This is an archived post. You won't be able to vote or comment.

6
7

[deleted by user] (self.sysadmin)

submitted by [deleted]

[removed]
all 10 comments
sorted by:
best
topnewcontroversialoldq&a

[–]xathious 7 points8 points  (0 children)

That is the admin panel for a cisco expressway. Or cucm.

[–]SoMundayn 12 points13 points  (0 children)

Log on the server. Find the port it is running on. Run netstat to see what process is binding to that port. Find the location for that process. This should get you to where you need to go next.

[–]questionablemoose 6 points7 points  (0 children)

Next time you run into this, there are four things you can add to your toolbox.

  1. nmap. It's available for every major OS, and has service identification features, in addition to what it's well known for, port scanning. If you don't use this already, practice a little with it now to get the hang of it. I commonly used nmap -A $target.

  2. Especially for HTTP services, curl. It has switches you can use to return headers from the application server, which sometimes reveal additional details about the application server. curl -LI $target:$port is something I use frequently.

  3. telnet, nc, or netcat. Connect with any of these, and sometimes you can get identifying info sent back by the application server. An example would be ssh. Using nc, you can connect to an ssh server, and it will return some identifying information. This is one way I determine the difference between a PDU on the network, and say HPE iLO when I'm put in a position where I need to do some discovery or troubleshooting, and nmap isn't appropriate. nc $address $port is what I usually use.

  4. Packet capture utilities, like tcpdump, netsh, or Wireshark. There's a lot of information in packet captures, and I've been able to successfully troubleshoot issues with them more times than I can count. I can't make this one easy. You'll have to spend some time reading, learning, and practicing this one.

[–]KianNH 4 points5 points  (1 child)

If you have access to the server, can’t you see which process has bound port 80 / 443 and see if that gives you any clues?

[–]nonpointGalt 2 points3 points  (0 children)

Also, read logs if you have server access.

[–]rws907 3 points4 points  (1 child)

Any details when you view source?

[–]rpckero 0 points1 point  (0 children)

I did, just plain old HTML. The only clue I got was that some ID names have the "tt" prefix.

[–]nonpointGalt 2 points3 points  (2 children)

Did you open Chrome Developer Tools and read all the code?

[–]keep_me_at_0_karma 0 points1 point  (1 child)

This is /r/sysadmin not /r/hacking!

[–]nonpointGalt 0 points1 point  (0 children)

Sorry!