Server-2: Vulnerable OnlyPhone— VulnerabilityWeb Walkthrough (4 Flags)

Server-2 is a deliberately vulnerable web application designed for practicing User-Agent bypass, directory listing enumeration, CVE assessment, and ROT13 decryption. It simulates an exclusive mobile platform with hidden admin panels, exposed internal notes, encrypted passwords, and multiple flags to find.

Repository: https://github.com/Enric-xX/Server-1

Live Server: https://enric-xx.github.io/Server-1/

Reconnaissance

Opening the website from a desktop browser immediately redirects us to /desktop.html with an error message: "Desktop Not Supported."

Inspecting the source code (Ctrl+U) reveals a comment mentioning a file called note.txt.

Navigating to /note.txt provides a list of valid iPhone User-Agents that the server accepts. We copy one of them.

Flag 1 — User-Agent Bypass

Since we're using Firefox, we go to about:config, search for general.useragent.override, select "String", click the + button, and paste the iPhone User-Agent we copied.

After reloading the main page, the mobile version appears with Flag 1 displayed.

Flag

flag{user_agent_bypass_success}

Flag 3 — CVE Vulnerability Assessment

On the main page, we click the "Vulnerability Scanner" button, which takes us to /CVE-VULN/. This tool displays the server software versions:

• Apache/2.4.41 (Ubuntu)
• PHP/7.2.18
• MySQL/5.7.34

We search on Google for CVEs affecting these versions. The correct CVEs are:

• CVE-2020–1927 (Apache mod_rewrite)
• CVE-2020–13950 (Apache mod_proxy_http)
• CVE-2019–11043 (PHP-FPM)
• CVE-2018–19518 (PHP IMAP)

We enter them one by one and click "Check Flag".

Flag

flag{cve_vulnerability_assessment}

Flag 2 — Directory Listing Discovery

Exploring common WordPress paths, we navigate to /wp-includes/ and discover that directory listing is enabled. Among the files, we spot internal-notes.txt.

Opening this file reveals internal developer notes, temporary credentials, and Flag 2.

Flag

flag{directory_listing_exposed}

Flag 4 — Shell Simulation + ROT13 Decryption

Navigating to /wp-admin/ shows a 403 Forbidden error. But inspecting the source code (Ctrl+U) reveals hidden paths:

• /wp-admin/shell/index.html
• /wp-admin/config/passwds.html

We first visit /wp-admin/config/passwds.html and find three users with ROT13-encrypted passwords:

root : BaylCubar2026! admin : nqzvav1289 www-data: jjj-qngn

We copy the root password and search "BaylCubar2026! ROT13" on Google. The decrypted result is OnlyPhone2026!.

Now we go to /wp-admin/shell/, type su root, and enter the decrypted password. Root access granted!

Flag

flag{shell_access_root}

Conclusion

Server-2 teaches four essential pentesting techniques:

1. User-Agent spoofing — Never trust the client
2. Directory listing — Always disable it in production
3. CVE research — Know your software versions
4. ROT13 decryption — Obfuscation is not encryption

All four flags found. Happy hacking!