Teamwork – Team DaMa<\/strong><\/p>\n We are particularly interested in which hosts are available, what services they offer and additional information we can collect about potential targets (like OS types, versions, etc.).<\/p>\n Q1:<\/strong> A1: <\/strong> nmap -n -sn 10.0.1.0\/24 -oA host_discovery –min-rate=20000<\/p>\n cat hosts.txt cat hosts.txt | wc -l Q2: <\/strong> A2: <\/strong> Q3: <\/strong> A3 (updated): <\/strong> The system has the TRACE method enabled. The HTTP TRACE can be used for Cross Site Tracing (XST) attacks. It can also be combined with cross-domain browser vulnerabilities to read sensitive headerDescription<\/h2>\n
Questions to Answer<\/h2>\n
\nHow many systems did you identify? <\/p>\n
\nThe host discovery with the specific nmap command provides us eight active hosts.<\/p>\n\n
\n10.0.1.1
\n10.0.1.10
\n10.0.1.15
\n10.0.1.100
\n10.0.1.101
\n10.0.1.102
\n10.0.1.103
\n10.0.1.254 <\/p>\n
\n8 <\/p>\n<\/blockquote>\n
\nWhat seems to be the purpose of the individual hosts (as far as you can tell from the services they offer)? <\/p>\n
\nBased on the Service Discovery Scan we can identify the following most interesting systems\/services (details
\nfile: script_version_scan.gnmap): <\/p>\n\n
\nDid the scan already reveal vulnerabilities\/weaknesses? <\/p>\n
\nThe performed nmap scans creates three output files. Unfortunately not all three files contains the same output. the XML file provide more details as the gnmap and nmap files. The XML file contains now the
\nfollowing potentional vulnerability\/weakness on the Microsoft IIS Server (10.0.1.103). Part of scan result from host 10.0.1.103:<\/p>\n
\ninformation from third-party domains.<\/p>\n