⚡ Web Security Lab

external recon · nmap · nikto · searchsploit
root@kali:~$ target lab.maninejad.com
> authorized external reconnaissance against own AWS infrastructure
> simulating first-step attacker recon from outside the network
Methodology
nmap -sV -p- lab.maninejad.com
nikto -h https://lab.maninejad.com
searchsploit nginx 1.28
Findings

Minimal exposed attack surface

Full TCP port scan across all 65,535 ports returned only two open ports. All others filtered — confirms the AWS security group correctly restricts inbound access to only the intended web services.

PORT    STATE SERVICE  VERSION
80/tcp  open  http     nginx 1.28.3 (Ubuntu)
443/tcp open  ssl/http nginx 1.28.3 (Ubuntu)

Web server version disclosure

Both Nmap and Nikto independently confirmed the exact Nginx version is disclosed via the Server header, making CVE lookup easier for an attacker.

Server: nginx/1.28.3 (Ubuntu)
Remediation: add server_tokens off; inside the http {} block of nginx.conf, then reload Nginx.

TLS/SSL configuration

Nikto confirmed a strong cipher suite and a valid certificate. No weak or deprecated protocol versions flagged.

Ciphers: TLS_AES_256_GCM_SHA384
Issuer:  Let's Encrypt

No known applicable exploits

Searched Exploit-DB for the deployed Nginx version. All results manually reviewed: Ingress-NGINX entries are a different product (Kubernetes ingress controller); all version-specific Nginx exploits target releases predating 1.28.3; one local privilege-escalation entry reviewed and ruled not applicable.

General vulnerability scan — clean

Full Nikto scan against the live HTTPS endpoint completed with no additional findings beyond the version disclosure above. No outdated components, dangerous files, or misconfigurations detected.

Current status

External reconnaissance complete. One finding identified (version disclosure) with remediation documented. No exploitable vulnerabilities found against the current deployment.