| Section | Description |
|---|---|
| Target IP | 172.17.0.2 |
| Target Host | Unknown |
| OS | Linux |
| Kernel Version | Unknown |
| Web Application/Sercvice | Apache httpd 2.4.38 (Debian) |
| Application Version | Apache 2.4.38 |
| Open Ports | 22 (SSH),80/tcp (HTTP),53 |
| Test Methodology | Black-box |
| Test Date | 7/25/2026 |
An nmap scan was performed to identify open ports and surfaces
nmap -sC -sV 172.17.0.2
Open Ports:
The web service hosted a login page with fields for "User" and "Password".
URL -> <http://172.17.0.2>
User: ' OR 1=1 --
Password: admin
The application is protected by a WAF. When common SQL injection strings such as ' OR 1=1 -- were submitted, the server responded with a 403 Forbidden error , explicitly stating that the user did not have permission to access the resource. This confirmed the presence of an active security filter blocking standard exploitation attempts.
User: admin
Password: '
Analysis with the tool WhatWaf identified the website protection as "Apache Generic," likely referring to ModSecurity. This is an open-source WAF that integrates as a module into web servers, such as Apache in this case.
./whatwaf -u '<http://172.17.0.2/index.php?name=admin&password=%27+OR+1%3D1+--&submit=Login>'