=============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://vuln-webapp.ctf.local:8080 [+] Method: GET [+] Threads: 50 [+] Wordlist: /usr/share/wordlists/dirb/common.txt [+] Negative Status codes: 404 [+] Extensions: php,bak,txt,html,conf,sql,tar.gz,zip,old,log [+] User Agent: gobuster/3.6 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /.git (Status: 301) [Size: 0] [--> /.git/] /.git/HEAD (Status: 200) [Size: 23] /.git/config (Status: 200) [Size: 198] /.git/index (Status: 200) [Size: 4096] /.git/logs (Status: 301) [Size: 0] [--> /.git/logs/] /.env (Status: 200) [Size: 547] /.htaccess (Status: 403) [Size: 289] /.htpasswd (Status: 403) [Size: 289] /admin (Status: 301) [Size: 0] [--> /admin/] /admin/login (Status: 200) [Size: 3214] /admin/dashboard (Status: 200) [Size: 8472] /admin/config (Status: 200) [Size: 5918] /admin/users (Status: 200) [Size: 12304] /admin/logs (Status: 200) [Size: 24891] /api (Status: 301) [Size: 0] [--> /api/] /api/v1 (Status: 200) [Size: 1247] /api/v1/users (Status: 200) [Size: 8934] /api/v1/invoices (Status: 200) [Size: 6712] /api/v1/products (Status: 200) [Size: 15204] /api/v1/docs (Status: 200) [Size: 22841] /api/v1/health (Status: 200) [Size: 89] /api/internal (Status: 200) [Size: 4521] /api/internal/debug (Status: 200) [Size: 7832] /api/internal/metrics (Status: 200) [Size: 3204] /api/swagger.json (Status: 200) [Size: 34201] /backup (Status: 301) [Size: 0] [--> /backup/] /backup/database.sql.bak (Status: 200) [Size: 2457832] /backup/config.php.bak (Status: 200) [Size: 1893] /backup/site-backup-2026-03-15.tar.gz (Status: 200) [Size: 48293104] /cgi-bin (Status: 301) [Size: 0] [--> /cgi-bin/] /cgi-bin/test-cgi (Status: 200) [Size: 412] /console (Status: 200) [Size: 5124] /css (Status: 301) [Size: 0] [--> /css/] /dashboard (Status: 302) [Size: 0] [--> /login] /debug (Status: 301) [Size: 0] [--> /debug/] /debug/vars (Status: 200) [Size: 8721] /debug/pprof (Status: 200) [Size: 3412] /debug/requests (Status: 200) [Size: 12894] /doc (Status: 301) [Size: 0] [--> /doc/] /doc/README (Status: 200) [Size: 4521] /doc/CHANGELOG (Status: 200) [Size: 18934] /favicon.ico (Status: 200) [Size: 1150] /health (Status: 200) [Size: 52] /images (Status: 301) [Size: 0] [--> /images/] /index.html (Status: 200) [Size: 7824] /js (Status: 301) [Size: 0] [--> /js/] /login (Status: 200) [Size: 3412] /login.php (Status: 200) [Size: 3412] /logout (Status: 302) [Size: 0] [--> /login] /logs (Status: 301) [Size: 0] [--> /logs/] /logs/access.log (Status: 200) [Size: 1482934] /logs/error.log (Status: 200) [Size: 294812] /logs/app-debug.log (Status: 200) [Size: 87234] /phpmyadmin (Status: 301) [Size: 0] [--> /phpmyadmin/] /phpmyadmin/setup (Status: 200) [Size: 8421] /phpinfo.php (Status: 200) [Size: 78234] /profile (Status: 302) [Size: 0] [--> /login] /register (Status: 200) [Size: 4102] /robots.txt (Status: 200) [Size: 312] /search (Status: 200) [Size: 2841] /secret-admin (Status: 301) [Size: 0] [--> /secret-admin/] /secret-admin/login (Status: 200) [Size: 2104] /server-status (Status: 200) [Size: 12482] /server-info (Status: 200) [Size: 45892] /sitemap.xml (Status: 200) [Size: 5891] /staging (Status: 301) [Size: 0] [--> /staging/] /staging/index.html (Status: 200) [Size: 9123] /static (Status: 301) [Size: 0] [--> /static/] /test (Status: 301) [Size: 0] [--> /test/] /test/info.php (Status: 200) [Size: 78124] /test/debug.php (Status: 200) [Size: 4521] /test/upload.php (Status: 200) [Size: 1892] /tmp (Status: 301) [Size: 0] [--> /tmp/] /tmp/cache (Status: 200) [Size: 0] /uploads (Status: 301) [Size: 0] [--> /uploads/] /uploads/avatars (Status: 301) [Size: 0] [--> /uploads/avatars/] /wp-admin (Status: 301) [Size: 0] [--> /wp-admin/] /wp-admin/install.php (Status: 200) [Size: 12934] /wp-config.php.bak (Status: 200) [Size: 3204] /wp-content (Status: 301) [Size: 0] [--> /wp-content/] /wp-includes (Status: 301) [Size: 0] [--> /wp-includes/] /wp-login.php (Status: 200) [Size: 8924] /xmlrpc.php (Status: 200) [Size: 420] =============================================================== Finished =============================================================== 2026/04/07 09:22:14 Finished scanning Duration: 2m38s Requests: 92,451 Errors: 12 =============================================================== SUMMARY OF NOTABLE FINDINGS =============================================================== [CRITICAL] Source code exposure: /.git/HEAD - Git repository metadata accessible /.git/config - Git configuration (may contain remote URLs) /.env - Environment variables (likely contains secrets) [CRITICAL] Database / backup exposure: /backup/database.sql.bak - Database dump (2.3 MB) /backup/config.php.bak - PHP config with DB credentials /wp-config.php.bak - WordPress config with DB credentials /backup/site-backup-2026-03-15.tar.gz - Full site archive (46 MB) [HIGH] Admin panels without authentication: /admin/dashboard - Admin dashboard (no redirect to login) /admin/config - Configuration panel /admin/users - User management /secret-admin/login - Hidden admin login (found via robots.txt) [HIGH] Sensitive information disclosure: /phpinfo.php - Full PHP configuration /server-status - Apache status page (active connections) /server-info - Apache server configuration /api/swagger.json - Complete API specification /api/internal/debug - Internal debugging endpoint /debug/vars - Application debug variables /logs/access.log - Web server access log /logs/error.log - Web server error log /logs/app-debug.log - Application debug log [MEDIUM] Development/testing artifacts: /test/debug.php - Debug script /test/upload.php - Test upload handler /console - Debug console (potential RCE) /staging/ - Staging environment /phpmyadmin/setup - phpMyAdmin setup wizard [LOW] Directory listings enabled: /backup/ - Backup directory /uploads/ - User uploads /logs/ - Log files /css/ - Stylesheets /js/ - JavaScript files /images/ - Image assets