> For the complete documentation index, see [llms.txt](https://n4shx.gitbook.io/wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://n4shx.gitbook.io/wiki/schule/mspl-2/scans.md).

# Scans

## NMAP

### -sV -p-

```bash
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-23 08:18 -0400
Nmap scan report for 192.168.56.101
Host is up (0.00078s latency).
Not shown: 65505 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp open telnet Linux telnetd
25/tcp open smtp Postfix smtpd
53/tcp open domain ISC BIND 9.4.2
80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2)
111/tcp open rpcbind 2 (RPC #100000)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
512/tcp open exec netkit-rsh rexecd
513/tcp open login OpenBSD or Solaris rlogind
514/tcp open shell Netkit rshd
1099/tcp open java-rmi GNU Classpath grmiregistry
1524/tcp open bindshell Metasploitable root shell
2049/tcp open nfs 2-4 (RPC #100003)
2121/tcp open ftp ProFTPD 1.3.1
3306/tcp open mysql MySQL 5.0.51a-3ubuntu5
3632/tcp open distccd distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
5432/tcp open postgresql PostgreSQL DB 8.3.0 - 8.3.7
5900/tcp open vnc VNC (protocol 3.3)
6000/tcp open X11 (access denied)
6667/tcp open irc UnrealIRCd
6697/tcp open irc UnrealIRCd
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
8180/tcp open http Apache Tomcat/Coyote JSP engine 1.1
8787/tcp open drb Ruby DRb RMI (Ruby 1.8; path /usr/lib/ruby/1.8/drb)
39279/tcp open java-rmi GNU Classpath grmiregistry
45546/tcp open status 1 (RPC #100024)
53663/tcp open nlockmgr 1-4 (RPC #100021)
56597/tcp open mountd 1-3 (RPC #100005)

MAC Address: 08:00:27:B2:41:CC (Oracle VirtualBox virtual NIC)

Service Info: Hosts: metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 152.24 seconds
```

### -p- -A --script=vuln

```bash
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-23 08:19 -0400
Nmap scan report for 192.168.56.101
Host is up (0.0015s latency).
Not shown: 65505 closed tcp ports (reset)
PORT      STATE SERVICE     VERSION
21/tcp    open  ftp         vsftpd 2.3.4
22/tcp    open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
23/tcp    open  telnet      Linux telnetd
25/tcp    open  smtp        Postfix smtpd
| ssl-poodle: 
|   VULNERABLE:
|   SSL POODLE information leak
|     State: VULNERABLE
|     IDs:  CVE:CVE-2014-3566  BID:70574
|           The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
|           products, uses nondeterministic CBC padding, which makes it easier
|           for man-in-the-middle attackers to obtain cleartext data via a
|           padding-oracle attack, aka the "POODLE" issue.
|     Disclosure date: 2014-10-14
|     Check results:
|       TLS_RSA_WITH_AES_128_CBC_SHA
|     References:
|       https://www.imperialviolet.org/2014/10/14/poodle.html
|       https://www.securityfocus.com/bid/70574
|       https://www.openssl.org/~bodo/ssl-poodle.pdf
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
|_sslv2-drown: ERROR: Script execution failed (use -d to debug)
| ssl-dh-params: 
|   VULNERABLE:
|   Anonymous Diffie-Hellman Key Exchange MitM Vulnerability
|     State: VULNERABLE
|       Transport Layer Security (TLS) services that use anonymous
|       Diffie-Hellman key exchange only provide protection against passive
|       eavesdropping, and are vulnerable to active man-in-the-middle attacks
|       which could completely compromise the confidentiality and integrity
|       of any data exchanged over the resulting session.
|     Check results:
|       ANONYMOUS DH GROUP 1
|             Cipher Suite: TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA
|             Modulus Type: Safe prime
|             Modulus Source: Unknown/Custom-generated
|             Modulus Length: 512
|             Generator Length: 8
|             Public Key Length: 512
|     References:
|       https://www.ietf.org/rfc/rfc2246.txt
|   
|   Transport Layer Security (TLS) Protocol DHE_EXPORT Ciphers Downgrade MitM (Logjam)
|     State: VULNERABLE
|     IDs:  CVE:CVE-2015-4000  BID:74733
|       The Transport Layer Security (TLS) protocol contains a flaw that is
|       triggered when handling Diffie-Hellman key exchanges defined with
|       the DHE_EXPORT cipher. This may allow a man-in-the-middle attacker
|       to downgrade the security of a TLS session to 512-bit export-grade
|       cryptography, which is significantly weaker, allowing the attacker
|       to more easily break the encryption and monitor or tamper with
|       the encrypted stream.
|     Disclosure date: 2015-5-19
|     Check results:
|       EXPORT-GRADE DH GROUP 1
|             Cipher Suite: TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
|             Modulus Type: Safe prime
|             Modulus Source: Unknown/Custom-generated
|             Modulus Length: 512
|             Generator Length: 8
|             Public Key Length: 512
|     References:
|       https://weakdh.org
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000
|       https://www.securityfocus.com/bid/74733
|   
|   Diffie-Hellman Key Exchange Insufficient Group Strength
|     State: VULNERABLE
|       Transport Layer Security (TLS) services that use Diffie-Hellman groups
|       of insufficient strength, especially those using one of a few commonly
|       shared groups, may be susceptible to passive eavesdropping attacks.
|     Check results:
|       WEAK DH GROUP 1
|             Cipher Suite: TLS_DHE_RSA_WITH_DES_CBC_SHA
|             Modulus Type: Safe prime
|             Modulus Source: postfix builtin
|             Modulus Length: 1024
|             Generator Length: 8
|             Public Key Length: 1024
|     References:
|_      https://weakdh.org
| smtp-vuln-cve2010-4344: 
|_  The SMTP server is not Exim: NOT VULNERABLE
53/tcp    open  domain      ISC BIND 9.4.2
80/tcp    open  http        Apache httpd 2.2.8 ((Ubuntu) DAV/2)
|_http-stored-xss: Couldnt find any stored XSS vulnerabilities.
|_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
|_http-server-header: Apache/2.2.8 (Ubuntu) DAV/2
|_http-trace: TRACE is enabled
| http-enum: 
|   /tikiwiki/: Tikiwiki
|   /test/: Test page
|   /phpinfo.php: Possible information file
|   /phpMyAdmin/: phpMyAdmin
|   /doc/: Potentially interesting directory w/ listing on 'apache/2.2.8 (ubuntu) dav/2'
|   /icons/: Potentially interesting folder w/ directory listing
|_  /index/: Potentially interesting folder
| http-sql-injection: 
|   Possible sqli for queries:
|     http://192.168.56.101:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?do=toggle-hints%27%20OR%20sqlspider&page=home.php
|     http://192.168.56.101:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?do=toggle-security%27%20OR%20sqlspider&page=home.php
|     http://192.168.56.101:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=notes.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=usage-instructions.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=php-errors.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=password-generator.php%27%20OR%20sqlspider&username=anonymous
|     http://192.168.56.101:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/dav/?C=D%3BO%3DA%27%20OR%20sqlspider
|     http://192.168.56.101:80/dav/?C=M%3BO%3DA%27%20OR%20sqlspider
|     http://192.168.56.101:80/dav/?C=S%3BO%3DA%27%20OR%20sqlspider
|     http://192.168.56.101:80/dav/?C=N%3BO%3DD%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=password-generator.php%27%20OR%20sqlspider&username=anonymous
|     http://192.168.56.101:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?do=toggle-hints%27%20OR%20sqlspider&page=home.php
|     http://192.168.56.101:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?do=toggle-security%27%20OR%20sqlspider&page=home.php
|     http://192.168.56.101:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=notes.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=usage-instructions.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=php-errors.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=password-generator.php%27%20OR%20sqlspider&username=anonymous
|     http://192.168.56.101:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=password-generator.php%27%20OR%20sqlspider&username=anonymous
|     http://192.168.56.101:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=password-generator.php%27%20OR%20sqlspider&username=anonymous
|     http://192.168.56.101:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=password-generator.php%27%20OR%20sqlspider&username=anonymous
|     http://192.168.56.101:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=password-generator.php%27%20OR%20sqlspider&username=anonymous
|     http://192.168.56.101:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?do=toggle-security%27%20OR%20sqlspider&page=capture-data.php
|     http://192.168.56.101:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=password-generator.php%27%20OR%20sqlspider&username=anonymous
|     http://192.168.56.101:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?do=toggle-hints%27%20OR%20sqlspider&page=capture-data.php
|     http://192.168.56.101:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=secret-administrative-pages.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=home.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=register.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=capture-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?do=toggle-hints%27%20OR%20sqlspider&page=home.php
|     http://192.168.56.101:80/mutillidae/index.php?page=html5-storage.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=text-file-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=framing.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?do=toggle-security%27%20OR%20sqlspider&page=home.php
|     http://192.168.56.101:80/mutillidae/index.php?page=captured-data.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=notes.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=browser-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fvulnerabilities.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=usage-instructions.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=documentation%2Fhow-to-access-Mutillidae-over-Virtual-Box-network.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=php-errors.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=installation.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=change-log.htm%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=dns-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=show-log.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=set-background-color.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=password-generator.php%27%20OR%20sqlspider&username=anonymous
|     http://192.168.56.101:80/mutillidae/?page=login.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=arbitrary-file-inclusion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=pen-test-tool-lookup.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=add-to-your-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=source-viewer.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=user-poll.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=credits.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/?page=user-info.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=site-footer-xss-discussion.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=view-someones-blog.php%27%20OR%20sqlspider
|     http://192.168.56.101:80/mutillidae/index.php?page=text-file-viewer.php%27%20OR%20sqlspider
|_    http://192.168.56.101:80/mutillidae/?page=view-someones-blog.php%27%20OR%20sqlspider
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.56.101
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://192.168.56.101:80/dvwa/
|     Form id: 
|     Form action: login.php
|     
|     Path: http://192.168.56.101:80/mutillidae/index.php?page=register.php
|     Form id: id-bad-cred-tr
|     Form action: index.php?page=register.php
|     
|     Path: http://192.168.56.101:80/mutillidae/index.php?page=login.php
|     Form id: idloginform
|_    Form action: index.php?page=login.php
|_http-dombased-xss: Couldn't find any DOM based XSS.
111/tcp   open  rpcbind     2 (RPC #100000)
| rpcinfo: 
|   program version    port/proto  service
|   100000  2            111/tcp   rpcbind
|   100000  2            111/udp   rpcbind
|   100003  2,3,4       2049/tcp   nfs
|   100003  2,3,4       2049/udp   nfs
|   100005  1,2,3      56597/tcp   mountd
|   100005  1,2,3      58257/udp   mountd
|   100021  1,3,4      53663/tcp   nlockmgr
|   100021  1,3,4      54575/udp   nlockmgr
|   100024  1          45546/tcp   status
|_  100024  1          55031/udp   status
139/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp   open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
512/tcp   open  exec        netkit-rsh rexecd
513/tcp   open  login
514/tcp   open  shell       Netkit rshd
1099/tcp  open  java-rmi    GNU Classpath grmiregistry
| rmi-vuln-classloader: 
|   VULNERABLE:
|   RMI registry default configuration remote code execution vulnerability
|     State: VULNERABLE
|       Default configuration of RMI registry allows loading classes from remote URLs which can lead to remote code execution.
|       
|     References:
|_      https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/java_rmi_server.rb
1524/tcp  open  bindshell   Metasploitable root shell
2049/tcp  open  nfs         2-4 (RPC #100003)
2121/tcp  open  ftp         ProFTPD 1.3.1
3306/tcp  open  mysql       MySQL 5.0.51a-3ubuntu5
|_ssl-ccs-injection: No reply from server (TIMEOUT)
3632/tcp  open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
| distcc-cve2004-2687: 
|   VULNERABLE:
|   distcc Daemon Command Execution
|     State: VULNERABLE (Exploitable)
|     IDs:  CVE:CVE-2004-2687
|     Risk factor: High  CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)
|       Allows executing of arbitrary commands on systems running distccd 3.1 and
|       earlier. The vulnerability is the consequence of weak service configuration.
|       
|     Disclosure date: 2002-02-01
|     Extra information:
|       
|     uid=1(daemon) gid=1(daemon) groups=1(daemon)
|   
|     References:
|       https://distcc.github.io/security.html
|       https://nvd.nist.gov/vuln/detail/CVE-2004-2687
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2687
5432/tcp  open  postgresql  PostgreSQL DB 8.3.0 - 8.3.7
| ssl-poodle: 
|   VULNERABLE:
|   SSL POODLE information leak
|     State: VULNERABLE
|     IDs:  CVE:CVE-2014-3566  BID:70574
|           The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other
|           products, uses nondeterministic CBC padding, which makes it easier
|           for man-in-the-middle attackers to obtain cleartext data via a
|           padding-oracle attack, aka the "POODLE" issue.
|     Disclosure date: 2014-10-14
|     Check results:
|       TLS_RSA_WITH_AES_128_CBC_SHA
|     References:
|       https://www.imperialviolet.org/2014/10/14/poodle.html
|       https://www.securityfocus.com/bid/70574
|       https://www.openssl.org/~bodo/ssl-poodle.pdf
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566
| ssl-dh-params: 
|   VULNERABLE:
|   Diffie-Hellman Key Exchange Insufficient Group Strength
|     State: VULNERABLE
|       Transport Layer Security (TLS) services that use Diffie-Hellman groups
|       of insufficient strength, especially those using one of a few commonly
|       shared groups, may be susceptible to passive eavesdropping attacks.
|     Check results:
|       WEAK DH GROUP 1
|             Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|             Modulus Type: Safe prime
|             Modulus Source: Unknown/Custom-generated
|             Modulus Length: 1024
|             Generator Length: 8
|             Public Key Length: 1024
|     References:
|_      https://weakdh.org
| ssl-ccs-injection: 
|   VULNERABLE:
|   SSL/TLS MITM vulnerability (CCS Injection)
|     State: VULNERABLE
|     Risk factor: High
|       OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h
|       does not properly restrict processing of ChangeCipherSpec messages,
|       which allows man-in-the-middle attackers to trigger use of a zero
|       length master key in certain OpenSSL-to-OpenSSL communications, and
|       consequently hijack sessions or obtain sensitive information, via
|       a crafted TLS handshake, aka the "CCS Injection" vulnerability.
|           
|     References:
|       http://www.openssl.org/news/secadv_20140605.txt
|       http://www.cvedetails.com/cve/2014-0224
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224
5900/tcp  open  vnc         VNC (protocol 3.3)
6000/tcp  open  X11         (access denied)
6667/tcp  open  irc         UnrealIRCd
|_irc-unrealircd-backdoor: Looks like trojaned version of unrealircd. See http://seclists.org/fulldisclosure/2010/Jun/277
6697/tcp  open  irc         UnrealIRCd
|_ssl-ccs-injection: No reply from server (TIMEOUT)
| irc-botnet-channels: 
|_  ERROR: Closing Link: [192.168.56.102] (Too many unknown connections from your IP)
8009/tcp  open  ajp13       Apache Jserv (Protocol v1.3)
8180/tcp  open  http        Apache Tomcat/Coyote JSP engine 1.1
|_http-stored-xss: Couldnt find any stored XSS vulnerabilities.
| http-csrf: 
| Spidering limited to: maxdepth=3; maxpagecount=20; withinhost=192.168.56.101
|   Found the following possible CSRF vulnerabilities: 
|     
|     Path: http://192.168.56.101:8180/admin/
|     Form id: username
|     Form action: j_security_check;jsessionid=B05508C19AC6A40076A9BDFDBA6D7854
|     
|     Path: http://192.168.56.101:8180/servlets-examples/servlet/CookieExample
|     Form id: 
|     Form action: CookieExample
|     
|     Path: http://192.168.56.101:8180/servlets-examples/servlet/RequestParamExample
|     Form id: 
|     Form action: RequestParamExample
|     
|     Path: http://192.168.56.101:8180/servlets-examples/servlet/SessionExample
|     Form id: 
|     Form action: SessionExample;jsessionid=734EFE03196713C0B13B70C90DD1041B
|     
|     Path: http://192.168.56.101:8180/servlets-examples/servlet/SessionExample
|     Form id: 
|_    Form action: SessionExample;jsessionid=734EFE03196713C0B13B70C90DD1041B
|_http-server-header: Apache-Coyote/1.1
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http servers resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_      http://ha.ckers.org/slowloris/
|_http-dombased-xss: Couldnt find any DOM based XSS.
8787/tcp  open  drb         Ruby DRb RMI (Ruby 1.8; path /usr/lib/ruby/1.8/drb)
39279/tcp open  java-rmi    GNU Classpath grmiregistry
| rmi-vuln-classloader: 
|   VULNERABLE:
|   RMI registry default configuration remote code execution vulnerability
|     State: VULNERABLE
|       Default configuration of RMI registry allows loading classes from remote URLs which can lead to remote code execution.
|       
|     References:
|_      https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/java_rmi_server.rb
45546/tcp open  status      1 (RPC #100024)
53663/tcp open  nlockmgr    1-4 (RPC #100021)
56597/tcp open  mountd      1-3 (RPC #100005)
MAC Address: 08:00:27:B2:41:CC (Oracle VirtualBox virtual NIC)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.33
Network Distance: 1 hop
Service Info: Hosts:  metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: false
|_smb-vuln-regsvc-dos: ERROR: Script execution failed (use -d to debug)

TRACEROUTE
HOP RTT     ADDRESS
1   1.54 ms 192.168.56.101

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 490.12 seconds

Host script results: 
|_smb-vuln-ms10-054: false 
|_smb-vuln-ms10-061: false 
|_smb-vuln-regsvc-dos: ERROR: Script execution failed (use -d to debug)

TRACEROUTE HOP RTT ADDRESS 1 1.54 ms 192.168.56.101

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 490.12 seconds
```

### -p 21,2121 -sV --script=ftp-anon

```bash
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-23 08:21 -0400
Nmap scan report for 192.168.56.101
Host is up (0.00099s latency).
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
2121/tcp open ftp ProFTPD 1.3.1
MAC Address: 08:00:27:B2:41:CC (Oracle VirtualBox virtual NIC)
Service Info: OS: Unix
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.26 seconds
```

### -p 21,2121 -sV --script=ftp\*

```bash
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-23 08:21 -0400
NSE: [ftp-bounce] Couldnt resolve scanme.nmap.org, scanning 10.0.0.1 instead.
NSE: [ftp-bounce] PORT response: 500 Illegal PORT command.
Stats: 0:00:56 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 91.36% done; ETC: 08:22 (0:00:05 remaining)
Stats: 0:02:09 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 94.96% done; ETC: 08:23 (0:00:07 remaining)
NSE: [ftp-brute] usernames: Time limit 10m00s exceeded.
NSE: [ftp-brute] usernames: Time limit 10m00s exceeded.
NSE: [ftp-brute] passwords: Time limit 10m00s exceeded.
NSE: [ftp-brute] usernames: Time limit 10m00s exceeded.
NSE: [ftp-brute] usernames: Time limit 10m00s exceeded.
NSE: [ftp-brute] passwords: Time limit 10m00s exceeded.
Nmap scan report for 192.168.56.101
Host is up (0.00076s latency).

PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 2.3.4
| ftp-brute: 
|   Accounts: 
|     user:user - Valid credentials
|_  Statistics: Performed 2403 guesses in 602 seconds, average tps: 3.8
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 192.168.56.102
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
| ftp-vsftpd-backdoor: 
|   VULNERABLE:
|   vsFTPd version 2.3.4 backdoor
|     State: VULNERABLE (Exploitable)
|     IDs:  CVE:CVE-2011-2523  BID:48539
|       vsFTPd version 2.3.4 backdoor, this was reported on 2011-07-04.
|     Disclosure date: 2011-07-03
|     Exploit results:
|       Shell command: id
|       Results: uid=0(root) gid=0(root)
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2523
|       http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html
|       https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/ftp/vsftpd_234_backdoor.rb
|_      https://www.securityfocus.com/bid/48539
2121/tcp open  ftp     ProFTPD 1.3.1
| ftp-brute: 
|   Accounts: 
|     user:user - Valid credentials
|_  Statistics: Performed 11037 guesses in 600 seconds, average tps: 18.7
MAC Address: 08:00:27:B2:41:CC (Oracle VirtualBox virtual NIC)
Service Info: OS: Unix

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 602.28 seconds
```

-sU (UDP)

```bash
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-22 15:37 EDT 

Nmap scan report for 10.0.2.5 
Host is up (0.0015s latency). 
Not shown: 992 closed udp ports (port-unreach) 

PORT     STATE         SERVICE 
53/udp   open          domain 
68/udp   open|filtered dhcpc 
69/udp   open|filtered tftp 
111/udp  open          rpcbind 
137/udp  open          netbios-ns 
138/udp  open|filtered netbios-dgm 
999/udp  open|filtered applix 
2049/udp open          nfs 

MAC Address: 08:00:27:F3:7E:AE (PCS Systemtechnik/Oracle VirtualBox virtual NIC) 
Nmap done: 1 IP address (1 host up) scanned in 1094.08 seconds 
```

***

## SMB 139/445

```bash
enum4linux -a 10.0.2.4
enum4linux -U 10.0.2.4   # Users
enum4linux -S 10.0.2.4   # Shares
enum4linux -G 10.0.2.4   # Groups
```

👉 macht automatisch:

* User auflisten
* Shares finden
* Gruppen anzeigen
* Passwort-Policy

```bash
smbclient -L //10.0.2.4 -N
```

👉 zeigt Shares ohne Passwort

#### SMB verbinden

```bash
smbclient //10.0.2.4/share -N
```

Dann:

```bash
ls
get file.txt
```

***

## FTP Enumeration

```bash
ftp anonymous@10.0.2.4
ls
get file.txt
put shell.php
```

***

## Web enumeration

### gobuster (Directories finden)

```bash
gobuster dir -u http://10.0.2.4 -w /usr/share/wordlists/dirb/common.txt

===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.101
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
.htaccess            (Status: 403) [Size: 296]
.hta                 (Status: 403) [Size: 291]
.htpasswd            (Status: 403) [Size: 296]
cgi-bin/             (Status: 403) [Size: 295]
dav                  (Status: 301) [Size: 319] [--> http://192.168.56.101/dav/]
index                (Status: 200) [Size: 891]
index.php            (Status: 200) [Size: 891]
phpMyAdmin           (Status: 301) [Size: 326] [--> http://192.168.56.101/phpMyAdmin/]
phpinfo              (Status: 200) [Size: 48014]
phpinfo.php          (Status: 200) [Size: 48026]
server-status        (Status: 403) [Size: 300]
test                 (Status: 301) [Size: 320] [--> http://192.168.56.101/test/]
twiki                (Status: 301) [Size: 321] [--> http://192.168.56.101/twiki/]
Progress: 4613 / 4613 (100.00%)
===============================================================
Finished
===============================================================

```

### nikto (Web Vulnerabilities)

```bash
nikto -h http://10.0.2.4
```

***

## 🔌 Netcat (quick check)

```bash
nc -v 10.0.2.4 21
nc -v 10.0.2.4 80
```

👉 zeigt Banner / Infos

## Banner Grabbing

```bash
nc 10.0.2.4 21
```

Oder:

```bash
telnet 10.0.2.4 21
```

👉 oft bekommst du:

* Version
* Service Infos

***

## SNMP Enumeration

```bash
snmpwalk -c public -v1 10.0.2.4
```

👉 kann extrem viele Infos liefern

***

## 🧠 Quick Mapping (für Prüfung)

| Port    | Tool                  | Ziel            |
| ------- | --------------------- | --------------- |
| 21      | ftp                   | anonymous login |
| 22      | ssh                   | login testen    |
| 80      | gobuster, nikto       | web dirs/vulns  |
| 139/445 | enum4linux, smbclient | shares/users    |
| 161     | snmpwalk              | system infos    |