The target system at 192.168.64.2 exhibits critical vulnerabilities across multiple services and protocols, including FTP, SSH, and DNS, which could allow unauthorized access or data exfiltration.
Begin with vsftpd 21 (CRITICAL) via CVE-2011-2523, then SSH 22 (HIGH) using NSE findings, followed by BIND 53 (HIGH) for DNS poisoning.
| Finding | Severity | Impact | CVE |
|---|---|---|---|
| FTP Service (Port 21) | CRITICAL | Potential for remote code execution via backdoor in vsftpd 2.3.4. | CVE-2011-2523 |
| SSH Service (Port 22) | HIGH | Vulnerable to various attacks due to outdated version and lack of proper configuration. | — |
| DNS Service (Port 53) | HIGH | Potential for DNS cache poisoning, leading to man-in-the-middle attacks. | — |
| HTTP Service (Port 80) | HIGH | Multiple web application vulnerabilities including XSS and information disclosure. | — |
| Finding | OWASP 2021 | CWE |
|---|---|---|
| XSS vulnerability detected | A03:2021 | CWE-79 |
| HTTP TRACE method enabled | A04:2021 | CWE-864 |
Immediate remediation is required to patch critical vulnerabilities and secure the system. Remediation should be completed within 7 days.
| IP | Port | Service | Version / Banner | CVEs (click to view) | NSE Findings |
|---|---|---|---|---|---|
| 192.168.64.2 | 21 |
ftp | vsftpd 2.3.4 | CVE-2011-2523 EDB-17491 EDB-49757 | ⚠ 1 finding(s) |
| 192.168.64.2 | 22 |
ssh | OpenSSH 4.7p1 Debian 8ubuntu1 | — | — |
| 192.168.64.2 | 23 |
telnet | Linux telnetd | CVE-2021-27171 CVE-2000-1195 CVE-2022-39028 | — |
| 192.168.64.2 | 25 |
smtp | Postfix smtpd | CVE-2005-0337 CVE-2023-51764 CVE-2024-27305 | ⚠ 1 finding(s) |
| 192.168.64.2 | 53 |
domain | ISC BIND 9.4.2 | CVE-2008-0122 CVE-2008-4163 | — |
| 192.168.64.2 | 80 |
http | Apache httpd 2.2.8 | — | ⚠ 68 finding(s) |
| 192.168.64.2 | 111 |
rpcbind | 2 | CVE-2003-1070 EDB-26887 EDB-41974 | — |
| 192.168.64.2 | 139 |
netbios-ssn | Samba smbd 3.X - 4.X | — | — |
| 192.168.64.2 | 445 |
netbios-ssn | Samba smbd 3.X - 4.X | — | — |
| 192.168.64.2 | 512 |
exec | netkit-rsh rexecd | — | — |
| 192.168.64.2 | 513 |
login | — | CVE-1999-0036 CVE-1999-0180 CVE-1999-1152 | — |
| 192.168.64.2 | 514 |
tcpwrapped | — | — | — |
| 192.168.64.2 | 1099 |
java-rmi | GNU Classpath grmiregistry | — | — |
| 192.168.64.2 | 1524 |
bindshell | Metasploitable root shell | — | — |
| 192.168.64.2 | 2049 |
nfs | 2-4 | EDB-10202 EDB-42305 | — |
| 192.168.64.2 | 2121 |
ftp | ProFTPD 1.3.1 | CVE-2009-0542 CVE-2008-4242 CVE-2009-0543 | — |
| 192.168.64.2 | 3306 |
mysql | MySQL 5.0.51a-3ubuntu5 | CVE-2019-14939 CVE-2015-9244 GHSA-5f7m-mmpc-qhh4 | — |
| 192.168.64.2 | 3632 |
distccd | distccd v1 | CVE-2004-2687 | ⚠ 5 finding(s) |
| 192.168.64.2 | 5432 |
postgresql | PostgreSQL DB 8.3.0 - 8.3.7 | — | — |
| 192.168.64.2 | 5900 |
vnc | VNC | CVE-2002-2088 CVE-2006-1652 CVE-2006-4309 | — |
| 192.168.64.2 | 6000 |
X11 | — | CVE-2000-1169 CVE-2002-0402 CVE-2005-0084 | — |
| 192.168.64.2 | 6667 |
irc | UnrealIRCd | CVE-2010-2075 CVE-2016-7144 CVE-2009-4893 | — |
| 192.168.64.2 | 6697 |
irc | UnrealIRCd | — | — |
| 192.168.64.2 | 8009 |
ajp13 | Apache Jserv | CVE-2020-1938 CVE-2000-1247 | ⚠ 3 finding(s) |
| 192.168.64.2 | 8180 |
http | Apache Tomcat/Coyote JSP engine 1.1 | — | ⚠ 37 finding(s) |
| 192.168.64.2 | 8787 |
drb | Ruby DRb RMI | — | — |
| CVE ID ↗ NVD | CVSS | Severity | Service | Description |
|---|---|---|---|---|
| CVE-2008-0122 | 10.0 | 192.168.64.2:53 | Off-by-one error in the inet_network function in libbind in ISC BIND 9.4.2 and earlier, as used in libc in FreeBSD 6.2 t | |
| CVE-2002-2088 | 10.0 | 192.168.64.2:5900 | The MOSIX Project clump/os 5.4 creates a default VNC account without a password, which allows remote attackers to gain r | |
| CVE-2006-4309 | 10.0 | 192.168.64.2:5900 | VNC server on the AK-Systems Windows Terminal 1.2.5 ExVLP is not password protected, which allows remote attackers to lo | |
| CVE-2021-27171 | 9.8 | CRITICAL | 192.168.64.2:23 | An issue was discovered on FiberHome HG6245D devices through RP2613. It is possible to start a Linux telnetd as root on |
| CVE-2011-2523 | 9.8 | CRITICAL | 192.168.64.2:21 | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. |
| CVE-2020-1938 | 9.8 | CRITICAL | 192.168.64.2:8009 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc |
| CVE-2006-1652 | 9.0 | 192.168.64.2:5900 | Multiple buffer overflows in (a) UltraVNC (aka Ultr@VNC) 1.0.1 and earlier and (b) tabbed_viewer 1.29 (1) allow user-ass | |
| CVE-1999-0036 | 8.4 | HIGH | 192.168.64.2:513 | IRIX login program with a nonzero LOCKOUT parameter allows creation or damage to files. |
| CVE-2016-7144 | 8.1 | HIGH | 192.168.64.2:6667 | The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attacke |
| CVE-2008-4163 | 7.8 | 192.168.64.2:53 | Unspecified vulnerability in ISC BIND 9.3.5-P2-W1, 9.4.2-P2-W1, and 9.5.0-P2-W1 on Windows allows remote attackers to ca | |
| CVE-2005-0337 | 7.5 | 192.168.64.2:25 | Postfix 2.1.3, when /proc/net/if_inet6 is not available and permit_mx_backup is enabled in smtpd_recipient_restrictions, | |
| CVE-2000-1195 | 7.5 | 192.168.64.2:23 | telnet daemon (telnetd) from the Linux netkit package before netkit-telnet-0.16 allows remote attackers to bypass authen | |
| CVE-2022-39028 | 7.5 | HIGH | 192.168.64.2:23 | telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference v |
| CVE-2009-0542 | 7.5 | 192.168.64.2:2121 | SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL co | |
| CVE-1999-0180 | 7.5 | 192.168.64.2:513 | in.rshd allows users to login with a NULL username and execute commands. | |
| CVE-1999-1152 | 7.5 | HIGH | 192.168.64.2:513 | Compaq/Microcom 6000 Access Integrator does not disconnect a client after a certain number of failed login attempts, whi |
| CVE-2001-1422 | 7.5 | 192.168.64.2:5900 | WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to | |
| CVE-2002-0994 | 7.5 | 192.168.64.2:5900 | SunPCi II VNC uses a weak authentication scheme, which allows remote attackers to obtain the VNC password by sniffing th | |
| CVE-2002-1336 | 7.5 | 192.168.64.2:5900 | TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to byp | |
| CVE-2000-1169 | 7.5 | 192.168.64.2:6000 | OpenSSH SSH client before 2.3.0 does not properly disable X11 or agent forwarding, which could allow a malicious SSH ser | |
| CVE-2002-0402 | 7.5 | 192.168.64.2:6000 | Buffer overflow in X11 dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a denial of service (cra | |
| CVE-2005-0084 | 7.5 | 192.168.64.2:6000 | Buffer overflow in the X11 dissector in Ethereal 0.8.10 through 0.10.8 allows remote attackers to execute arbitrary code | |
| CVE-2010-2075 | 7.5 | 192.168.64.2:6667 | UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally | |
| CVE-1999-1034 | 7.2 | 192.168.64.2:513 | Vulnerability in login in AT&T System V Release 4 allows local users to gain privileges. | |
| CVE-1999-1142 | 7.2 | 192.168.64.2:513 | SunOS 4.1.2 and earlier allows local users to gain privileges via "LD_*" environmental variables to certain dynamically | |
| CVE-1999-1304 | 7.2 | 192.168.64.2:513 | Vulnerability in login in SCO UNIX 4.2 and earlier allows local users to gain root access. | |
| CVE-1999-0028 | 7.2 | 192.168.64.2:513 | root privileges via buffer overflow in login/scheme command on SGI IRIX systems. | |
| CVE-2002-0517 | 7.2 | 192.168.64.2:6000 | Buffer overflow in X11 library (libX11) on Caldera Open UNIX 8.0.0, UnixWare 7.1.1, and possibly other operating systems | |
| CVE-2006-0577 | 7.2 | 192.168.64.2:6000 | Lexmark X1185 printer allows local users to gain SYSTEM privileges by navigating to the "Appearance" dialog and selectin | |
| CVE-2008-4242 | 6.8 | 192.168.64.2:2121 | ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct |
| Target | Module | Payload | RC File |
|---|---|---|---|
| ⚡ 192.168.64.2:21 | exploit/unix/ftp/vsftpd_234_backdoor | ||
| ⚡ 192.168.64.2:512 | auxiliary/scanner/rservices/rexec_login | ||
| ⚡ 192.168.64.2:3306 | auxiliary/scanner/mysql/mysql_login | ||
| ⚡ 192.168.64.2:3632 | exploit/unix/misc/distcc_exec | cmd/unix/reverse_bash | |
| ⚡ 192.168.64.2:5432 | exploit/linux/postgres/postgres_payload | linux/x86/meterpreter/reverse_tcp | |
| ⚡ 192.168.64.2:5900 | auxiliary/scanner/vnc/vnc_login | ||
| ⚡ 192.168.64.2:6667 | exploit/unix/irc/unreal_ircd_3281_backdoor | ||
| ⚡ 192.168.64.2:6697 | exploit/unix/irc/unreal_ircd_3281_backdoor | ||
| ⚡ 192.168.64.2:8180 | exploit/multi/http/tomcat_mgr_upload | java/meterpreter/reverse_tcp | |
| ⚡ 192.168.64.2:8787 | exploit/linux/misc/drb_remote_codeexec | cmd/unix/reverse_bash | |
| ⚡ 192.168.64.2:139 | exploit/windows/smb/ms17_010_eternalblue | windows/x64/meterpreter/reverse_tcp |
| Category | Host:Port | Details |
|---|---|---|
| WEB | 192.168.64.2:21 | /usr/share/nmap/nse_main.lua:829: 'ftp-vuln-cve-2011-3376' did not match a category, filename, or directory |
| WEB | 192.168.64.2:25 | |_ The SMTP server is not Exim: NOT VULNERABLE |
| NIKTO | 192.168.64.2:80 | [NIKTO] + Target IP: 192.168.64.2 |
| NIKTO | 192.168.64.2:80 | [NIKTO] + Target Hostname: 192.168.64.2 |
| NIKTO | 192.168.64.2:80 | [NIKTO] + Target Port: 80 |
| NIKTO | 192.168.64.2:80 | [NIKTO] + Platform: Unknown |
| NIKTO | 192.168.64.2:80 | [NIKTO] + Start Time: 2026-05-31 20:56:43 (GMT0) |
| NIKTO | 192.168.64.2:80 | [NIKTO] + Server: Apache/2.2.8 (Ubuntu) DAV/2 |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [999986] /: Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.10. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [750500] /icons/: Directory indexing found. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + No CGI Directories found (use '-C all' to force check all possible dirs). CGI tests skipped. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [013587] /: Suggested security header missing: strict-transport-security. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [013587] /: Suggested security header missing: permissions-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [013587] /: Suggested security header missing: content-security-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [013587] /: Suggested security header missing: referrer-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [013587] /: Suggested security header missing: x-content-type-options. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [999100] /index: Uncommon header(s) 'tcn' found, with contents: list. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [999965] /index: Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. The following alternatives for 'index' were found: index.php. See |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [600050] Apache/2.2.8 appears to be outdated (current is at least 2.4.66). |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [600625] PHP/5.2.4-2ubuntu5.10 appears to be outdated (current is at least 8.5.1). |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [999967] /: Web Server returns a valid response with junk HTTP methods which may cause false positives. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [000434] /: HTTP TRACE method is active and replies which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [750510] /phpinfo.php: Output from the phpinfo() function was found. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [750500] /doc/: Directory indexing found. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [001213] /doc/: The /doc/ directory is browsable. This may be /usr/doc. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0678 |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [001384] /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP Easter Eggs reveals potentially sensitive information via HTTP requests that contain specific QUERY strings. See: https://labs.detect |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [001385] /?=PHPE9568F36-D428-11d2-A769-00AA001ACF42: PHP Easter Egg reveals potentially sensitive information via HTTP requests that contain specific QUERY strings. See: https://labs.detecti |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [001386] /?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: PHP Easter Egg reveals potentially sensitive information via HTTP requests that contain specific QUERY strings. See: https://labs.detecti |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [001387] /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP Easter Egg reveals potentially sensitive information via HTTP requests that contain specific QUERY strings. See: https://labs.detecti |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [001795] /phpMyAdmin/changelog.php: phpMyAdmin is for managing MySQL databases, and should be protected or limited to authorized hosts. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [999984] /phpMyAdmin/ChangeLog: Server may leak inodes via ETags, header found with file /phpMyAdmin/ChangeLog, inode: 92462, size: 40540, mtime: Tue Dec 9 17:24:00 2008. See: https://cve.m |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [001796] /phpMyAdmin/ChangeLog: phpMyAdmin is for managing MySQL databases, and should be protected or limited to authorized hosts. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [750500] /test/: Directory indexing found. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [001894] /test/: This might be interesting. |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [002989] /phpinfo.php: PHP is installed, and a test script which runs phpinfo() was found. This gives a lot of system information. See: CWE-552 |
| NIKTO | 192.168.64.2:80 | [NIKTO] + [003584] /icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/ |
| NIKTO | 192.168.64.2:80 | [NIKTO] + Scan terminated: 3 errors and 27 items reported on the remote host |
| NIKTO | 192.168.64.2:80 | [NIKTO] + End Time: 2026-05-31 20:58:41 (GMT0) (118 seconds) |
| NIKTO | 192.168.64.2:80 | [NIKTO] + 1 host(s) tested |
| NIKTO | 192.168.64.2:80 | [NIKTO] + ERROR: Failed to check for updates: 403 |
| NIKTO | 192.168.64.2:80 | [NIKTO] + ERROR: Host maximum execution time of 90 seconds reached |
| DIRB | 192.168.64.2:80 | [DIRB] + http://192.168.64.2:80/cgi-bin/ (CODE:403|SIZE:293) |
| DIRB | 192.168.64.2:80 | [DIRB] ==> DIRECTORY: http://192.168.64.2:80/dav/ |
| DIRB | 192.168.64.2:80 | [DIRB] + http://192.168.64.2:80/index (CODE:200|SIZE:891) |
| DIRB | 192.168.64.2:80 | [DIRB] + http://192.168.64.2:80/index.php (CODE:200|SIZE:891) |
| DIRB | 192.168.64.2:80 | [DIRB] + http://192.168.64.2:80/phpinfo (CODE:200|SIZE:48062) |
| DIRB | 192.168.64.2:80 | [DIRB] + http://192.168.64.2:80/phpinfo.php (CODE:200|SIZE:48074) |
| DIRB | 192.168.64.2:80 | [DIRB] ==> DIRECTORY: http://192.168.64.2:80/phpMyAdmin/ |
| DIRB | 192.168.64.2:80 | [DIRB] + http://192.168.64.2:80/server-status (CODE:403|SIZE:298) |
| DIRB | 192.168.64.2:80 | [DIRB] ==> DIRECTORY: http://192.168.64.2:80/test/ |
| DIRB | 192.168.64.2:80 | [DIRB] ==> DIRECTORY: http://192.168.64.2:80/twiki/ |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: <script>alert(1)</script> |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: <img src=x onerror=alert(1)> |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: <svg onload=alert(1)> |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: " onmouseover="alert(1)" x=" |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: ' onmouseover='alert(1)' x=' |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%3Cscript%3Ealert%281%29%3C%2Fscript%3E | Payload reflected: <script>alert(1)</script> |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E | Payload reflected: <img src=x onerror=alert(1)> |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%3Csvg%20onload%3Dalert%281%29%3E | Payload reflected: <svg onload=alert(1)> |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%22%20onmouseover%3D%22alert%281%29%22%20x%3D%22 | Payload reflected: " onmouseover="alert(1)" x=" |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%27%20onmouseover%3D%27alert%281%29%27%20x%3D%27 | Payload reflected: ' onmouseover='alert(1)' x=' |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&password=x | Payload reflected: <script>alert(1)</script> |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E&password=x | Payload reflected: <img src=x onerror=alert(1)> |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%3Csvg%20onload%3Dalert%281%29%3E&password=x | Payload reflected: <svg onload=alert(1)> |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%22%20onmouseover%3D%22alert%281%29%22%20x%3D%22&password=x | Payload reflected: " onmouseover="alert(1)" x=" |
| XSS REFLECTED | 192.168.64.2:80 | [XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%27%20onmouseover%3D%27alert%281%29%27%20x%3D%27&password=x | Payload reflected: ' onmouseover='alert(1)' x=' |
| XSS POC | 192.168.64.2:80 | [XSS POC] XSS PoC confirmed on 192.168.64.2:80 — 15 payload(s) reflected |
| HEADERS | 192.168.64.2:80 | [HEADERS] Response headers for http://192.168.64.2:80/: Date: Sun, 31 May 2026 21:06:26 GMT; Server: Apache/2.2.8 (Ubuntu) DAV/2; X-Powered-By: PHP/5.2.4-2ubuntu5.10; Transfer-Encoding: chunked; Conte |
| CLICKJACKING | 192.168.64.2:80 | [CLICKJACKING] Missing X-Frame-Options header — http://192.168.64.2:80/ may be frameable (vulnerable to clickjacking UI redress attack) |
| HEADERS | 192.168.64.2:80 | [HEADERS] Missing security headers: X-CONTENT-TYPE-OPTIONS, X-XSS-PROTECTION, STRICT-TRANSPORT-SECURITY, CONTENT-SECURITY-POLICY |
| WEB | 192.168.64.2:3632 | | VULNERABLE: |
| WEB | 192.168.64.2:3632 | | State: VULNERABLE (Exploitable) |
| WEB | 192.168.64.2:3632 | | IDs: CVE:CVE-2004-2687 |
| WEB | 192.168.64.2:3632 | | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2687 |
| WEB | 192.168.64.2:3632 | | https://nvd.nist.gov/vuln/detail/CVE-2004-2687 |
| NIKTO | 192.168.64.2:8009 | [NIKTO] + [FAIL] Unable to connect to 192.168.64.2:8009. |
| CLICKJACKING | 192.168.64.2:8009 | [CLICKJACKING] Missing X-Frame-Options header — http://192.168.64.2:8009/ may be frameable (vulnerable to clickjacking UI redress attack) |
| HEADERS | 192.168.64.2:8009 | [HEADERS] Missing security headers: X-CONTENT-TYPE-OPTIONS, X-XSS-PROTECTION, STRICT-TRANSPORT-SECURITY, CONTENT-SECURITY-POLICY |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + Target IP: 192.168.64.2 |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + Target Hostname: 192.168.64.2 |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + Target Port: 8180 |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + Platform: Unknown |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + Start Time: 2026-05-31 20:56:42 (GMT0) |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + Server: Apache-Coyote/1.1 |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + No CGI Directories found (use '-C all' to force check all possible dirs). CGI tests skipped. |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [500645] /favicon.ico: identifies this app/server as: Apache Tomcat (possibly 5.5.26 through 8.0.15), Alfresco Community. See: https://en.wikipedia.org/wiki/Favicon |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [013587] /: Suggested security header missing: strict-transport-security. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [013587] /: Suggested security header missing: referrer-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [013587] /: Suggested security header missing: x-content-type-options. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [013587] /: Suggested security header missing: permissions-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [013587] /: Suggested security header missing: content-security-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [999967] /: Web Server returns a valid response with junk HTTP methods which may cause false positives. |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [000356] /: Appears to be a default Apache Tomcat install. |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [95] /admin/: Cookie JSESSIONID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [001226] /admin/contextAdmin/contextAdmin.html: Tomcat may be configured to let attackers read arbitrary files. Restrict access to /admin. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [002785] /tomcat-docs/index.html: Default Apache Tomcat documentation found. See: CWE-552 |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [003489] /webdav/index.html: WebDAV support is enabled. |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + [003502] /jsp-examples/: Apache Java Server Pages documentation. See: CWE-552 |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + Scan terminated: 0 errors and 13 items reported on the remote host |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + End Time: 2026-05-31 20:58:13 (GMT0) (91 seconds) |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + 1 host(s) tested |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + ERROR: Failed to check for updates: 403 |
| NIKTO | 192.168.64.2:8180 | [NIKTO] + ERROR: Host maximum execution time of 90 seconds reached |
| DIRB | 192.168.64.2:8180 | [DIRB] ==> DIRECTORY: http://192.168.64.2:8180/admin/ |
| DIRB | 192.168.64.2:8180 | [DIRB] + http://192.168.64.2:8180/favicon.ico (CODE:200|SIZE:21630) |
| DIRB | 192.168.64.2:8180 | [DIRB] ==> DIRECTORY: http://192.168.64.2:8180/host-manager/ |
| DIRB | 192.168.64.2:8180 | [DIRB] ==> DIRECTORY: http://192.168.64.2:8180/jsp-examples/ |
| DIRB | 192.168.64.2:8180 | [DIRB] ==> DIRECTORY: http://192.168.64.2:8180/manager/ |
| DIRB | 192.168.64.2:8180 | [DIRB] ==> DIRECTORY: http://192.168.64.2:8180/servlets-examples/ |
| DIRB | 192.168.64.2:8180 | [DIRB] ==> DIRECTORY: http://192.168.64.2:8180/tomcat-docs/ |
| DIRB | 192.168.64.2:8180 | [DIRB] + http://192.168.64.2:8180/webdav (CODE:200|SIZE:1775) |
| DIRB | 192.168.64.2:8180 | [DIRB] ==> DIRECTORY: http://192.168.64.2:8180/WEB-INF/ |
| HEADERS | 192.168.64.2:8180 | [HEADERS] Response headers for http://192.168.64.2:8180/: Server: Apache-Coyote/1.1; Content-Type: text/html;charset=ISO-8859-1; Transfer-Encoding: chunked; Date: Sun, 31 May 2026 21:06:32 GMT |
| CLICKJACKING | 192.168.64.2:8180 | [CLICKJACKING] Missing X-Frame-Options header — http://192.168.64.2:8180/ may be frameable (vulnerable to clickjacking UI redress attack) |
| HEADERS | 192.168.64.2:8180 | [HEADERS] Missing security headers: X-CONTENT-TYPE-OPTIONS, X-XSS-PROTECTION, STRICT-TRANSPORT-SECURITY, CONTENT-SECURITY-POLICY |
| Service | Host:Port | Risk | Fix Summary | Linux Fix Command |
|---|---|---|---|---|
| FTP | 192.168.64.2:21 | vsftpd 2.3.4 backdoor (CVE-2011-2523) — trivial remote root shell. Anonymous FTP also exposes data. | Immediately replace vsftpd with a patched version. Disable anonymous access. Consider replacing FTP with SFTP entirely. | # Remove backdoored vsftpd and replace apt-get remove vsftpd -y apt-get install vsftpd -y # Disable anonymous login sed -i 's/anonymous_enable=YES/anonymous_enable=NO/' /etc/vsftpd.conf # Restrict to local users only echo 'local_enable=YES' >> /etc/vsftpd.conf echo 'chroot_local_user=YES' >> /etc/vsftpd.conf systemctl restart vsftpd # Block FTP port from external access ufw deny 21/tcp |
| SSH | 192.168.64.2:22 | OpenSSH 4.7p1 is outdated and vulnerable to multiple CVEs. Default credentials (msfadmin/msfadmin) allow trivial login. | Upgrade OpenSSH, disable password auth, enforce key-based auth, disable root login, change default credentials. | # Harden SSH configuration sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config echo 'MaxAuthTries 3' >> /etc/ssh/sshd_config echo 'LoginGraceTime 30' >> /etc/ssh/sshd_config echo 'AllowUsers YOUR_USER' >> /etc/ssh/sshd_config # Change default password immediately passwd msfadmin # Upgrade SSH apt-get upgrade openssh-server -y systemctl restart sshd |
| Telnet | 192.168.64.2:23 | Telnet transmits all credentials and data in cleartext. Trivially interceptable. No reason to run in 2024+. | Disable and remove telnetd immediately. Use SSH for all remote access. | # Disable and remove telnet systemctl stop telnet.socket 2>/dev/null || true systemctl disable telnet.socket 2>/dev/null || true apt-get remove --purge telnetd telnet -y # Block port 23 ufw deny 23/tcp |
| SMTP | 192.168.64.2:25 | Open SMTP relay allows spam/phishing. User enumeration via VRFY/EXPN. Postfix version may have known CVEs. | Disable open relay, disable VRFY/EXPN, require SMTP AUTH for sending. | # Disable VRFY and EXPN postconf -e 'disable_vrfy_command = yes' # Restrict relay postconf -e 'smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination' # Require authentication postconf -e 'smtpd_sasl_auth_enable = yes' systemctl restart postfix |
| HTTP | 192.168.64.2:80 | Apache 2.2.8 with PHP 5.2.4 — multiple critical CVEs. PHP CGI arg injection (CVE-2012-1823). Unencrypted HTTP. | Upgrade Apache and PHP immediately. Force HTTPS. Disable PHP CGI mode. Add security headers. | # Upgrade Apache and PHP apt-get upgrade apache2 php -y # Disable PHP CGI (the vulnerable interface) a2dismod cgi # Add security headers cat >> /etc/apache2/conf-available/security.conf << 'EOF' Header always set X-Frame-Options DENY Header always set X-Content-Type-Options nosniff Header always set X-XSS-Protection '1; mode=block' Header always set Content-Security-Policy "default-src 'self'" ServerTokens Prod ServerSignature Off EOF a2enmod headers # Force HTTPS redirect echo 'Redirect permanent / https://YOUR_DOMAIN/' >> /etc/apache2/sites-enabled/000-default.conf systemctl restart apache2 |
| RPCbind | 192.168.64.2:111 | RPCbind exposes NFS and other RPC services. Combined with NFS, allows mounting remote filesystems. | Block port 111 externally. Restrict NFS exports to specific trusted IPs. | # Block rpcbind from external access ufw deny 111/tcp ufw deny 111/udp # If NFS is not needed, disable it systemctl stop nfs-server rpcbind systemctl disable nfs-server rpcbind |
| NetBIOS/SMB | 192.168.64.2:139 | Samba 3.0.20 — CVE-2007-2447 (usermap_script) allows unauthenticated remote root command execution. | Upgrade Samba immediately. Disable SMBv1. Block ports 139/445 from external access. | # Upgrade Samba to patched version apt-get upgrade samba -y # Disable SMBv1 and restrict protocol cat >> /etc/samba/smb.conf << 'EOF' [global] min protocol = SMB2 smb encrypt = required restrict anonymous = 2 EOF systemctl restart smbd nmbd # Block from external access ufw deny 139/tcp ufw deny 445/tcp |
| SMB | 192.168.64.2:445 | Samba 3.0.20 (CVE-2007-2447). Also check MS17-010 EternalBlue if Windows target. | Upgrade Samba. Disable SMBv1. Block externally. | apt-get upgrade samba -y echo -e '[global]\nmin protocol = SMB2\nrestrict anonymous = 2' >> /etc/samba/smb.conf systemctl restart smbd ufw deny 445/tcp |
| rexec | 192.168.64.2:512 | R-services (rexec/rlogin/rsh) use trust-based authentication — trivially bypassable. No encryption. | Disable all R-services. Replace with SSH. | # Remove R-services completely apt-get remove --purge rsh-server rsh-client -y # Clear .rhosts and hosts.equiv trust files find / -name '.rhosts' -delete 2>/dev/null find / -name 'hosts.equiv' -delete 2>/dev/null ufw deny 512/tcp && ufw deny 513/tcp && ufw deny 514/tcp |
| rlogin | 192.168.64.2:513 | rlogin uses .rhosts trust files — no real authentication. Allows login without password. | Remove .rhosts files and disable rlogin service. | apt-get remove --purge rsh-server -y find / -name '.rhosts' -delete 2>/dev/null ufw deny 513/tcp |
| rsh | 192.168.64.2:514 | RSH allows command execution via trust files. Equivalent to unauthenticated remote shell. | Remove .rhosts, disable rsh, use SSH instead. | apt-get remove --purge rsh-server -y find / -name '.rhosts' -delete 2>/dev/null ufw deny 514/tcp |
| Java RMI | 192.168.64.2:1099 | Java RMI registry exposes remote method invocation — can lead to deserialization RCE. | Disable Java RMI if not needed. If required, restrict access via firewall to trusted hosts only. | # Block RMI from external access ufw deny 1099/tcp # In Java app, set -Djava.rmi.server.hostname=127.0.0.1 # Use Java Security Manager to restrict RMI |
| Bindshell (Ingreslock) | 192.168.64.2:1524 | Port 1524 is a root backdoor shell on Metasploitable 2 — anyone can connect and get root. | This is a deliberately placed backdoor. Kill the process and block the port immediately. | # Kill the bindshell process fuser -k 1524/tcp # Block the port ufw deny 1524/tcp # Check for other backdoors netstat -tlnp | grep -v 'sshd\|apache\|nginx\|mysql\|postgres' |
| NFS | 192.168.64.2:2049 | NFS exports may expose sensitive directories including /root, /home, /etc. No auth on NFSv3. | Restrict NFS exports to specific trusted IPs. Never export /root or /. Require Kerberos auth. | # Check what is exported cat /etc/exports # Restrict exports to specific IPs (replace 0.0.0.0 with actual trusted IP) # Edit /etc/exports: change *(rw) to 192.168.1.0/24(rw,no_root_squash) # Add no_root_squash removal and restrict: sed -i 's/\*/192.168.1.0\/24/g' /etc/exports sed -i 's/no_root_squash/root_squash/g' /etc/exports exportfs -ra # Block from external access ufw deny 2049/tcp && ufw deny 2049/udp |
| MySQL | 192.168.64.2:3306 | MySQL 5.0.51a — root account has no password. Remotely accessible. Risk of data theft and UDF exploitation. | Set strong root password, bind to localhost, remove anonymous users, disable remote root login. | # Set root password mysqladmin -u root password 'NEW_STRONG_PASSWORD' # Secure MySQL installation mysql -u root -pNEW_STRONG_PASSWORD << 'EOF' DELETE FROM mysql.user WHERE User=''; DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1'); DROP DATABASE IF EXISTS test; DELETE FROM mysql.db WHERE Db='test' OR Db='test\_%'; FLUSH PRIVILEGES; EOF # Bind MySQL to localhost only sed -i 's/bind-address.*/bind-address = 127.0.0.1/' /etc/mysql/mysql.conf.d/mysqld.cnf systemctl restart mysql ufw deny 3306/tcp |
| DistCC | 192.168.64.2:3632 | DistCC daemon allows arbitrary command execution as the daemon user (CVE-2004-2687). Trivial RCE. | Disable DistCC if not needed. If needed, restrict to trusted build hosts only. | # Stop and disable distccd systemctl stop distcc systemctl disable distcc apt-get remove distcc -y # Block port ufw deny 3632/tcp |
| PostgreSQL | 192.168.64.2:5432 | PostgreSQL 8.3 with default credentials (postgres/postgres). Remote access enabled. UDF exploitation possible. | Change default password, bind to localhost, restrict pg_hba.conf access. | # Change postgres password su - postgres -c "psql -c \"ALTER USER postgres PASSWORD 'NEW_STRONG_PASSWORD';\"" # Bind to localhost sed -i "s/#listen_addresses = 'localhost'/listen_addresses = 'localhost'/" /etc/postgresql/*/main/postgresql.conf sed -i "s/listen_addresses = '\*'/listen_addresses = 'localhost'/" /etc/postgresql/*/main/postgresql.conf # Restrict pg_hba.conf — replace 'trust' with 'md5' sed -i 's/host.*all.*all.*0.0.0.0\/0.*trust/# removed open access/' /etc/postgresql/*/main/pg_hba.conf systemctl restart postgresql ufw deny 5432/tcp |
| VNC | 192.168.64.2:5900 | VNC password is 'password' — trivial to guess. Remote desktop access to the system. | Set strong VNC password, restrict to localhost, use SSH tunneling for remote access. | # Set strong VNC password vncpasswd # Restrict VNC to localhost (use SSH tunnel to access remotely) # Edit VNC startup to bind to 127.0.0.1 only # In ~/.vnc/xstartup or vncserver config, add: -localhost # Block from external access ufw deny 5900/tcp ufw deny 5901/tcp |
| X11 | 192.168.64.2:6000 | X11 display is open — allows remote screenshot capture, keylogging, and GUI hijacking. | Disable X11 TCP access. Use SSH X11 forwarding instead. | # Disable X11 TCP connections echo 'DisallowTCP true' >> /etc/X11/xorg.conf.d/10-security.conf # Or start X with -nolisten tcp sed -i 's/DAEMON_OPTS="/DAEMON_OPTS="-nolisten tcp /' /etc/X11/xinit/xserverrc ufw deny 6000/tcp |
| IRC / UnrealIRCd | 192.168.64.2:6667 | UnrealIRCd 3.2.8.1 contains a backdoor (CVE-2010-2075) — sending 'AB' prefix gives instant root shell. | Remove UnrealIRCd immediately. Verify binary checksums if reinstalling. Block IRC ports. | # Remove backdoored UnrealIRCd systemctl stop unrealircd 2>/dev/null || true apt-get remove --purge unrealircd -y # Kill any remaining IRC processes pkill -f unrealircd # Block IRC ports ufw deny 6667/tcp ufw deny 6697/tcp # If IRC is legitimately needed, download a verified clean version # and verify its SHA256 checksum before deploying |
| AJP / Tomcat | 192.168.64.2:8009 | AJP connector exposed (Ghostcat CVE-2020-1938) — allows reading any file from webapp root. | Disable AJP connector or restrict to localhost. Upgrade Tomcat. | # Disable AJP in Tomcat server.xml sed -i 's/ # Or set requiredSecret and bind to localhost: # systemctl restart tomcat* ufw deny 8009/tcp |
| Tomcat HTTP | 192.168.64.2:8180 | Apache Tomcat 5.5 with default credentials (tomcat/tomcat). Manager webapp allows WAR file upload = RCE. | Change Tomcat credentials, restrict manager app to localhost, upgrade Tomcat. | # Change Tomcat credentials in tomcat-users.xml # Edit /etc/tomcat*/tomcat-users.xml and set strong password # Restrict manager to localhost in context.xml: # apt-get upgrade tomcat* -y systemctl restart tomcat* |
[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: <script>alert(1)</script>[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: <img src=x onerror=alert(1)>[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: <svg onload=alert(1)>[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: " onmouseover="alert(1)" x="[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=add-to-your-blog.php | Payload reflected: ' onmouseover='alert(1)' x='[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%3Cscript%3Ealert%281%29%3C%2Fscript%3E | Payload reflected: <script>alert(1)</script>[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E | Payload reflected: <img src=x onerror=alert(1)>[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%3Csvg%20onload%3Dalert%281%29%3E | Payload reflected: <svg onload=alert(1)>[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%22%20onmouseover%3D%22alert%281%29%22%20x%3D%22 | Payload reflected: " onmouseover="alert(1)" x="[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=dns-lookup.php&target_host=%27%20onmouseover%3D%27alert%281%29%27%20x%3D%27 | Payload reflected: ' onmouseover='alert(1)' x='[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&password=x | Payload reflected: <script>alert(1)</script>[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%3Cimg%20src%3Dx%20onerror%3Dalert%281%29%3E&password=x | Payload reflected: <img src=x onerror=alert(1)>[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%3Csvg%20onload%3Dalert%281%29%3E&password=x | Payload reflected: <svg onload=alert(1)>[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%22%20onmouseover%3D%22alert%281%29%22%20x%3D%22&password=x | Payload reflected: " onmouseover="alert(1)" x="[XSS REFLECTED] http://192.168.64.2:80/mutillidae/index.php?page=user-info.php&username=%27%20onmouseover%3D%27alert%281%29%27%20x%3D%27&password=x | Payload reflected: ' onmouseover='alert(1)' x='