===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://vuln-webapp.ctf.local:8080
[+] Method:                  GET
[+] Threads:                 50
[+] Wordlist:                /usr/share/wordlists/dirb/common.txt
[+] Negative Status codes:   404
[+] Extensions:              php,bak,txt,html,conf,sql,tar.gz,zip,old,log
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.git                 (Status: 301) [Size: 0] [--> /.git/]
/.git/HEAD            (Status: 200) [Size: 23]
/.git/config          (Status: 200) [Size: 198]
/.git/index           (Status: 200) [Size: 4096]
/.git/logs            (Status: 301) [Size: 0] [--> /.git/logs/]
/.env                 (Status: 200) [Size: 547]
/.htaccess            (Status: 403) [Size: 289]
/.htpasswd            (Status: 403) [Size: 289]
/admin                (Status: 301) [Size: 0] [--> /admin/]
/admin/login          (Status: 200) [Size: 3214]
/admin/dashboard      (Status: 200) [Size: 8472]
/admin/config         (Status: 200) [Size: 5918]
/admin/users          (Status: 200) [Size: 12304]
/admin/logs           (Status: 200) [Size: 24891]
/api                  (Status: 301) [Size: 0] [--> /api/]
/api/v1               (Status: 200) [Size: 1247]
/api/v1/users         (Status: 200) [Size: 8934]
/api/v1/invoices      (Status: 200) [Size: 6712]
/api/v1/products      (Status: 200) [Size: 15204]
/api/v1/docs          (Status: 200) [Size: 22841]
/api/v1/health        (Status: 200) [Size: 89]
/api/internal         (Status: 200) [Size: 4521]
/api/internal/debug   (Status: 200) [Size: 7832]
/api/internal/metrics (Status: 200) [Size: 3204]
/api/swagger.json     (Status: 200) [Size: 34201]
/backup               (Status: 301) [Size: 0] [--> /backup/]
/backup/database.sql.bak  (Status: 200) [Size: 2457832]
/backup/config.php.bak    (Status: 200) [Size: 1893]
/backup/site-backup-2026-03-15.tar.gz  (Status: 200) [Size: 48293104]
/cgi-bin              (Status: 301) [Size: 0] [--> /cgi-bin/]
/cgi-bin/test-cgi     (Status: 200) [Size: 412]
/console              (Status: 200) [Size: 5124]
/css                  (Status: 301) [Size: 0] [--> /css/]
/dashboard            (Status: 302) [Size: 0] [--> /login]
/debug                (Status: 301) [Size: 0] [--> /debug/]
/debug/vars           (Status: 200) [Size: 8721]
/debug/pprof          (Status: 200) [Size: 3412]
/debug/requests       (Status: 200) [Size: 12894]
/doc                  (Status: 301) [Size: 0] [--> /doc/]
/doc/README           (Status: 200) [Size: 4521]
/doc/CHANGELOG        (Status: 200) [Size: 18934]
/favicon.ico          (Status: 200) [Size: 1150]
/health               (Status: 200) [Size: 52]
/images               (Status: 301) [Size: 0] [--> /images/]
/index.html           (Status: 200) [Size: 7824]
/js                   (Status: 301) [Size: 0] [--> /js/]
/login                (Status: 200) [Size: 3412]
/login.php            (Status: 200) [Size: 3412]
/logout               (Status: 302) [Size: 0] [--> /login]
/logs                 (Status: 301) [Size: 0] [--> /logs/]
/logs/access.log      (Status: 200) [Size: 1482934]
/logs/error.log       (Status: 200) [Size: 294812]
/logs/app-debug.log   (Status: 200) [Size: 87234]
/phpmyadmin           (Status: 301) [Size: 0] [--> /phpmyadmin/]
/phpmyadmin/setup     (Status: 200) [Size: 8421]
/phpinfo.php          (Status: 200) [Size: 78234]
/profile              (Status: 302) [Size: 0] [--> /login]
/register             (Status: 200) [Size: 4102]
/robots.txt           (Status: 200) [Size: 312]
/search               (Status: 200) [Size: 2841]
/secret-admin         (Status: 301) [Size: 0] [--> /secret-admin/]
/secret-admin/login   (Status: 200) [Size: 2104]
/server-status        (Status: 200) [Size: 12482]
/server-info          (Status: 200) [Size: 45892]
/sitemap.xml          (Status: 200) [Size: 5891]
/staging              (Status: 301) [Size: 0] [--> /staging/]
/staging/index.html   (Status: 200) [Size: 9123]
/static               (Status: 301) [Size: 0] [--> /static/]
/test                 (Status: 301) [Size: 0] [--> /test/]
/test/info.php        (Status: 200) [Size: 78124]
/test/debug.php       (Status: 200) [Size: 4521]
/test/upload.php      (Status: 200) [Size: 1892]
/tmp                  (Status: 301) [Size: 0] [--> /tmp/]
/tmp/cache            (Status: 200) [Size: 0]
/uploads              (Status: 301) [Size: 0] [--> /uploads/]
/uploads/avatars      (Status: 301) [Size: 0] [--> /uploads/avatars/]
/wp-admin             (Status: 301) [Size: 0] [--> /wp-admin/]
/wp-admin/install.php (Status: 200) [Size: 12934]
/wp-config.php.bak    (Status: 200) [Size: 3204]
/wp-content           (Status: 301) [Size: 0] [--> /wp-content/]
/wp-includes          (Status: 301) [Size: 0] [--> /wp-includes/]
/wp-login.php         (Status: 200) [Size: 8924]
/xmlrpc.php           (Status: 200) [Size: 420]

===============================================================
Finished
===============================================================
2026/04/07 09:22:14 Finished scanning
Duration: 2m38s
Requests: 92,451
Errors: 12

===============================================================
SUMMARY OF NOTABLE FINDINGS
===============================================================

[CRITICAL] Source code exposure:
  /.git/HEAD            - Git repository metadata accessible
  /.git/config          - Git configuration (may contain remote URLs)
  /.env                 - Environment variables (likely contains secrets)

[CRITICAL] Database / backup exposure:
  /backup/database.sql.bak     - Database dump (2.3 MB)
  /backup/config.php.bak       - PHP config with DB credentials
  /wp-config.php.bak           - WordPress config with DB credentials
  /backup/site-backup-2026-03-15.tar.gz - Full site archive (46 MB)

[HIGH] Admin panels without authentication:
  /admin/dashboard       - Admin dashboard (no redirect to login)
  /admin/config          - Configuration panel
  /admin/users           - User management
  /secret-admin/login    - Hidden admin login (found via robots.txt)

[HIGH] Sensitive information disclosure:
  /phpinfo.php           - Full PHP configuration
  /server-status         - Apache status page (active connections)
  /server-info           - Apache server configuration
  /api/swagger.json      - Complete API specification
  /api/internal/debug    - Internal debugging endpoint
  /debug/vars            - Application debug variables
  /logs/access.log       - Web server access log
  /logs/error.log        - Web server error log
  /logs/app-debug.log    - Application debug log

[MEDIUM] Development/testing artifacts:
  /test/debug.php        - Debug script
  /test/upload.php       - Test upload handler
  /console               - Debug console (potential RCE)
  /staging/              - Staging environment
  /phpmyadmin/setup      - phpMyAdmin setup wizard

[LOW] Directory listings enabled:
  /backup/               - Backup directory
  /uploads/              - User uploads
  /logs/                 - Log files
  /css/                  - Stylesheets
  /js/                   - JavaScript files
  /images/               - Image assets
