Øvelse 10 – Aktiv Rekognoscering
Forfatter: Mathias Greisen
Dato: 2026-09-11
Fag/modul: IT-Sikkerhed i Webapplikationer
Status: Færdig
1. Beskrivelse af øvelsen
I denne øvelse arbejdes der med aktiv rekognoscering af Crapi.
Følgende steps skal gennemføres:
-
Nmap til port- og service-scanning
-
Gobuster til path-enumeration via wordlists
-
OWASP ZAP(Ekstra opgave) til mere automatiseret API-analyse
Øvelserne fokuserer på at lære praktiske teknikker og værktøjsbrug – men også på at kunne analysere og dokumentere resultaterne.
Husk
Gem og genbrug de wordlister, du udarbejder til crAPI – de skal bruges i senere øvelser og som dokumentation.
2. Reproduktion trin for trin
Forudsætninger
Man skal have adgang til følgende værktøjer
- Crapi
- Nmap
- Gobuster
- OWASP ZAP
Trin
-
Installer seclists:
-
Brug Nmap til at udføre en fuld scanning og gem resultatet i en XML fil:
- -p- - Scan all ports - -oX [filename] - Output as xmlNmap all port scan resultat
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE nmaprun> <?xml-stylesheet href="file:///usr/share/nmap/nmap.xsl" type="text/xsl"?> <!-- Nmap 7.99 scan initiated Fri Sep 11 11:29:25 2026 as: /usr/lib/nmap/nmap --privileged -p- -oX allportscan.xml 127.0.0.1 --> <nmaprun scanner="nmap" args="/usr/lib/nmap/nmap --privileged -p- -oX allportscan.xml 127.0.0.1" start="1789118965" startstr="Fri Sep 11 11:29:25 2026" version="7.99" xmloutputversion="1.05"> <scaninfo type="syn" protocol="tcp" numservices="65535" services="1-65535"/> <verbose level="0"/> <debugging level="0"/> <host starttime="1789118965" endtime="1789118966"><status state="up" reason="localhost-response" reason_ttl="0"/> <address addr="127.0.0.1" addrtype="ipv4"/> <hostnames> <hostname name="localhost" type="PTR"/> </hostnames> <ports><extraports state="closed" count="65530"> <extrareasons reason="reset" count="65530" proto="tcp" ports="1-2999,3001-4279,4281-8024,8026-8442,8444-8887,8889-65535"/> </extraports> <port protocol="tcp" portid="3000"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="ppp" method="table" conf="3"/></port> <port protocol="tcp" portid="4280"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="vrml-multi-use" method="table" conf="3"/></port> <port protocol="tcp" portid="8025"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="ca-audit-da" method="table" conf="3"/></port> <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="https-alt" method="table" conf="3"/></port> <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="sun-answerbook" method="table" conf="3"/></port> </ports> <times srtt="1" rttvar="0" to="100000"/> </host> <runstats><finished time="1789118966" timestr="Fri Sep 11 11:29:26 2026" summary="Nmap done at Fri Sep 11 11:29:26 2026; 1 IP address (1 host up) scanned in 0.33 seconds" elapsed="0.33" exit="success"/><hosts up="1" down="0" total="1"/> </runstats> </nmaprun> -
Brug Nmap til at udføre default scripts og version detection, detection:
- -p 3000,4280,8025,8443,8888
- Scan ports 3000,4280,8025,8443,8888
- -sC
- equivalent to --script=default
- -sV
- Probe open ports to determine service/version info
- -oX [filename]
- Output as xml
Nmap all port scan resultat
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE nmaprun> <?xml-stylesheet href="file:///usr/share/nmap/nmap.xsl" type="text/xsl"?> <!-- Nmap 7.99 scan initiated Fri Sep 11 12:51:40 2026 as: /usr/lib/nmap/nmap --privileged -p 3000,4280,8025,8443,8888 -sC -sV -oX servicedetection1.xml 127.0.0.1 --> <nmaprun scanner="nmap" args="/usr/lib/nmap/nmap --privileged -p 3000,4280,8025,8443,8888 -sC -sV -oX servicedetection1.xml 127.0.0.1" start="1789123900" startstr="Fri Sep 11 12:51:40 2026" version="7.99" xmloutputversion="1.05"> <scaninfo type="syn" protocol="tcp" numservices="5" services="3000,4280,8025,8443,8888"/> <verbose level="0"/> <debugging level="0"/> <host starttime="1789123901" endtime="1789123914"><status state="up" reason="localhost-response" reason_ttl="0"/> <address addr="127.0.0.1" addrtype="ipv4"/> <hostnames> <hostname name="localhost" type="PTR"/> </hostnames> <ports><port protocol="tcp" portid="3000"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="ppp" servicefp="SF-Port3000-TCP:V=7.99%I=7%D=9/11%Time=6AA3DD48%P=x86_64-pc-linux-gnu%r(GetRequest,101B9,"HTTP/1\.1\x20200\x20OK\r\nAccess-Control-Allow-Origin:\x20\*\r\nX-Content-Type-Options:\x20nosniff\r\nX-Frame-Options:\x20SAMEORIGIN\r\nFeature-Policy:\x20payment\x20'self'\r\nX-Recruiting:\x20/#/jobs\r\nAccept-Ranges:\x20bytes\r\nCache-Control:\x20public,\x20max-age=0\r\nLast-Modified:\x20Fri,\x2011\x20Sep\x202026\x2009:24:23\x20GMT\r\nETag:\x20W/\"124fa-1a08fc84ca3\"\r\nContent-Type:\x20text/html;\x20charset=UTF-8\r\nContent-Length:\x2075002\r\nVary:\x20Accept-Encoding\r\nDate:\x20Fri,\x2011\x20Sep\x202026\x2010:51:52\x20GMT\r\nConnection:\x20close\r\n\r\n<!--\n\x20\x20~\x20Copyright\x20\(c\)\x202014-2025\x20Bjoern\x20Kimminich\x20&\x20the\x20OWASP\x20Juice\x20Shop\x20contributors\.\n\x20\x20~\x20SPDX-License-Identifier:\x20MIT\n\x20\x20-->\n\n<!doctype\x20html>\n<html\x20lang=\"en\"\x20data-beasties-container>\n<head>\n\x20\x20<meta\x20charset=\"utf-8\">\n\x20\x20<title>OWASP\x20Juice\x20Shop</title>\n\x20\x20<meta\x20name=\"description\"\x20content=\"Probably\x20the\x20most\x20modern\x20and\x20sophisticated\x20insecure\x20web\x20application\">\n\x20\x20<meta\x20name=\"viewport\"\x20content=\"width=device-width,\x20initial-scale=1\">\n\x20\x20<link\x20id=\"favicon\"\x20rel=\"icon\"\x20")%r(Help,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%r(NCP,2F,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nConnection:\x20close\r\n\r\n")%r(HTTPOptions,EA,"HTTP/1\.1\x20204\x20No\x20Content\r\nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow-Methods:\x20GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary:\x20Access-Control-Request-Headers\r\nContent-Length:\x200\r\nDate:\x20Fri,\x2011\x20Sep\x202026\x2010:51:52\x20GMT\r\nConnection:\x20close\r\n\r\n")%r(RTSPRequest,EA,"HTTP/1\.1\x20204\x20No\x20Content\r\nAccess-Control-Allow-Origin:\x20\*\r\nAccess-Control-Allow-Methods:\x20GET,HEAD,PUT,PATCH,POST,DELETE\r\nVary:\x20Access-Control-Request-Headers\r\nContent-Length:\x200\r\nDate:\x20Fri,\x2011\x20Sep\x202026\x2010:51:52\x20GMT\r\nConnection:\x20close\r\n\r\n");" method="table" conf="3"/><script id="fingerprint-strings" output="
 GetRequest: 
 HTTP/1.1 200 OK
 Access-Control-Allow-Origin: *
 X-Content-Type-Options: nosniff
 X-Frame-Options: SAMEORIGIN
 Feature-Policy: payment 'self'
 X-Recruiting: /#/jobs
 Accept-Ranges: bytes
 Cache-Control: public, max-age=0
 Last-Modified: Fri, 11 Sep 2026 09:24:23 GMT
 ETag: W/"124fa-1a08fc84ca3"
 Content-Type: text/html; charset=UTF-8
 Content-Length: 75002
 Vary: Accept-Encoding
 Date: Fri, 11 Sep 2026 10:51:52 GMT
 Connection: close
 <!--
 Copyright (c) 2014-2025 Bjoern Kimminich & the OWASP Juice Shop contributors.
 SPDX-License-Identifier: MIT
 <!doctype html>
 <html lang="en" data-beasties-container>
 <head>
 <meta charset="utf-8">
 <title>OWASP Juice Shop</title>
 <meta name="description" content="Probably the most modern and sophisticated insecure web application">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <link id="favicon" rel="icon"
 HTTPOptions, RTSPRequest: 
 HTTP/1.1 204 No Content
 Access-Control-Allow-Origin: *
 Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
 Vary: Access-Control-Request-Headers
 Content-Length: 0
 Date: Fri, 11 Sep 2026 10:51:52 GMT
 Connection: close
 Help, NCP: 
 HTTP/1.1 400 Bad Request
 Connection: close"><elem key="GetRequest">
 HTTP/1.1 200 OK
 Access-Control-Allow-Origin: *
 X-Content-Type-Options: nosniff
 X-Frame-Options: SAMEORIGIN
 Feature-Policy: payment 'self'
 X-Recruiting: /#/jobs
 Accept-Ranges: bytes
 Cache-Control: public, max-age=0
 Last-Modified: Fri, 11 Sep 2026 09:24:23 GMT
 ETag: W/"124fa-1a08fc84ca3"
 Content-Type: text/html; charset=UTF-8
 Content-Length: 75002
 Vary: Accept-Encoding
 Date: Fri, 11 Sep 2026 10:51:52 GMT
 Connection: close
 <!--
 Copyright (c) 2014-2025 Bjoern Kimminich & the OWASP Juice Shop contributors.
 SPDX-License-Identifier: MIT
 <!doctype html>
 <html lang="en" data-beasties-container>
 <head>
 <meta charset="utf-8">
 <title>OWASP Juice Shop</title>
 <meta name="description" content="Probably the most modern and sophisticated insecure web application">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <link id="favicon" rel="icon"</elem> <elem key="HTTPOptions, RTSPRequest">
 HTTP/1.1 204 No Content
 Access-Control-Allow-Origin: *
 Access-Control-Allow-Methods: GET,HEAD,PUT,PATCH,POST,DELETE
 Vary: Access-Control-Request-Headers
 Content-Length: 0
 Date: Fri, 11 Sep 2026 10:51:52 GMT
 Connection: close</elem> <elem key="Help, NCP">
 HTTP/1.1 400 Bad Request
 Connection: close</elem> </script></port> <port protocol="tcp" portid="4280"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="http" product="Apache httpd" version="2.4.62" extrainfo="(Debian)" method="probed" conf="10"><cpe>cpe:/a:apache:http_server:2.4.62</cpe></service><script id="http-title" output="Login :: Damn Vulnerable Web Application (DVWA)
Requested resource was login.php"><elem key="title">Login :: Damn Vulnerable Web Application (DVWA)</elem> <elem key="redirect_url">login.php</elem> </script><script id="http-robots.txt" output="1 disallowed entry 
/"/><script id="http-server-header" output="Apache/2.4.62 (Debian)"><elem>Apache/2.4.62 (Debian)</elem> </script></port> <port protocol="tcp" portid="8025"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="http" product="Golang net/http server" extrainfo="Go-IPFS json-rpc or InfluxDB API" method="probed" conf="10"><cpe>cpe:/a:protocol_labs:go-ipfs</cpe></service><script id="http-title" output="MailHog"><elem key="title">MailHog</elem> </script></port> <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="http" product="OpenResty web app server" version="1.25.3.1" tunnel="ssl" method="probed" conf="10"><cpe>cpe:/a:openresty:ngx_openresty:1.25.3.1</cpe></service><script id="http-server-header" output="openresty/1.25.3.1"><elem>openresty/1.25.3.1</elem> </script><script id="ssl-cert" output="Subject: commonName=localhost/organizationName=DEVELOPMENT COMPANY/stateOrProvinceName=DEVELOPMENT STATE/countryName=US
Not valid before: 2017-07-23T22:53:19
Not valid after: 2027-07-21T22:53:19"><table key="subject"> <elem key="commonName">localhost</elem> <elem key="countryName">US</elem> <elem key="emailAddress">development@example.com</elem> <elem key="localityName">DEVELOPMENT CITY</elem> <elem key="organizationName">DEVELOPMENT COMPANY</elem> <elem key="organizationalUnitName">DJANGO DEVELOPERS</elem> <elem key="stateOrProvinceName">DEVELOPMENT STATE</elem> </table> <table key="issuer"> <elem key="commonName">localhost</elem> <elem key="countryName">US</elem> <elem key="emailAddress">development@example.com</elem> <elem key="localityName">DEVELOPMENT CITY</elem> <elem key="organizationName">DEVELOPMENT COMPANY</elem> <elem key="organizationalUnitName">DJANGO DEVELOPERS</elem> <elem key="stateOrProvinceName">DEVELOPMENT STATE</elem> </table> <table key="pubkey"> <elem key="type">rsa</elem> <elem key="bits">4096</elem> <elem key="modulus">B8E0C7BE59BDF1F647D6F417C7A8DA437104B7B0466E6E88AB8256F3E9C2DE8F68086FACDACFDDCC1468F0E27CA9EA57E6FD1B2CE7A8027DC5709ABAF16458EA9CA2DB20CEDBD857ACDD578C14E1AD606152E17EB410FAB5D53E4C1B6557F004499C3457E2829668C6B0520DD4AE34CE59A768070769FA4DC458BC8E73D9A23073AB3E198A89A61C64974CEFC9E54CB1BB0EA312B65B55A439F822E256930D18F5061E440112B10F832E9FA3BC846FEC327B5233805DAD08A62272AF56C9EEA70205DEBF631CFC963FF6C90ACE4AF1C78CDEBD79807C81C65A5683FEF8DF2E63279ADB4E549B347F6F7294845208C145C92A15A7B1FD18BF86BFF5153CFD95713ECC3EE376EF9D6FD5BC531773BF919BC8091E0E6A217241FB60266CCD2483B0F082433A7FE0CB9FB9BF48866B824E8FBF666BBFE93A0243EE09C4C3F15639C9844075D259F5C58A23009853054EDF6F9428DF00E35C52841ED73F277D56DA4F32101942BC2FB962536E2598A10197CA4B4648AAF71867BA91E53C34DC56414E079F4FA785EFCB3B31D8C3BB12A138E005FBCFF01CBE7A2E338625947ADCA881DD7C9BD1751E790E2477579FCB9F172D246E5096BBCDE3206CC3C16F2E91ED8EB1D9B83798492F6423D005C639638DE0E33A25E2444EE5E3657B2A02A59566A33803B806A35DAB2117E0D9C67DB71DC984E86F48C581139300F71ED2193D9F01</elem> <elem key="exponent">65537</elem> </table> <table key="extensions"> <table> <elem key="name">X509v3 Subject Key Identifier</elem> <elem key="value">CA:31:F2:0C:6D:98:A2:CF:1D:C6:1A:22:51:3D:38:A1:54:7E:25:DC</elem> </table> <table> <elem key="name">X509v3 Authority Key Identifier</elem> <elem key="value">CA:31:F2:0C:6D:98:A2:CF:1D:C6:1A:22:51:3D:38:A1:54:7E:25:DC</elem> </table> <table> <elem key="name">X509v3 Basic Constraints</elem> <elem key="value">CA:TRUE</elem> </table> </table> <elem key="sig_algo">sha256WithRSAEncryption</elem> <table key="validity"> <elem key="notBefore">2017-07-23T22:53:19</elem> <elem key="notAfter">2027-07-21T22:53:19</elem> </table> <elem key="md5">0e58297e61b00b26c764862b1e3cdb7c</elem> <elem key="sha1">ab776a9a9401f7298a5cff832ce2829fb329db51</elem> <elem key="sha256">c26fa5b0b166d4b9c34096d7311270d86aa4d3f5bf3e6d762cbb67c0eeefb5c5</elem> <elem key="pem">-----BEGIN CERTIFICATE-----
MIIGSTCCBDGgAwIBAgIJAPc4JnQC+MORMA0GCSqGSIb3DQEBCwUAMIG6MQswCQYD
VQQGEwJVUzEaMBgGA1UECAwRREVWRUxPUE1FTlQgU1RBVEUxGTAXBgNVBAcMEERF
VkVMT1BNRU5UIENJVFkxHDAaBgNVBAoME0RFVkVMT1BNRU5UIENPTVBBTlkxGjAY
BgNVBAsMEURKQU5HTyBERVZFTE9QRVJTMRIwEAYDVQQDDAlsb2NhbGhvc3QxJjAk
BgkqhkiG9w0BCQEWF2RldmVsb3BtZW50QGV4YW1wbGUuY29tMB4XDTE3MDcyMzIy
NTMxOVoXDTI3MDcyMTIyNTMxOVowgboxCzAJBgNVBAYTAlVTMRowGAYDVQQIDBFE
RVZFTE9QTUVOVCBTVEFURTEZMBcGA1UEBwwQREVWRUxPUE1FTlQgQ0lUWTEcMBoG
A1UECgwTREVWRUxPUE1FTlQgQ09NUEFOWTEaMBgGA1UECwwRREpBTkdPIERFVkVM
T1BFUlMxEjAQBgNVBAMMCWxvY2FsaG9zdDEmMCQGCSqGSIb3DQEJARYXZGV2ZWxv
cG1lbnRAZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoIC
AQC44Me+Wb3x9kfW9BfHqNpDcQS3sEZuboirglbz6cLej2gIb6zaz93MFGjw4nyp
6lfm/Rss56gCfcVwmrrxZFjqnKLbIM7b2Fes3VeMFOGtYGFS4X60EPq11T5MG2VX
8ARJnDRX4oKWaMawUg3UrjTOWadoBwdp+k3EWLyOc9miMHOrPhmKiaYcZJdM78nl
TLG7DqMStltVpDn4IuJWkw0Y9QYeRAESsQ+DLp+jvIRv7DJ7UjOAXa0IpiJyr1bJ
7qcCBd6/Yxz8lj/2yQrOSvHHjN69eYB8gcZaVoP++N8uYyea205UmzR/b3KUhFII
wUXJKhWnsf0Yv4a/9RU8/ZVxPsw+43bvnW/VvFMXc7+Rm8gJHg5qIXJB+2AmbM0k
g7DwgkM6f+DLn7m/SIZrgk6Pv2Zrv+k6AkPuCcTD8VY5yYRAddJZ9cWKIwCYUwVO
32+UKN8A41xShB7XPyd9VtpPMhAZQrwvuWJTbiWYoQGXyktGSKr3GGe6keU8NNxW
QU4Hn0+nhe/LOzHYw7sSoTjgBfvP8By+ei4zhiWUetyogd18m9F1HnkOJHdXn8uf
Fy0kblCWu83jIGzDwW8uke2Osdm4N5hJL2Qj0AXGOWON4OM6JeJETuXjZXsqAqWV
ZqM4A7gGo12rIRfg2cZ9tx3JhOhvSMWBE5MA9x7SGT2fAQIDAQABo1AwTjAdBgNV
HQ4EFgQUyjHyDG2Yos8dxhoiUT04oVR+JdwwHwYDVR0jBBgwFoAUyjHyDG2Yos8d
xhoiUT04oVR+JdwwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEASpqo
aUHGEMGHpszdYowLRq9me8XqJkxFWuKPIZgZL/fb6nf5hjICtjpZGic79x13A2eV
paXPmQa7MK1JbGGnVEJN07W7CKnwB2lgV/WZuARDPzJ/9anLtRTs8OhuOIcDYIsg
f5pfTwWosNwZej1coosK04Dp8/8gt0qq6Ri1nH/HV5r7bzYmtMquv6N1sKtS4QGG
lPBnGptToj4zN9x0w57JvUzGnUAVwuaRJerizmxMggS1j2Q3iK70xG9860fMJvCC
pX2tsOjHsyxw/qRYZPeANGQlwVX+93cV4LV7XE4tK2QvyUOJMjwqB1EMmJEcSDXw
65zWZrCTpVsSkPmlQcL7gVYWPGyPpAWJICuvdvG4klbAcQS9EhK8w4rnrV2B3wzm
KNp1c48gmIOsxRYYOQYB9TKfqmv6icYUPZ7wUhahYyf5z5EMnvfXEyflmSAsHOy6
kkSLd8TfC8VQxAhL87DeCEkWkDl1xeEcPuRu3gOm90dxVZfphrqlBZ9hW9j7dysg
Xp2xSqDYOcyKAMR5mMajOogE8vDXgoSRkQK+/HYCNCtKthVIXT2x5h8VP8MGFWNH
YBQwmKnIT6PT2DV2TgpF3X9T9lLdPbg+TwnaoBuYxCIIEbTK+LNKnqaj2dLCxdOq
VjVM6fboLD/7AqtVyld7pX/5FbcD3PaZURQw3p0=
-----END CERTIFICATE-----
</elem> </script><script id="tls-alpn" output="
 http/1.1
 http/1.0
 http/0.9"><elem>http/1.1</elem> <elem>http/1.0</elem> <elem>http/0.9</elem> </script><script id="http-title" output="crAPI"><elem key="title">crAPI</elem> </script><script id="ssl-date" output="TLS randomness does not represent time"></script></port> <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="http" product="OpenResty web app server" version="1.25.3.1" method="probed" conf="10"><cpe>cpe:/a:openresty:ngx_openresty:1.25.3.1</cpe></service><script id="http-title" output="crAPI"><elem key="title">crAPI</elem> </script><script id="http-server-header" output="openresty/1.25.3.1"><elem>openresty/1.25.3.1</elem> </script></port> </ports> <times srtt="77" rttvar="1647" to="100000"/> </host> <runstats><finished time="1789123914" timestr="Fri Sep 11 12:51:54 2026" summary="Nmap done at Fri Sep 11 12:51:54 2026; 1 IP address (1 host up) scanned in 14.27 seconds" elapsed="14.27" exit="success"/><hosts up="1" down="0" total="1"/> </runstats> </nmaprun> - -p 3000,4280,8025,8443,8888
-
Enumerate Crapi with Gobuster and "common.txt" wordlist:
Find content lenght for sider som ikke findescurl -k -i https://127.0.0.1:8443/thispathshouldnotexistContent-Length: 2837
Go buster kommandogobuster dir -d "100ms" -k --xl "2837" -w "/usr/share/seclists/Discovery/Web-Content/common.txt" -u "https://127.0.0.1:8443" | tee -a crAPI_gobuster.txt- --url value, -u value
- The target URL
- --no-tls-validation, -k
- Skip TLS certificate verification
- --exclude-length, --xl
- exclude the following content lengths (completely ignores the status). You can separate multiple lengths by comma and it also supports ranges like 203-206
- --wordlist value, -w value
- Path to the wordlist. Set to - to use STDIN.
- --delay value, -d value
- Time each thread waits between requests (e.g. 1500ms) (default: 0s)
- --status-codes value, -s value
- Positive status codes (will be overwritten with status-codes-blacklist if set). Can also handle ranges like 200,300-400,404
- --status-codes-blacklist value, -b value
- Negative status codes (will override status-codes if set). Can also handle ranges like 200,300-400,404. (default: "404")
- --output value, -o value
- Output file to write results to (defaults to stdout)
- --username value, -U value
- Username for Basic Auth
- --password value, -P value
- Password for Basic Auth
- --cookies value, -c value
- Cookies to use for the requests
- --url value, -u value
-
Enumerate found directories of Crapi with Gobuster and "quickhits.txt" wordlist:
-
Enumerate with api specific wordlist
Endelige resultat
3. Problemer og løsninger
[Beskriv de udfordringer du stødte på undervejs, og hvordan du løste dem. Dette hjælper både dig selv og andre til at undgå samme faldgruber fremover.]
| Problem | Årsag | Løsning |
|---|---|---|
| Kunne ikke append output fra gobuster til samme fil | Go Buster overskriver automatisk filen | Gemte output i to filer, da brug af "| tee -a filnavn.txt" ikke gave det samme output fra gobuster |
4. Resultater og besvarelser
Besvarelse af reflektionsspørgsmål:
-
What types of services and ports did you discover?
- Ports: 3000,4280,8025,8443,8888
- Services: OWASP Juice Shop, Damn Vulnerable Web Application (DVWA), MailHog, crAPI (8443,8888)
-
Which tool gave you the most useful information about crAPI’s structure — and why?
- OWASP ZAP da man får et site tree samt informationer om potentielle sårbarheder kategoriseret efter niveau.
-
How could an attacker use the discovered endpoints to plan a more targeted attack?
- .env filen som blev fundet kan muligvis bruges til at angibe database servere.
- admin og api endpoint kan bruges til at teste for sårbarheder og muligvis få adgang til siden.
-
If an endpoint always returns 200 OK, how can that mislead automation tools like Gobuster?
- Værktøjerne tror at siden findes, men i virkeligheden er det blot en blank side med at den ikke findes.
-
How would you explain the purpose of active reconnaissance to a non-technical stakeholder?
-
Ved at udføre aktiv rekogniscering kan man kortlægge angrebsfladen for en virksomhed eller service. Man skal kende netop angrebsfladen for at vide hvilke potentielle sårbarheder der findes og hvad man evt skal beskytte.
-
Man skal vide hvor vinduer og døre er i et hus hvis man enten vil låse af eller bryde ind.
-
5. Anvendte ressourcer
6. Opsummering af erfaringer
Jeg har opbygget erfaringer med aktiv rekogniscering med brug af forskellige værktøjer: Nmap og Gobuster
Jeg har lært vigtigheden af at kende til angrebsfladen, uanset om man skal angribe eller beskytte noget.