5000

adot@kali:~/htb/Machines/Headless$ searchsploit werkzeug   
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
 Exploit Title                                                                                                                                                                                              |  Path
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Pallets Werkzeug 0.15.4 - Path Traversal                                                                                                                                                                    | python/webapps/50101.py
Werkzeug - 'Debug Shell' Command Execution                                                                                                                                                                  | multiple/remote/43905.py
Werkzeug - Debug Shell Command Execution (Metasploit)                                                                                                                                                       | python/remote/37814.rb
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------------
Shellcodes: No Results
                                                                                                                                                                                                                                              
adot@kali:~/htb/Machines/Headless$ searchsploit -m 43905
  Exploit: Werkzeug - 'Debug Shell' Command Execution
      URL: https://www.exploit-db.com/exploits/43905
     Path: /usr/share/exploitdb/exploits/multiple/remote/43905.py
    Codes: N/A
 Verified: False
File Type: Python script, ASCII text executable
Copied to: /home/adot/htb/Machines/Headless/43905.py

  /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.11.8:5000/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

#                       [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 50ms]
# This work is licensed under the Creative Commons  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 56ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 59ms]
# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 62ms]
# Priority ordered case sensative list, where entries were found  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 66ms]
# Copyright 2007 James Fisher [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 67ms]
# directory-list-2.3-medium.txt [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 68ms]
#                       [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 70ms]
# or send a letter to Creative Commons, 171 Second Street,  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 70ms]
# Attribution-Share Alike 3.0 License. To view a copy of this  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 74ms]
                        [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 75ms]
# on atleast 2 different hosts [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 79ms]
#                       [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 85ms]
#                       [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 85ms]
support                 [Status: 200, Size: 2363, Words: 836, Lines: 93, Duration: 55ms]
dashboard               [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 57ms]
                        [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 46ms]
:: Progress: [220560/220560] :: Job [1/1] :: 418 req/sec :: Duration: [0:09:11] :: Errors: 0 ::

Exploiting XSS-stealing cookies, keylogger, csrfMedium