| Section | Description |
|---|---|
| Target IP | 172.17.0.2 |
| Target Host | Uknown |
| OS | Uknown |
| Kernel Version | Linux |
| Web Application/Sercvice | Apache 2.4.58 (Ubuntu) |
| Application Version | Apache 2.4.58 |
| Open Ports | 22 (SSH),80/tcp (HTTP), |
| Test Methodology | Black-box |
| Test Date | 8/12/2026 |
| SSH version | OpenSSH 9.6p1 (Ubuntu) |
An nmap scan was performed to identify open ports and surfaces
nmap -sC -sV 172.17.0.2
Open Ports:
URL -> <http://172.17.0.2/>
It is a ‘news’ website, but nothing relevant can be found. Therefore, its source code will be reviewed to see if any clues can be found there:
On line 14, a possible user named "pipe" is identified, so hydra will be used to brute-force this username against SSH on port 22.
hydra -l pipe -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2 -t 64
Indeed, this user is confirmed to exist on the machine, and the corresponding password is found to be "kisses" Intrusion is then carried out using these credentials via SSH on port 22.
User Flag: d970977b69a543ce746095e2b660d107