Reconnaissance & Test Plan — 54.253.218.67:3000

Quick context / guesses

• Port 3000 commonly hosts Node/Express apps or Grafana.
• Expect a web UI or API endpoints (REST/GraphQL/WebSocket) influencing auth and discovery tactics.

Suggested phased plan (safe → intrusive)

Each phase lists purpose, commands, and expected findings. Risk labels: Low • Medium • High.

Passive reconnaissance Very low risk — safe to run

Purpose: identify tech, headers, public content, entry points.

curl -i http://54.253.218.67:3000/
whatweb -a 2 http://54.253.218.67:3000/

curl -s http://54.253.218.67:3000/robots.txt | sed -n '1,200p'
curl -s http://54.253.218.67:3000/favicon.ico -D - | sed -n '1,40p'

curl -s http://54.253.218.67:3000/ | sed -n '1,200p'

Expected findings: server banner, app fingerprint (Grafana, Express), public endpoints.

Targeted service & port check Low → Medium

Purpose: confirm service, version, and basic exposure.

sudo nmap -sV -p3000 -Pn -T3 -oN /tmp/nmap_3000.txt 54.253.218.67

sudo nmap -sS -T3 --top-ports 100 -oA /tmp/nmap_3000_top 54.253.218.67

Expected findings: product/version on 3000, other open ports.

Web application surface discovery Low (throttle)

Purpose: locate admin panels, APIs, uploads, backups.

gobuster dir -u http://54.253.218.67:3000/ \
  -w /usr/share/wordlists/dirb/common.txt -t 25 -o /tmp/gobuster_3000.txt

ffuf -u http://54.253.218.67:3000/FUZZ \
  -w /usr/share/wordlists/raft-small-words.txt -t 25 -o /tmp/ffuf_3000.json

Targets: /admin, /login, /dashboard, /api, /graphql, /metrics, /.env, backups.

Application fingerprint & auth checks Low → Medium

Purpose: detect dashboards, default creds, auth endpoints, CORS.

curl -s http://54.253.218.67:3000/login | sed -n '1,200p'
curl -s http://54.253.218.67:3000/dashboard | sed -n '1,200p'

curl -s -I -H "Origin: https://evil.com" http://54.253.218.67:3000/ | sed -n '1,200p'

curl -s -X OPTIONS http://54.253.218.67:3000/graphql -i

If Grafana is suspected, review /login and public dashboards. Default creds (admin/admin) only with explicit authorization.

Non-exploit vulnerability scans Medium

Purpose: detect common misconfigs and weak headers.

nikto -h http://54.253.218.67:3000 -output /tmp/nikto_3000.txt

whatweb -a 3 http://54.253.218.67:3000/

Deeper testing (intrusive) High — explicit permission only

Purpose: brute-force, SQLi/SSRF/XXE, and exploit attempts. These can be disruptive.

hydra -l admin -P passwdlist.txt \
  http-post-form "http://54.253.218.67:3000/login:username=^USER^&password=^PASS^:F=incorrect"

sqlmap -u "http://54.253.218.67:3000/path?param=1" --batch

Post-discovery (if credentials/admin are obtained)

• Inventory plugins, endpoints, files; look for .env, backups, SSTI.
• Consider authenticated scans (OWASP ZAP or Burp with session).

Service-specific checks — Grafana

• Probe /login, /api/health, /api/admin/settings.
• Anonymous dashboard access; list public dashboards.
• Default creds only if authorized.

Service-specific checks — Node/Express

• Look for /api/docs, /swagger.json, /openapi.json.
• File upload endpoints; size/content-type validation.
• WebSockets: ws://, /socket.io in HTML/JS.

Risk categorization

• Passive checks: curl/whatweb/robots (very low)
• Dir discovery (small): throttle, respect rate limits (low)
• nmap -sV single port: non-intrusive (low/medium)
• Nikto/automated scanners: may trigger WAF/IDS (medium)
• Bruteforce, SQLMap, large fuzz: noisy/disruptive (high)

Deliverables

• Short report: headers, tech stack, exposed endpoints, initial issues.
• Raw outputs saved on kali-local: /tmp/*.txt, /tmp/*.json.
• Prioritized remediation list.

Next steps

1. Provide written authorization for 54.253.218.67:3000 scope.
2. Pick a path:
   • Option 1: Run passive checks only (curl, whatweb, small gobuster). Low risk
   • Option 2: Add light nmap + nikto. Medium risk
   • Option 3: Hold execution; use this plan for internal ops. No activity