- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          10.10.10.50
+ Target Hostname:    vuln-webapp.ctf.local
+ Target Port:        8080
+ Start Time:         2026-04-07 09:14:22 (GMT-4)
---------------------------------------------------------------------------
+ Server: Apache/2.4.49 (Ubuntu)
+ /: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+ /: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
+ /: The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-x-xss-protection-header/
+ /: The Content-Security-Policy header is not set. This allows the browser to load resources from any origin, enabling XSS and data injection attacks. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+ /: The Strict-Transport-Security header is not defined. HSTS tells the browser to only communicate over HTTPS. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+ /: The Permissions-Policy header is not set. This allows the browser to enable device features (camera, microphone, geolocation) without restriction. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
+ Apache/2.4.49 appears to be outdated (current is at least Apache/2.4.59). Apache 2.4.49 is vulnerable to CVE-2021-41773 (path traversal) and CVE-2021-42013 (RCE via path traversal). See: https://httpd.apache.org/security/vulnerabilities_24.html
+ /: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: http://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf
+ /: Server leaks inodes via ETags, header found with file /., inode: 1a4e2, size: 3b8f, mtime: 662ea1c0. See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1418
+ OPTIONS: Allowed HTTP Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, TRACE .
+ /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-telecom-icons/
+ /icons/README.html: Apache default file found.
+ /admin/: Admin login page/section found.
+ /admin/login: Admin login page found.
+ /admin/dashboard: Admin dashboard accessible without authentication.
+ /admin/config: Configuration panel found. May contain sensitive settings.
+ /admin/users: User management interface found.
+ /admin/logs: Application log viewer found. May contain sensitive information.
+ /phpmyadmin/: phpMyAdmin installation found. See: https://www.phpmyadmin.net/
+ /phpmyadmin/setup/: phpMyAdmin setup page found. This can allow remote attackers to configure phpMyAdmin.
+ /server-status: Apache mod_status enabled. Reveals active connections, request URLs, and client IPs. See: https://httpd.apache.org/docs/2.4/mod/mod_status.html
+ /server-info: Apache mod_info enabled. Reveals complete server configuration including loaded modules.
+ /phpinfo.php: Output of the phpinfo() function was found. This reveals PHP version, server paths, environment variables, and loaded extensions.
+ /test/: Test directory found. May contain development artifacts and debugging tools.
+ /test/info.php: Additional PHP info page found in test directory.
+ /test/debug.php: Debug script found. Outputs internal application state.
+ /backup/: Directory listing enabled on /backup/. Contains potentially sensitive backup files.
+ /backup/database.sql.bak: Database backup file found. May contain full database dump with credentials.
+ /backup/config.php.bak: PHP configuration backup found. Likely contains database credentials.
+ /backup/site-backup-2026-03-15.tar.gz: Full site backup archive found.
+ /backup/.htaccess.old: Old Apache configuration file found.
+ /uploads/: Directory listing enabled on /uploads/. User-uploaded files accessible without authentication.
+ /logs/: Directory listing enabled on /logs/. Application log files accessible.
+ /logs/access.log: Web server access log found. Contains request URLs and client IPs.
+ /logs/error.log: Web server error log found. May contain stack traces and internal paths.
+ /logs/app-debug.log: Application debug log found. May contain sensitive debugging output.
+ /.env: Environment configuration file found. Likely contains API keys, database credentials, and secrets.
+ /.git/HEAD: Git repository metadata found. Source code may be recoverable. See: https://github.com/internetwache/GitTools
+ /.git/config: Git configuration file accessible. May reveal remote repository URLs.
+ /wp-login.php: WordPress login page found. Indicates WordPress installation.
+ /wp-admin/: WordPress admin directory found.
+ /wp-config.php.bak: WordPress configuration backup found. Contains database credentials and authentication keys.
+ /xmlrpc.php: WordPress XML-RPC interface found. Can be used for brute-force attacks and DDoS amplification.
+ /readme.html: WordPress readme file found. Reveals WordPress version.
+ /license.txt: License file found. May reveal CMS version information.
+ /robots.txt: Contains 8 entries which should be manually viewed for interesting paths.
+ /robots.txt: Entry '/secret-admin/' found. Hidden admin panel.
+ /robots.txt: Entry '/api/internal/' found. Internal API endpoints.
+ /robots.txt: Entry '/staging/' found. Staging environment.
+ /sitemap.xml: Sitemap found. Reveals complete site structure including potentially hidden pages.
+ /crossdomain.xml: Adobe Flash cross-domain policy found. May be overly permissive.
+ /api/swagger.json: Swagger/OpenAPI specification found. Reveals complete API structure and endpoints.
+ /api/v1/docs: API documentation page found. Interactive API documentation accessible without authentication.
+ /cgi-bin/: CGI directory found. May contain vulnerable CGI scripts.
+ /cgi-bin/test-cgi: Test CGI script found. Reveals server environment variables.
+ /console: Application debug console found. May allow remote code execution.
+ /debug/vars: Application debug variables endpoint found. Reveals internal application state.
+ /actuator: Spring Boot Actuator endpoint found. May expose application health, environment, and configuration.
+ /actuator/env: Spring Boot environment endpoint. Reveals environment variables and system properties.
+ /login: Default login page uses HTTP (not HTTPS). Credentials transmitted in plaintext.
+ /login: No account lockout policy detected. Tested 50 invalid login attempts without lockout.
+ /register: User registration form does not implement CAPTCHA. Vulnerable to automated account creation.
+ OSVDB-3092: /doc/: Documentation directory found.
+ OSVDB-3233: /doc/README: Default documentation file.
+ OSVDB-3268: /css/: Directory listing enabled on CSS directory.
+ OSVDB-3268: /js/: Directory listing enabled on JavaScript directory.
+ OSVDB-3268: /images/: Directory listing enabled on images directory.
+ /server-status?auto: Apache mod_status auto output found. Machine-readable format.
+ 8142 requests: 0 error(s) and 68 item(s) reported on remote host
+ End Time:           2026-04-07 09:19:47 (GMT-4) (325 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
