Hack The Box: Dante Pro Lab - Web Enumeration

Overview

Continuing from the initial network enumeration, this writeup focuses on the web server at 10.10.110.100 and the WordPress installation discovered during reconnaissance.

Service Enumeration

Full Nmap Scan

nmap -A 10.10.110.100 -Pn

Results:

PORT      STATE SERVICE VERSION
21/tcp    open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4
65000/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
| http-robots.txt: 2 disallowed entries 
|_/wordpress DANTE{Y0u_Cant_G3t_at_m3_br0!}

Flag Found: DANTE{Y0u_Cant_G3t_at_m3_br0!} in robots.txt

WordPress Discovery

Accessing http://10.10.110.100:65000/wordpress/ revealed a WordPress installation.

Discovered Pages

1. /wordpress/index.php/about/
2. /wordpress/index.php/languages-and-framework/
3. /wordpress/index.php/meet-the-team/
4. /wordpress/wp-admin/

Team Members Identified

• Kevin
• Balthazar (Bally)
• AJ
• Nathan

Nikto Scan

nikto -host http://10.10.110.100:65000

Findings

• Server: Apache/2.4.41 (Ubuntu)
• Missing X-Frame-Options header (clickjacking risk)
• Missing X-XSS-Protection header
• Missing X-Content-Type-Options header
• WordPress redirect via x-redirect-by header
• robots.txt contains 2 entries
• Potential inode leak via ETags

WPScan Results

wpscan --url http://10.10.110.100:65000/wordpress/

Key Discoveries

Finding	URL	Risk
robots.txt	/wordpress/robots.txt	Information Disclosure
XML-RPC enabled	/wordpress/xmlrpc.php	Brute Force / DDoS
readme.html	/wordpress/readme.html	Version Disclosure
Debug Log	/wordpress/wp-content/debug.log	Critical
Directory Listing	/wordpress/wp-content/uploads/	Information Disclosure

XML-RPC Attack Vectors

The enabled XML-RPC endpoint allows:

• Brute force attacks via system.multicall
• Pingback DDoS amplification
• User enumeration

References:

• WordPress Ghost Scanner module
• WordPress XMLRPC DoS module
• WordPress Pingback Access module

Debug Log Exposure

Critical Finding: Debug log publicly accessible at:

http://10.10.110.100:65000/wordpress/wp-content/debug.log

This could expose:

• PHP errors and stack traces
• Database queries
• Plugin/theme vulnerabilities
• Internal paths and configurations

Directory Listing

Upload directory has listing enabled, potentially exposing:

• Uploaded files and media
• Plugin/theme assets
• Backup files

Next Steps

1. Enumerate WordPress users via XML-RPC or author archives
2. Check debug.log for sensitive information
3. Explore upload directory for interesting files
4. Test for LFI vulnerability mentioned in todo.txt
5. Attempt password attacks against discovered users

Security Recommendations

For defenders:

• Disable XML-RPC if not needed
• Remove debug.log or restrict access
• Disable directory listing
• Add security headers (X-Frame-Options, CSP, etc.)
• Keep WordPress and plugins updated

---

This writeup is for educational purposes. Always obtain proper authorization before testing systems.