So I am doing a pentesting/CTF exercise against a very closed system. Only ports 22 (ssh) and 80(unidentified web server) are open. System is Linux.
SSH at least reports an up to date version with no remote vulnerabilities. The web server gives no identifying information what so ever, has nothing enabled, and only returns a 404.
I have performed some vulnerability scans against the host, and not a single finding was found.
The goal of the CTF is to gain root, and gain access to 'Tony Starks' encrypted ironman suit plans, and reverse the encryption.
Along with that goal, a dictionary of top 1000 passwords was provided. I've taken that as a hint that there could be a user with a username somehow based on or related to Tony Stark, trying variations like tonystark, tstark, starkt etc and using hydra with such usernames and the provided dictionary.
So far I have had no luck. I am currently stumped by the complete lack of info and available 'surface area' to attack, and I'm not sure how to proceed further.
Would anyone have some suggestions for further things I could try, or avenues to look investigate?