IвЂ™ll add that to my /etc/hosts file, and start a subdomain brute force in the background, but it doesnвЂ™t find anything interesting. Trying to visit the interactive Swagger API docs typically found with Gitea (link at the bottom of the page) just loads an empty page: Under вЂњExploreвЂќ, in the вЂњUsersвЂќ tab, thereвЂ™s a single user, root: Without an account, thereвЂ™s not much to find. The bottom does has a Gitea version, 1.14.1, but I donвЂ™t find any vulnerabilities in this version that would have existed at Catches creation. ThereвЂ™s a custom Gitea instance on TCP 3000: рџЏЃ Press to use the Scan Management Menuв„ў рџ“– Wordlist в”‚ /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt IвЂ™ll run feroxbuster against the site, and include -x php since I know the site is feroxbuster -u -x php Guessing at the index page, it does return as index.php, which is a bit surprising as the page looks very static. The response headers donвЂ™t give much info at all. None of the links on the page lead anywhere, except for the вЂњDownload NowвЂќ button, which downloads catchv1.0.apk. The website on TCP 80 is for Catch Global Systems: Nmap done: 1 IP address (1 host up) scanned in 94.91 secondsД«ased on the OpenSSH and Apache (TCP 80) versions, the host is likely running Ubuntu 20.04 focal. Service Info: OS: Linux CPE: cpe:/o:linux:linux_kernelService detection performed. =NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)= If you know the service/version, please submit the following fingerprints at : |_http-server-header: Apache/2.4.29 (Ubuntu)Дў services unrecognized despite returning data. | DNSStatusRequestTCP, DNSVersionBindReqTCP, Help, RPCCheck, RTSPRequest, SMBProgNeg, ZendJavaBridge:ДЁ000/tcp open http Apache httpd 2.4.29 ((Ubuntu)) | Set-Cookie: _csrf=TqeCOMxg0eXNRMeRtlBTI5MB66E6MTY1NDk4MDE5NDk5MzE4MjQ4Mw | Set-Cookie: i_like_gitea=11f4bcc216e281a0 Path=/ HttpOnly

|_http-server-header: Apache/2.4.41 (Ubuntu)

Respawnables hack android root