CTF VulnNet Internal

rustscan

rustscan -a 10.10.11.203

Output:

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack
80/tcp open  http    syn-ack

Subdomain

ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.agile.htb" -u http://agile.htb -fs 178

Web agile.htb

Wapalizer

Nginx 1.18.0

Debugger

(function() {
    if (window.scriptExecuted1681322012868) {
        return;
    }
    var script = document.createElement("script");
    script.setAttribute("type", "text/javascript");
    script.textContent = "\n\
            (function () {\n\
                try {\n\
                    \n\
                } catch (ex) {\n\
                    console.error(\'Error executing js: \' + ex);\n\
                }\n\
            })();\n\
            ";
    var FRAME_REQUESTS_LIMIT = 500;
    var frameRequests = 0;

    function waitParent() {
        frameRequests += 1;
        var parent = document.head || document.documentElement;
        if (parent) {
            try {
                parent.appendChild(script);
                parent.removeChild(script);
            } catch (e) {} finally {
                window.scriptExecuted1681322012868 = true;
                return true;
            }
        }
        if (frameRequests < FRAME_REQUESTS_LIMIT) {
            requestAnimationFrame(waitParent);
        }
    }
    waitParent();
})()

Gobuster

gobuster dir -u http://agile.htb/ -x html,php,js,txt -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt