# Box full of recon **URL:** \ **Category:** Career Paths\ **Created:** [August 3, 2024, 11:09am UTC](https://forums.cybrary.it/t/box-full-of-recon/231810 "2024-08-03T11:09:41Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Josip](https://forums.cybrary.it/user_avatar/forums.cybrary.it/josip/32/18098_2.png) [@Josip](https://forums.cybrary.it/u/Josip)\ **Post date:** [August 3, 2024, 11:09am UTC](https://forums.cybrary.it/t/box-full-of-recon/231810/1 "2024-08-03T11:09:41Z")
Hi Team, Has anyone done “Box full of recon” , I am not sure what is expected from 1st flag. I found and exploited 2nd and 3rd. The question is : What is the flag found during the initial scanning? And description is :Hint: The first flag will be a web-related vulnerability. I’ve enumerated service running on port 8081 as blackice-icecap ---
**Author:** ![MissingReptile8874](https://forums.cybrary.it/user_avatar/forums.cybrary.it/missingreptile8874/32/8017_2.png) [@MissingReptile8874](https://forums.cybrary.it/u/MissingReptile8874)\ **Post date:** [August 4, 2024, 8:49pm UTC](https://forums.cybrary.it/t/box-full-of-recon/231810/2 "2024-08-04T20:49:30Z")
![image](https://forums.cybrary.it/uploads/default/original/3X/b/3/b35cd16f5e6f7f6e9f0972a07c511eff41b20d62.png) I think we were meant to look for that first since these ports are open, but there is an smb server on the other subnet, and too, that was my thought. Metasploit isn’t really cracking the conditionals on it either. ---
**Author:** ![MissingReptile8874](https://forums.cybrary.it/user_avatar/forums.cybrary.it/missingreptile8874/32/8017_2.png) [@MissingReptile8874](https://forums.cybrary.it/u/MissingReptile8874)\ **Post date:** [August 4, 2024, 8:52pm UTC](https://forums.cybrary.it/t/box-full-of-recon/231810/3 "2024-08-04T20:52:10Z")
But that is my guess ---
**Author:** ![Josip](https://forums.cybrary.it/user_avatar/forums.cybrary.it/josip/32/18098_2.png) [@Josip](https://forums.cybrary.it/u/Josip)\ **Post date:** [August 5, 2024, 7:48am UTC](https://forums.cybrary.it/t/box-full-of-recon/231810/4 "2024-08-05T07:48:16Z")
Yeah enumerated all IP that are up with nmap -sV -A --script vuln and nothing fits the asked patter in question. The second flag was just nmap ftp brute force and 3rd one was metasploit. The first one was supported only to be name of vulnerability but I am completely lost. ---
**Author:** ![MissingReptile8874](https://forums.cybrary.it/user_avatar/forums.cybrary.it/missingreptile8874/32/8017_2.png) [@MissingReptile8874](https://forums.cybrary.it/u/MissingReptile8874)\ **Post date:** [August 8, 2024, 2:19pm UTC](https://forums.cybrary.it/t/box-full-of-recon/231810/5 "2024-08-08T14:19:09Z")
Yeah, I agree; I was going to go back to that one later today in Burbsuite on one of the addresses and check the cookies or dirb the website to see if it’s an HTTP attack is possible. ---
**Author:** ![MissingReptile8874](https://forums.cybrary.it/user_avatar/forums.cybrary.it/missingreptile8874/32/8017_2.png) [@MissingReptile8874](https://forums.cybrary.it/u/MissingReptile8874)\ **Post date:** [August 8, 2024, 2:59pm UTC](https://forums.cybrary.it/t/box-full-of-recon/231810/6 "2024-08-08T14:59:33Z")
Thinking about it, I haven’t been on just yet, but maybe Metasploit may need to be used; try Rejetto HTTP File Server exploit if it is opened. I just thought of that. But perhaps that was the missing key here. Not sure. But one idea I had, but as a thought. ---
**Author:** ![Josip](https://forums.cybrary.it/user_avatar/forums.cybrary.it/josip/32/18098_2.png) [@Josip](https://forums.cybrary.it/u/Josip)\ **Post date:** [August 8, 2024, 7:16pm UTC](https://forums.cybrary.it/t/box-full-of-recon/231810/7 "2024-08-08T19:16:41Z")
The issue is, in wording :during the initial scan, flag will be web-based vulnerability. ---
**Author:** ![CaptBoykin](https://forums.cybrary.it/user_avatar/forums.cybrary.it/captboykin/32/7498_2.png) [@CaptBoykin](https://forums.cybrary.it/u/CaptBoykin)\ **Post date:** [August 12, 2024, 2:28pm UTC](https://forums.cybrary.it/t/box-full-of-recon/231810/8 "2024-08-12T14:28:14Z")
Hi all… a series of fixes are inbound. Thank you for bringing these to our attention. For the first flag, nmap scanning will suffice. The word ‘vulnerability’ is perhaps a misnomer, however it’ll be painfully obvious from the scan output what the flag is.