Authorized Web Application Security Assessment Report
This report summarizes host discovery, service discovery, web application enumeration, and evidence-based testing for
SQL injection, CSRF, XSS, LFI, RFI, IDOR indicators, TLS weaknesses, command injection indicators, and related OWASP Top 10 issues.
1. Executive Summary
The assessment identified 4 live hosts in the authorized subnet 192.168.56.0/24. The most significant findings were on
192.168.56.106, which hosts multiple intentionally vulnerable web applications and legacy services.
- Confirmed: Local File Inclusion (LFI) on Mutillidae.
- Confirmed: SQL injection error-based indicator on Mutillidae user-info workflow.
- Confirmed: Reflected or unsafely returned XSS payload handling in Mutillidae registration workflow.
- Confirmed: Missing security headers, TRACE enabled, phpinfo exposure, directory indexing, and exposed admin interfaces.
- Potential: CSRF weaknesses in Mutillidae due to predictable/disabled anti-CSRF token usage.
- Potential: Command injection indicator in DNS lookup feature based on form purpose and application profile, but not conclusively reproduced in this run.
- Potential: Weak TLS configuration concerns on
192.168.56.1:443 due to support for static RSA key exchange and CBC suites, though deprecated protocol versions were not observed.
2. Scope and Methodology
- Host discovery via ICMP/ARP-assisted network sweep.
- Port and service discovery via TCP SYN/version detection.
- Web enumeration via HTTP banner inspection, content review, Nikto, directory brute force, and targeted manual parameter testing.
- Only non-destructive techniques were used. No destructive exploitation, persistence, or service disruption was attempted.
3. Host Discovery Results
| IP Address |
Status |
Notes |
| 192.168.56.1 |
Up |
Web services on 80/443, Windows RPC on 135, RDP-like service on 3389. |
| 192.168.56.100 |
Up |
No open ports among top 200 tested; host responded as filtered/proto-unreach. |
| 192.168.56.105 |
Up |
Assessment system. |
| 192.168.56.106 |
Up |
Legacy Linux host exposing many insecure services and multiple web applications. |
4. Port and Service Discovery
192.168.56.1
| Port | Service | Version / Notes |
|---|
| 80/tcp | HTTP | Apache httpd 2.4.65 ((Debian)) |
| 135/tcp | MSRPC | Microsoft Windows RPC |
| 443/tcp | HTTPS | Apache httpd 2.4.65 ((Debian)) |
| 3389/tcp | RDP-like | ssl/ms-wbt-server? |
192.168.56.106
| Port | Service | Version / Notes |
|---|
| 21/tcp | FTP | vsftpd 2.3.4 |
| 22/tcp | SSH | OpenSSH 4.7p1 Debian 8ubuntu1 |
| 23/tcp | Telnet | Linux telnetd |
| 25/tcp | SMTP | Postfix smtpd |
| 53/tcp | DNS | ISC BIND 9.4.2 |
| 80/tcp | HTTP | Apache 2.2.8 (Ubuntu) DAV/2, PHP 5.2.4-2ubuntu5.10 |
| 111/tcp | rpcbind | RPC #100000 |
| 139/tcp | NetBIOS | Samba smbd 3.x - 4.x |
| 445/tcp | SMB | Samba smbd 3.x - 4.x |
| 513/tcp | login | Legacy remote login |
| 514/tcp | shell | Netkit rshd |
| 2049/tcp | NFS | RPC #100003 |
| 2121/tcp | FTP | ProFTPD 1.3.1 |
| 3306/tcp | MySQL | MySQL 5.0.51a |
| 5432/tcp | PostgreSQL | PostgreSQL 8.3.0 - 8.3.7 |
| 5900/tcp | VNC | Protocol 3.3 |
| 6000/tcp | X11 | Access denied |
5. Identified Web Applications
| Host | Application / Path | Observation |
|---|
| 192.168.56.106 | / | Landing page references TWiki, phpMyAdmin, Mutillidae, DVWA, WebDAV. |
| 192.168.56.106 | /mutillidae/ | Primary target for OWASP-style testing; multiple vulnerable modules exposed. |
| 192.168.56.106 | /dvwa/ | Accessible; redirects to login.php; security cookie set. |
| 192.168.56.106 | /phpMyAdmin/ | Exposed administration interface. |
| 192.168.56.106 | /dav/ | WebDAV referenced on landing page. |
| 192.168.56.106 | /twiki/ | Referenced on landing page. |
| 192.168.56.1 | http://192.168.56.1/ and https://192.168.56.1/ | Apache web service present; TLS reviewed on 443. |
6. Security Findings
Finding 1: Local File Inclusion (LFI) - Confirmed
Critical
| Affected Host/Application | 192.168.56.106 / Mutillidae |
|---|
| Category | LFI / File Inclusion / OWASP A05 Security Misconfiguration / Injection class |
|---|
| Evidence | Requesting /mutillidae/index.php?page=../../../../../../etc/passwd returned a response containing root:x:0:0:root:/root:/bin/bash. |
|---|
| Severity | Critical |
|---|
| Potential Impact | Arbitrary local file read, credential disclosure, source disclosure, and possible chained remote code execution depending on server configuration. |
|---|
| Recommended Remediation | Do not include files directly from user-controlled input. Replace dynamic file inclusion with strict server-side allowlists and fixed routing. Disable remote and unsafe inclusion patterns; harden PHP configuration and review file permissions. |
|---|
| Status | Confirmed |
|---|
Finding 2: SQL Injection Indicator - Confirmed
High
| Affected Host/Application | 192.168.56.106 / Mutillidae / user-info.php |
|---|
| Category | SQL Injection |
|---|
| Evidence |
Supplying username=' OR '1'='1 caused database error output and query disclosure:
Error executing query: Table 'metasploit.accounts' doesn't exist
SELECT * FROM accounts WHERE username='' OR '1'='1' AND password='x'
|
|---|
| Severity | High |
|---|
| Potential Impact | Authentication bypass, unauthorized data access, credential disclosure, and potential database compromise depending on backend schema and permissions. |
|---|
| Recommended Remediation | Use parameterized queries/prepared statements exclusively. Remove verbose database errors from user responses. Implement input validation and centralized error handling. |
|---|
| Status | Confirmed |
|---|
Finding 3: Cross-Site Scripting (XSS) Handling Weakness - Confirmed
High
| Affected Host/Application | 192.168.56.106 / Mutillidae / register.php |
|---|
| Category | XSS |
|---|
| Evidence | A test payload <script>alert(1)</script> submitted in registration data was reflected/returned unsafely in the application response, indicating inadequate output encoding or validation. |
|---|
| Severity | High |
|---|
| Potential Impact | Session theft, credential theft, client-side defacement, arbitrary actions in the victim browser, and pivoting into CSRF-style attacks. |
|---|
| Recommended Remediation | Apply context-aware output encoding, validate and sanitize untrusted input, and deploy Content Security Policy where appropriate. Review all user-supplied fields for reflected and stored XSS handling. |
|---|
| Status | Confirmed |
|---|
Finding 4: CSRF Protection Weakness - Potential
Medium
| Affected Host/Application | 192.168.56.106 / Mutillidae / blog functions |
|---|
| Category | CSRF |
|---|
| Evidence | The blog submission form contained a hidden field csrf-token with value SecurityIsDisabled, suggesting CSRF controls are absent, disabled, or predictable in the current configuration. |
|---|
| Severity | Medium |
|---|
| Potential Impact | An attacker could potentially induce authenticated users to submit unwanted state-changing requests. |
|---|
| Recommended Remediation | Implement per-request or per-session unpredictable anti-CSRF tokens, validate origin/referer where appropriate, and mark session cookies SameSite. |
|---|
| Status | Potential - manual validation recommended |
|---|
Finding 5: Command Injection Indicator - Potential
High
| Affected Host/Application | 192.168.56.106 / Mutillidae / dns-lookup.php |
|---|
| Category | OS Command Injection |
|---|
| Evidence | The application exposes a DNS lookup feature accepting raw hostnames/IPs and is an archetypal command-execution sink. A non-destructive probe was attempted but did not return a conclusive uid= marker in this run. |
|---|
| Severity | High |
|---|
| Potential Impact | Remote command execution, host compromise, credential theft, lateral movement. |
|---|
| Recommended Remediation | Do not pass user input to shell commands. Use safe library calls, strict input allowlists, escaping as defense-in-depth only, and low-privilege execution contexts. |
|---|
| Status | Potential - manual validation recommended |
|---|
Finding 6: Exposed phpinfo() and Sensitive Information Disclosure - Confirmed
Medium
| Affected Host/Application | 192.168.56.106 / /phpinfo.php and Mutillidae phpinfo endpoints |
|---|
| Category | Information Disclosure |
|---|
| Evidence | Nikto identified accessible /phpinfo.php. Directory brute force also found /mutillidae/phpinfo.php. |
|---|
| Severity | Medium |
|---|
| Potential Impact | Disclosure of filesystem paths, modules, environment details, and versions useful for targeted exploitation. |
|---|
| Recommended Remediation | Remove phpinfo pages from production systems and restrict diagnostic endpoints to administrative access only. |
|---|
| Status | Confirmed |
|---|
Finding 7: Missing Security Headers - Confirmed
Low
| Affected Host/Application | 192.168.56.106 / Apache applications |
|---|
| Category | Security Misconfiguration |
|---|
| Evidence | Nikto reported missing X-Frame-Options and X-Content-Type-Options. |
|---|
| Severity | Low |
|---|
| Potential Impact | Increased exposure to clickjacking and content-type confusion issues. |
|---|
| Recommended Remediation | Add appropriate headers including X-Frame-Options or CSP frame-ancestors, and X-Content-Type-Options: nosniff. |
|---|
| Status | Confirmed |
|---|
Finding 8: HTTP TRACE Enabled - Confirmed
Low
| Affected Host/Application | 192.168.56.106 / Apache |
|---|
| Category | Security Misconfiguration |
|---|
| Evidence | Nikto reported HTTP TRACE method active. |
|---|
| Severity | Low |
|---|
| Potential Impact | Can assist Cross Site Tracing in certain legacy/browser-assisted scenarios. |
|---|
| Recommended Remediation | Disable TRACE/TRACK unless explicitly required. |
|---|
| Status | Confirmed |
|---|
Finding 9: Directory Indexing and Exposed Administrative Interfaces - Confirmed
Medium
| Affected Host/Application | 192.168.56.106 / Apache web root and applications |
|---|
| Category | Security Misconfiguration / Information Exposure |
|---|
| Evidence | Nikto reported browsable directories such as /doc/, /test/, /icons/, plus exposed /phpMyAdmin/. |
|---|
| Severity | Medium |
|---|
| Potential Impact | File disclosure, easier enumeration, increased exploitability, and unauthorized access attempts against admin consoles. |
|---|
| Recommended Remediation | Disable autoindex, remove test content, restrict admin interfaces by authentication and network controls, and minimize exposed files. |
|---|
| Status | Confirmed |
|---|
Finding 10: Outdated Web Stack and Legacy Services - Confirmed
High
| Affected Host/Application | 192.168.56.106 |
|---|
| Category | Vulnerable and Outdated Components |
|---|
| Evidence | Apache 2.2.8, PHP 5.2.4, OpenSSH 4.7p1, vsftpd 2.3.4, MySQL 5.0.51a, PostgreSQL 8.3.x, Telnet, rsh, VNC 3.3, and other legacy services are exposed. |
|---|
| Severity | High |
|---|
| Potential Impact | Multiple known vulnerabilities may be applicable; lack of vendor support materially increases compromise risk. |
|---|
| Recommended Remediation | Retire or rebuild legacy hosts, disable obsolete services, patch supported software, and segment vulnerable training systems away from production-like networks. |
|---|
| Status | Confirmed |
|---|
Finding 11: Weak TLS Configuration Characteristics - Potential
Medium
| Affected Host/Application | 192.168.56.1:443 |
|---|
| Category | TLS Configuration |
|---|
| Evidence |
- Observed support for TLS 1.2 and TLS 1.3.
- No deprecated TLS 1.0/1.1 observed in the scan output.
- Server supports static RSA key exchange suites and CBC-based suites in TLS 1.2, e.g.
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA.
- Cipher preference set to client.
|
|---|
| Severity | Medium |
|---|
| Potential Impact | Expanded attack surface and weaker forward secrecy posture if older client-driven choices are negotiated. |
|---|
| Recommended Remediation | Prefer TLS 1.3 and strong ECDHE suites, remove static RSA key exchange and legacy CBC suites where compatibility permits, and enforce server-side cipher preference if policy requires. |
|---|
| Status | Potential hardening issue |
|---|
Finding 12: Deprecated TLS Versions - Not Observed
Info
| Affected Host/Application | 192.168.56.1:443 |
|---|
| Category | Deprecated TLS Versions |
|---|
| Evidence | ssl-enum-ciphers identified TLS 1.2 and TLS 1.3 only. No TLS 1.0 or TLS 1.1 were listed. |
|---|
| Severity | Informational |
|---|
| Potential Impact | None observed for deprecated protocol support based on current scan evidence. |
|---|
| Recommended Remediation | Maintain TLS 1.2/1.3-only posture and periodically retest after configuration changes. |
|---|
| Status | Observed as not present in this scan |
|---|
Finding 13: Remote File Inclusion (RFI) - Not Confirmed
Info
| Affected Host/Application | 192.168.56.106 / Mutillidae |
|---|
| Category | RFI |
|---|
| Evidence | A basic probe using page=http://example.com did not return remote content in this assessment. |
|---|
| Severity | Informational |
|---|
| Potential Impact | None confirmed from this test. |
|---|
| Recommended Remediation | Continue to block remote inclusion and disable unsafe interpreter settings such as allow_url_include. |
|---|
| Status | Not confirmed in this assessment |
|---|
Finding 14: IDOR - Not Confirmed, Further Manual Review Needed
Info
| Affected Host/Application | Mutillidae modules reviewed |
|---|
| Category | IDOR / Broken Access Control |
|---|
| Evidence | Browsable functionality and author selection values were observed, but a non-destructive confirmation of unauthorized direct object access was not established during this run. |
|---|
| Severity | Informational |
|---|
| Potential Impact | Could allow unauthorized access to other users' records if identifiers are guessable and authorization checks are missing. |
|---|
| Recommended Remediation | Validate authorization on every object access, avoid direct exposure of sensitive identifiers, and test with role-based user accounts. |
|---|
| Status | Manual validation recommended |
|---|
7. Supporting Evidence
Host Discovery
# Nmap ping sweep
Host: 192.168.56.1 Status: Up
Host: 192.168.56.100 Status: Up
Host: 192.168.56.106 Status: Up
Host: 192.168.56.105 Status: Up
Metasploitable Web Root
HTTP/1.1 200 OK
Server: Apache/2.2.8 (Ubuntu) DAV/2
X-Powered-By: PHP/5.2.4-2ubuntu5.10
Landing page links:
- /twiki/
- /phpMyAdmin/
- /mutillidae/
- /dvwa/
- /dav/
Nikto Highlights
- Missing X-Frame-Options
- Missing X-Content-Type-Options
- Apache/2.2.8 outdated
- HTTP TRACE method active
- /phpinfo.php found
- /doc/ directory indexing
- /test/ directory indexing
- /phpMyAdmin/ exposed
- Apache default files present
SQL Injection Evidence
Error executing query: Table 'metasploit.accounts' doesn't exist
Diagnostic Information:
SELECT * FROM accounts WHERE username='' OR '1'='1' AND password='x'
LFI Evidence
Request:
GET /mutillidae/index.php?page=../../../../../../etc/passwd
Response snippet:
root:x:0:0:root:/root:/bin/bash
CSRF Indicator
<input name="csrf-token" type="hidden" value="SecurityIsDisabled" />
TLS Enumeration Summary for 192.168.56.1:443
Supported:
- TLSv1.2
- TLSv1.3
Examples of TLSv1.2 suites:
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_128_CBC_SHA
- TLS_RSA_WITH_AES_256_CBC_SHA
Deprecated TLS versions not observed in output:
- TLSv1.0
- TLSv1.1
8. Risk Prioritization
| Priority | Issue | Reason |
|---|
| 1 | LFI on Mutillidae | Direct file disclosure with strong evidence; often chainable to RCE. |
| 2 | SQL Injection on user-info workflow | Query manipulation and database error leakage confirmed. |
| 3 | XSS weakness in registration flow | Untrusted script payload reflected/returned unsafely. |
| 4 | Legacy exposed services and software | Large attack surface with outdated components. |
| 5 | CSRF and command injection candidates | Likely vulnerable features requiring focused manual validation. |
| 6 | TLS hardening on 192.168.56.1 | No deprecated versions observed, but cipher suite set can be improved. |
9. Recommendations
- Immediately isolate or decommission legacy training systems from any sensitive or shared network.
- Fix unsafe file inclusion logic using strict allowlists and framework-based routing.
- Replace dynamic SQL with prepared statements and suppress detailed SQL errors.
- Apply systematic output encoding and input validation to eliminate XSS classes.
- Implement robust CSRF protections on all state-changing requests.
- Review all command-execution features and replace shell calls with safe libraries.
- Remove phpinfo, test pages, sample content, and directory indexing from exposed hosts.
- Restrict or remove administrative interfaces like phpMyAdmin unless explicitly required.
- Harden TLS by removing static RSA key exchange and older CBC suites where possible.
- Disable obsolete services such as Telnet, rsh, legacy FTP, and unauthenticated or weak remote access mechanisms.
10. Conclusion
The assessment identified multiple confirmed high-risk web application issues and extensive legacy exposure on
192.168.56.106. The host appears to be a deliberately vulnerable training target, but the findings remain valid from a security
assessment perspective. The host 192.168.56.1 showed a comparatively stronger TLS posture with TLS 1.2/1.3 only, though additional
cipher hardening is recommended.
Confirmed findings are clearly separated from potential findings requiring manual validation. If needed, a follow-on assessment can focus on
authenticated testing, IDOR validation, deeper CSRF proofing, and more granular TLS/server hardening review.