安全面试全套真题解析在互联网火了

最新推荐文章于 2024-08-21 22:00:57 发布

2401_84166306

最新推荐文章于 2024-08-21 22:00:57 发布

阅读量728

点赞数 30

分类专栏： 2024年程序员学习文章标签： web安全面试安全

本文链接：https://blog.csdn.net/2401_84166306/article/details/137564422

版权

2024年程序员学习专栏收录该内容

87 篇文章 0 订阅

订阅专栏

信息收集

rustscan

┌──(root㉿ru)-[~/kali/hackthebox]
└─# rustscan -b 2250 10.10.11.239 --range=0-65535 --ulimit=4500 – -A -sC
.----. .-. .-. .----…—. .----. .—. .–. .-. .-.
| {} }| { } |{ {__ {_ }{ {_ / ___} / {} \ | | | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | -’ -'-----‘----' -’ ----' —’ -' -‘-' -’
Faster Nmap scanning with Rust.

: https://discord.gg/GFrQsGy :
: https://github.com/RustScan/RustScan :

😵 https://admin.tryhackme.com

[~] The config file is expected to be at “/root/.config/rustscan/config.toml”
[~] Automatically increasing ulimit value to 4500.
Open 10.10.11.239:22
Open 10.10.11.239:80
Open 10.10.11.239:3000
^[a[~] Starting Nmap
[>] The Nmap command to be run is nmap -A -sC -vvv -p 22,80,3000 10.10.11.239

Initiating Ping Scan at 08:53
Scanning 10.10.11.239 [4 ports]
Completed Ping Scan at 08:53, 0.33s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:53
Completed Parallel DNS resolution of 1 host. at 08:53, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 08:53
Scanning 10.10.11.239 [3 ports]
Discovered open port 22/tcp on 10.10.11.239
Discovered open port 80/tcp on 10.10.11.239
Discovered open port 3000/tcp on 10.10.11.239
Completed SYN Stealth Scan at 08:53, 0.31s elapsed (3 total ports)
Initiating Service scan at 08:53
Scanning 3 services on 10.10.11.239
Completed Service scan at 08:56, 167.36s elapsed (3 services on 1 host)
Initiating OS detection (try #1) against 10.10.11.239
Retrying OS detection (try #2) against 10.10.11.239
adjust_timeouts2: packet supposedly had rtt of -494427 microseconds. Ignoring time.
adjust_timeouts2: packet supposedly had rtt of -494427 microseconds. Ignoring time.
adjust_timeouts2: packet supposedly had rtt of -520036 microseconds. Ignoring time.
adjust_timeouts2: packet supposedly had rtt of -520036 microseconds. Ignoring time.
Initiating Traceroute at 08:56
Nmap scan report for 10.10.11.239
Host is up, received reset ttl 63 (0.19s latency).
Scanned at 2024-03-10 08:53:54 CST for 194s

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 96:07:1c:c6:77:3e:07:a0:cc:6f:24:19:74:4d:57:0b (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBN+/g3FqMmVlkT3XCSMH/JtvGJDW3+PBxqJ+pURQey6GMjs7abbrEOCcVugczanWj1WNU5jsaYzlkCEZHlsHLvk=
| 256 0b:a4:c0:cf:e2:3b:95:ae:f6:f5:df:7d:0c:88:d6:ce (ED25519)
|ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIm6HJTYy2teiiP6uZoSCHhsWHN+z3SVL/21fy6cZWZi
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.52
| http-methods:
| Supported Methods: GET HEAD POST OPTIONS
|_http-title: Did not follow redirect to http://codify.htb/
3000/tcp open ppp? syn-ack ttl 63
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 5.0 (96%), Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%)
No exact OS matches for host (test conditions non-ideal).
TCP/IP fingerprint:
SCAN(V=7.94SVN%E=4%D=3/10%OT=22%CT=%CU=35149%PV=Y%DS=2%DC=T%G=N%TM=65ED0564%P=x86_64-pc-linux-gnu)
SEQ(SP=102%GCD=1%ISR=108%TI=Z%CI=Z)
SEQ(SP=102%GCD=1%ISR=108%TI=Z%CI=Z%II=I%TS=A)
OPS(O1=M53CST11NW7%O2=M53CST11NW7%O3=M53CNNT11NW7%O4=M53CST11NW7%O5=M53CST11NW7%O6=M53CST11)
WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)
ECN(R=Y%DF=Y%T=40%W=FAF0%O=M53CNNSNW7%CC=Y%Q=)
T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)
IE(R=Y%DFI=N%T=40%CD=S)

Uptime guess: 0.000 days (since Sun Mar 10 08:56:45 2024)
Network Distance: 2 hops
TCP Sequence Prediction: Difficulty=258 (Good luck!)
IP ID Sequence Generation: All zeros
Service Info: Host: codify.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 443/tcp)
HOP RTT ADDRESS
1 291.10 ms 10.10.14.1
2 283.70 ms 10.10.11.239

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 08:57
Completed NSE at 08:57, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 08:57
Completed NSE at 08:57, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 08:57
Completed NSE at 08:57, 0.00s elapsed
Read data files from: /usr/bin/…/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 194.59 seconds
Raw packets sent: 112 (8.706KB) | Rcvd: 78 (6.546KB)

22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.52
|_http-title: Did not follow redirect to http://codify.htb/
3000/tcp open ppp? syn-ack ttl 63

把dns写入host文件内！这样我们就可以通过域名访问web主页了！

nmap

┌──(root㉿ru)-[~/kali/hackthebox]
└─# nmap -sCV -O -A -p 22,80,3000 10.10.11.239 --min-rate 10000
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-12 12:24 CST
Nmap scan report for http:*codify.htb (10.10.11.239)
Host is up (0.22s latency).

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 96:07:1c:c6:77:3e:07:a0:cc:6f:24:19:74:4d:57:0b (ECDSA)
|_ 256 0b:a4:c0:cf:e2:3b:95:ae:f6:f5:df:7d:0c:88:d6:ce (ED25519)
80/tcp open http Apache httpd 2.4.52
|_http-title: 400 Bad Request
|_http-server-header: Apache/2.4.52 (Ubuntu)
3000/tcp open http Node.js Express framework
|_http-title: Codify
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 5.0 (96%), Linux 4.15 - 5.8 (96%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (95%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: codify.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 268.82 ms 10.10.14.1
2 268.85 ms http:*codify.htb (10.10.11.239)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 75.56 seconds

dirsearch

┌──(root㉿ru)-[~/kali/hackthebox]
└─# dirsearch -u http://codify.htb/ -x 403
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict

|. _ _ _ _ _ | v0.4.3
(||| ) (/(|| (| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /root/kali/hackthebox/reports/http_codify.htb/__24-03-12_12-15-07.txt

Target: http://codify.htb/

[12:15:07] Starting:
[12:17:00] 200 - 1KB - /About
[12:17:00] 200 - 1KB - /about
[12:19:09] 200 - 1KB - /editor
[12:19:09] 200 - 1KB - /editor/

Task Completed