nmap

  ___                        
 ( _ ) _ __ ___   __ _ _ __  
 / _ \| '_ ` _ \ / _` | '_ \ 
| (_) | | | | | | (_| | |_) |
 \___/|_| |_| |_|\__,_| .__/ 
                      |_|    
          adot8 <3

[+] Scanning 10.10.10.97 [65535 TCP ports]


[+] Enumerating 10.10.10.97 [80,445,8808]

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-06 11:07 CDT
Nmap scan report for secnotes (10.10.10.97)
Host is up (0.058s latency).

PORT     STATE SERVICE      VERSION
80/tcp   open  http         Microsoft IIS httpd 10.0
| http-title: Secure Notes - Login
|_Requested resource was login.php
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
445/tcp  open  microsoft-ds Windows 10 Enterprise 17134 microsoft-ds (workgroup: HTB)
8808/tcp open  http         Microsoft IIS httpd 10.0
|_http-title: IIS Windows
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: mean: 2h20m00s, deviation: 4h02m30s, median: 0s
| smb-os-discovery: 
|   OS: Windows 10 Enterprise 17134 (Windows 10 Enterprise 6.3)
|   OS CPE: cpe:/o:microsoft:windows_10::-
|   Computer name: SECNOTES
|   NetBIOS computer name: SECNOTES\x00
|   Workgroup: HTB\x00
|_  System time: 2024-06-06T09:08:08-07:00
| smb2-time: 
|   date: 2024-06-06T16:08:10
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 51.99 seconds

[+] Enumerating 10.10.10.97 for vulnerabilities [80,445,8808]

Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-06 11:08 CDT
Pre-scan script results:
| broadcast-avahi-dos: 
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Nmap scan report for secnotes (10.10.10.97)
Host is up (0.047s latency).

PORT     STATE SERVICE
80/tcp   open  http
|_http-dombased-xss: Couldn't find any DOM based XSS.
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=secnotes
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://secnotes:80/
|     Form id: 
|     Form action: /login.php
|     
|     Path: http://secnotes:80/register.php
|     Form id: 
|     Form action: /register.php
|     
|     Path: http://secnotes:80/login.php
|     Form id: 
|_    Form action: /login.php
| http-enum: 
|_  /login.php: Possible admin folder
445/tcp  open  microsoft-ds
8808/tcp open  ssports-bcast

Host script results:
|_samba-vuln-cve-2012-1182: NT_STATUS_ACCESS_DENIED
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: NT_STATUS_ACCESS_DENIED

Nmap done: 1 IP address (1 host up) scanned in 252.25 seconds

[+] Scanning 10.10.10.97 [1000 UDP ports]
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-06 11:12 CDT
Initiating Ping Scan at 11:12
Scanning 10.10.10.97 [4 ports]
Completed Ping Scan at 11:12, 0.10s elapsed (1 total hosts)
Initiating UDP Scan at 11:12
Scanning secnotes (10.10.10.97) [100 ports]
Completed UDP Scan at 11:13, 6.03s elapsed (100 total ports)
Nmap scan report for secnotes (10.10.10.97)
Host is up (0.049s latency).
All 100 scanned ports on secnotes (10.10.10.97) are in ignored states.
Not shown: 100 open|filtered udp ports (no-response)

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 6.31 seconds
           Raw packets sent: 260 (15.876KB) | Rcvd: 183 (30.513KB)

[+] Completed!