[GhostlySam]

Alright well I know there are plenty of topics out there on this, but I wanted to go through the steps I am aware of from just reading and then tell you what I am stuck on and see if people can help, give suggestions, or comments toward it.

So pinging a website for IP... yeah. did that.

Next since you found the IP. You need to scan it. Well I tried a few different programs and ended up with the ZenMap or nmap for those who like to use that name more often.

Scan for vulnerabilities, and find which ones are valid and unprotected.

Get into website

Do whatever I want to do

Cover tracks.

I have gotten to the point of potentially finding vulnerabilities and I need help from there to understand a few things and what to look out for.

This is the output from what I scanned with nmap. What is some of the information that is useful to me more important? I figure I am looking for an open port, but I don't lnow what else.

Output:

Code

Initiating Parallel DNS resolution of 1 host. at 18:34
Completed Parallel DNS resolution of 1 host. at 18:34, 0.12s elapsed
Initiating SYN Stealth Scan at 18:34
Scanning www.r evo gaming.com (204.152.255.10) [1000 ports]
Discovered open port 53/tcp on 204.152.255.10
Completed SYN Stealth Scan at 18:34, 7.10s elapsed (1000 total ports)
Initiating Service scan at 18:34
Scanning 1 service on www.r evo gaming.com (204.152.255.10)
Completed Service scan at 18:34, 11.23s elapsed (1 service on 1 host)
Initiating OS detection (try #1) against www.r evo gaming.com (204.152.255.10)
Retrying OS detection (try #2) against www.r evo gaming.com (204.152.255.10)
Initiating Traceroute at 18:34
Completed Traceroute at 18:34, 3.02s elapsed
Initiating Parallel DNS resolution of 13 hosts. at 18:34
Completed Parallel DNS resolution of 13 hosts. at 18:34, 0.09s elapsed

NSE: Script scanning 204.152.255.10.
Initiating NSE at 18:34
Completed NSE at 18:34, 4.00s elapsed

Nmap scan report for www.r evo gaming.com (204.152.255.10)
Host is up (0.071s latency).
rDNS record for 204.152.255.10: cp10.hostable.com
Not shown: 998 filtered ports

PORT  STATE  SERVICE VERSION
53/tcp   open   domain
1723/tcp closed pptp

Aggressive OS guesses: Linux 2.6.9 (95%), Linux 2.6.9 - 2.6.27 (94%), Linux 2.6.11 (93%), Acorp W400G or W422G wireless ADSL modem (MontaVista embedded Linux 2.4.17) (92%), MontaVista embedded Linux 2.4.17 (92%), Riverbed Steelhead 200 proxy server (92%), Linux 2.6.28 (91%), Linux 2.6.30 (91%), Linux 2.6.9 (CentOS 4.4) (91%), Linux 2.6.23 (90%)

No exact OS matches for host (test conditions non-ideal).
Uptime guess: 3.224 days (since Tue Sep 06 13:11:47 2011)
Network Distance: 15 hops
TCP Sequence Prediction: Difficulty=193 (Good luck!)
IP ID Sequence Generation: All zeros

TRACEROUTE (using port 1723/tcp)
HOP RTT  ADDRESS
1   10.00 ms 10.0.0.1
2   58.00 ms cpe-76-187-96-1.tx.res.rr.com (76.187.96.1)
3   27.00 ms 70.125.216.161
4   26.00 ms 70.125.216.240
5   33.00 ms 70.125.216.88
6   30.00 ms gig2-0-2.hstntxl3-rtr1.texas.rr.com (72.179.205.50)
7   ... 8
9   29.00 ms 66.109.11.22
10  22.00 ms xe-0-1-0.cr2.dfw2.us.above.net (64.125.27.81)
11  23.00 ms xe-0-0-0.cr1.dfw2.us.above.net (64.125.30.73)
12  68.00 ms xe-2-1-0.cr1.iah1.us.above.net (64.125.30.57)
13  57.00 ms xe-1-1-0.mpr3.phx2.us.above.net (64.125.30.149)
14  69.00 ms 64.124.200.162.allocated.above.net (64.124.200.162)
15  79.00 ms cp10.hostable.com (204.152.255.10)

From that and my little knowledge of it. It has Linux server which is running potentially version 2.6.9. It said it was not conclusive so then I went to www.netcraft.com to double check and get more information. It has a closed port, so I moved on, and it has an open port 53 (53/tcp open domain), which I am not sure what to do with how to use that to see if I could access something.

Results:
http://toolbar.netcraft.com/site_report?...gaming.com

For those who don't want to click the link:

Code

Nameserver      ns1.hostable.com
DNS admin      [email protected]
Reverse DNS    cp10.hostable.com
Netblock owner    Brinkster Communications Corporation

and then this return from Apache:
Linux Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635.

So from what I get from all of that information and that I can possibly understand at this moment. 1 port open which is the host server? Possibly a way in through Apache.

What else is there that might be valuable I should look at for a possible way in?

**FYI - this is my friends website, I am doing this because he says he has a good amount of protection on his site (even though its a little gaming site), he does daily scans on the website with a automated virus scan program he coded.

You can see I have information on the website, found the IP, found an open port and possible other vulnerabilities within the website. I just don't know where to look from here or where to go, what imformation is important and what information is not. That is what I hope you all can help me with, because I am knew and don't know exactly what I should be looking for. :) Thanks. This will be my first project, which might take a while but I will learn a lot just from doing this one. It is more for educational purposes only for myself and protection of my sites, but thought I could mess with a few friends website in the process ✌

[v3xr]

Hmm, well if it IS linux 2.6.9, it's outdated, and there could definitely be some exploits floating around. I know for a fact that there are a bunch of local exploits, but idk about remote. If you could get a shell on the site then you could easily get r00t. Try getting a WVS and running some scans against it, like Acunetix.

[GhostlySam]

Great information! I do not know what a WVS is but I will look it up today sometime and see what I can do with it. :)

[ThatGoatherd]

You could look at the actual website hosted on the server too, to see if there are any vulnerabilities. Such as SQL injection, or if it is vulnerable to XSS.