4

I am trying to find all web application running on web server. The only information I have is IP address of web server, for example 192.168.1.100.

My approach was to check the existence of web applications on non-standard ports using nmap.

Nmap identified Apache httpd server on ports 80/tcp, 81/tcp and 443/tcp.

But when I visit http://192.168.1.100:80 with browser it opens "Apache 2 Test Page", the same for others ports. Is there any way to find address of web applications other than by guessing? It is address in internal network, not accessible form Internet so I can't check the address using Google.

Improve this question

4 Answers 4

Reset to default
2

One approach to this problem which could work, depending on how they've configured SSL, would be to check the SSL certificate returned when you connect to port 443/TCP.

The certificate may contain hostnames which are valid for the server, allowing you to locate websites running on it. This can either be in the CN field, or in the SAN (Subject Alternative Name) field.

This may not work, if they're using a wildcard certificate or if they're just doing a self-signed certificate with the IP address, but worth checking anyway.

Improve this answer
1
  • Or it will not work if the server implements SNI for the multiple sites, as this would only return the default none SNI certificate
    – ISMSDEV
    Oct 20, 2017 at 15:52
1

I would try a reverse DNS lookup, to see if there are any PTR records pointing to your IP.

dig -x 192.168.1.100 +short
Improve this answer
0

You can try sniffing traffic to/from the server (e.g. tcpdump, wireshark) and look for URLs there. That probably won't help with the port 443 traffic (though the amount of traffic will tell you a little about how popular the server is and maybe even how it's used or what it does (streaming-shaped traffic, regular (automated) queries and in which direction, etc.), and may give you a list of people to target to find out more about the server), and will only work if you manage to get "between" the server and hosts communicating with it (e.g. if you have freedom to plug into different ethernet ports); it also requires someone else to be actively using the server.

Depending on what sort of network access you have, you can look for references to the web server in other communications (e.g. search users' emails for URLs at that server, or find references to it in online documentation or SharePoint/wikis/newsletters (every intranet that gets big enough re-invents its own internal version of Google, just so its authorized users can find what they need)).

If you can get access to the server itself you can look at the webroot (and other web directories like ~/public_html) to see what files are hosted there. If it uses an outdated OS or Apache version you may be able to exploit known bugs to gain access.

other than guessing: you can try to find a list of common URLs, which is a sort of targeted guessing. But a URL that no one accesses or talks about, and that you don't have access to on the server itself, will stay hidden.

Improve this answer
0

So you want to recon deployed web applications on a given server.

Nmap identified Apache httpd server on ports 80/tcp, 81/tcp and 443/tcp

Almost there, the nmap script http-enum lets you enumarate possible web applications running on the server :

nmap -Pn --script=http-enum -p80,81,443 192.168.1.100


Edit: The script scans popular web apps using their fingerprints.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .