https://www.vulnhub.com/entry/double-1,632/Scan ports opened.Port 8080 need auth, we don't know yet. So we start from port 80.Check http://url/production. Try to send some cmd, like cmd="id", code="1", then we can see the comm
https://www.vulnhub.com/entry/alfa-1,655/Simple walkthroug:nmap -sV -sC -p- 192.168.56.72 -oN ports.logftp log in as anonymous, get a pic file.check robots.txt, find brain fuck strings, decode it, and get a new url.enum4linux, get username.ente
Machine is here.Nmap scan ports.Port 80 only has one file.Get domain name from index.html.Add it to /etc/hosts, then brute force vhost.gobuster vhost -u http://bassam.ctf -w /usr/share/seclists/Discovery/DNS/subdomains-
Machine can be download here.Nmap scan ports, 80,139 and 445 are open.Port 80 is a static index.html, with nothing interesting. Gobuster scan port 80, we get robots.txt and note.txt, but nothing useful too.Move to smb. Smbclient with no usernam
Machine can be download here.Nmap scan ports. 21,22,80 three ports open.Ftp login as anonymous, find a mkv file with no use.Scan port 80, find index.html and stream.php.Open index.html, looks like a youtube downloader.Check source code of index.html,
A not so easy machine made by tasiyanci, can be download here.Thanks tasiyanci for the hints.Nmap scan ports, 22 and 80.Open port 80, it's a wordpress site.Wpscan the site, found some usernames, but no vulnerable plugins.wpscan --url ht