server-status open to everyone
Apache’s server-status page lists every request in flight, query strings included. Find the config that exposes it, what it leaks, and the version banner it gives away.
Briefing
mod_status is useful for operators and usually restricted to localhost. With ExtendedStatus On it shows the full request line of every active connection, which includes tokens that applications put in URLs.
The intranet server sits behind a load balancer that is also reachable from the internet. Its Apache config is in /etc/apache2.
intranet-01 · Web config review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.