London Zoo - #InfoLeak #PawSec #NullAllZoos

#PawSecWasHere
#Op4Pawz #UnCaged. #NullAllZoos
  _   _ _   _ _     _          _    _ _   _____
 | \ | | | | | |   | |        / \  | | | |__  /___   ___  ___
 |  \| | | | | |   | |       / _ \ | | |   / // _ \ / _ \/ __|
 | |\  | |_| | |___| |___   / ___ \| | |  / /| (_) | (_) \__ \
 |_|_\_|\___/|_____|_____|_/_/   \_\_|_| /____\___/ \___/|___/
  _| || |_| | | |_ __  / ___|__ _  __ _  ___  __| |
 |_  ..  _| | | | '_ \| |   / _` |/ _` |/ _ \/ _` |
 |_      _| |_| | | | | |__| (_| | (_| |  __/ (_| |
   |_||_|  \___/|_| |_|\____\__,_|\__, |\___|\__,_|
                               _.-"|___/  | "-._
                          _.-"|   |"  |   |   |  -._
                      _.-"|   |   |   |   |   |   |"-._
                  _.-"|   |   |   |   |   |   |   |   |"-._
             _.-"`|   |   |   |   |   |   |   |   |   |   |`"-._
         _.-" |   |   | __|.-~|~-.|   |_..|.__|   |   |   |   | "-._
        " |   |   |   |'  | ` |  \|~"~|   |   |`-.|   |   |   |   | "
          |   |   |  /| _ |   |)  |\  |   |   |   |\  |   |   |   |
          |   |   | /`| a)|   |   | | |   |   |   | `\|   |   |   |
          |   |   |:` |   |  /|   | | |   |   |   |   |   |   |   |
          |   |`-.||` |.-.| ( |   |/  |.  |   |   | `;|\  |   |   |
          |   |`-.|`--|_.'|.;\|__/|   |   |  .|   |  ||\\ |   |   |
          | _ |   |:--|   | | |   |  /|   |/  |   | .'| \\|   |   |
          |("\|  /|/  |   | | |   | ' |   |   |   | / |  :|;  |   |
          |`\'|_/`|   |   | .\|   |/`~|=-.|   |   |/  |  `|   |   |
          |  `|_.'|   |   | /`|   ||  |   |\  |   |(  |   |   |   |
          |   |   |   |   |/  |\  ||  |   | `Y|  /| \ |   |   |   |
          |   |   |   |   |  /| Y ||  |   |  || /`|  \|   |   |   |
          |   |   |   |  /| | | | ||  |   |  || | ||  |   |   |   |
          |   |   |   | "-|-" |/__||  |   | /_|_| |/__|   |   |   |
          |   |   |   |   |   |'""|   |   | '"|"  |"""|   |   |   |
        __|___|___|___|___|___|___|___|___|___|___|___|___|___|___|
###################################################################################
We'll only be releasing tad nits of information...and a few vuln details.
We'll keep the 0day to ourselves. :]
######################################################################################
Dumping Interesting/hidden files for the London Zoo...

Progress: 100% |||||||||||||||||||||||||||||||||||||||||||||||||||||||| Time: 00:05:59   4.88 B/s
[-] No HTTP/HTTPS provided. Assuming HTTP...
[-] Target: http://www.zsl.org
[I] Server: cloudflare-nginx
[L] X-Generator: Drupal 7 (http://drupal.org)
[L] Robots.txt Found: http://www.zsl.org/robots.txt
[I] CMS Detection: Drupal
[I] Drupal Version: 7.32
[M]  EDB-ID: 25493 Date: 2013-05-17 Verified: No  Title: CKEditor < 4.1 - Persistent XSS WYSIWYG module Drupal 6.x & 7.x
[I] Drupal Theme: zsl
[////////////////////////////////////////]
[I] http://www.zsl.org/README.txt
[I] http://www.zsl.org/INSTALL.mysql.txt
[I] http://www.zsl.org/MAINTAINERS.txt
[I] http://www.zsl.org/profiles/standard/translations/README.txt
[I] http://www.zsl.org/profiles/minimal/translations/README.txt
[I] http://www.zsl.org/INSTALL.pgsql.txt
[I] http://www.zsl.org/UPGRADE.txt
[I] http://www.zsl.org/CHANGELOG.txt
[I] http://www.zsl.org/INSTALL.sqlite.txt
[I] http://www.zsl.org/LICENSE.txt
[I] http://www.zsl.org/INSTALL.txt
[I] http://www.zsl.org/COPYRIGHT.txt
[I] http://www.zsl.org/web.config
[I] http://www.zsl.org/modules/README.txt
[I] http://www.zsl.org/modules/simpletest/files/README.txt
[I] http://www.zsl.org/modules/simpletest/files/javascript-1.txt
[I] http://www.zsl.org/modules/simpletest/files/php-1.txt
[I] http://www.zsl.org/modules/simpletest/files/sql-1.txt
[I] http://www.zsl.org/modules/simpletest/files/html-1.txt
[I] http://www.zsl.org/modules/simpletest/tests/common_test_info.txt
[I] http://www.zsl.org/modules/filter/tests/filter.url-output.txt
[I] http://www.zsl.org/modules/filter/tests/filter.url-input.txt
[I] http://www.zsl.org/modules/search/tests/UnicodeTest.txt
[I] http://www.zsl.org/themes/README.txt
[I] http://www.zsl.org/themes/stark/README.txt
[I] http://www.zsl.org/sites/README.txt
[I] http://www.zsl.org/sites/all/themes/README.txt
[I] http://www.zsl.org/modules/simpletest/files/html-2.html
[I] http://www.zsl.org/modules/color/preview.html
[I] http://www.zsl.org/themes/bartik/color/preview.html
[\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\]
[L] http://www.zsl.org/.bash_profile.txt
[L] http://www.zsl.org/.bashrc.txt
[L] http://www.zsl.org/.logs.txt
[L] http://www.zsl.org/.default.txt
[L] http://www.zsl.org/.db_config.txt
[L] http://www.zsl.org/.old.txt
[L] http://www.zsl.org/.secret.txt
[L] http://www.zsl.org/.queries.txt
[L] http://www.zsl.org/.private.txt
[L] http://www.zsl.org/.sql.txt
[L] http://www.zsl.org/.query.txt
[L] http://www.zsl.org/.temp.txt
[L] http://www.zsl.org/.temp2.txt
[L] http://www.zsl.org/.logs.php
[L] http://www.zsl.org/.bash_profile.php
[L] http://www.zsl.org/.default.php
[L] http://www.zsl.org/.db_config.php
[L] http://www.zsl.org/.bashrc.php
[L] http://www.zsl.org/.queries.php
[L] http://www.zsl.org/.private.php
[L] http://www.zsl.org/.secret.php
[L] http://www.zsl.org/.old.php
[L] http://www.zsl.org/.sql.php
[L] http://www.zsl.org/.query.php
[L] http://www.zsl.org/.temp2.php
[L] http://www.zsl.org/.temp.php
[L] http://www.zsl.org/install.php
[L] http://www.zsl.org/status.php
[L] http://www.zsl.org/.default/
[L] http://www.zsl.org/.db_config/
[L] http://www.zsl.org/.bash_profile/
[L] http://www.zsl.org/.bashrc/
[L] http://www.zsl.org/.logs/
[L] http://www.zsl.org/.query/
[L] http://www.zsl.org/.queries/
[L] http://www.zsl.org/.old/
[L] http://www.zsl.org/.private/
[L] http://www.zsl.org/.secret/
[L] http://www.zsl.org/.temp/
[L] http://www.zsl.org/.sql/
[L] http://www.zsl.org/.temp2/
[L] http://www.zsl.org/phpmyadmin/
[L] http://www.zsl.org/.bashrc.html
[L] http://www.zsl.org/.bash_profile.html
[L] http://www.zsl.org/.db_config.html
[L] http://www.zsl.org/.logs.html
[L] http://www.zsl.org/.default.html
[L] http://www.zsl.org/.old.html
[L] http://www.zsl.org/.queries.html
[L] http://www.zsl.org/.private.html
[L] http://www.zsl.org/.query.html
[L] http://www.zsl.org/.temp.html
[L] http://www.zsl.org/.sql.html
[L] http://www.zsl.org/.secret.html
[L] http://www.zsl.org/.temp2.html
[I] Forgotten Password Allows Username Enumeration: http://www.zsl.org/?q=user/password
[\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\]
-] Search Drupal Module ...
Progress: 100% |||||||||||||||||||||||||||||||||||||||||||||||||||||||| Time: 00:28:43   6.37 B/s
[-] Searching Vulnerable Plugins from ExploitDB website ...

[I] aggregator
[I] block
[I] blog
[I] book
[I] color
[I] comment
[I] contact
[I] contextual
[I] dashboard
[I] dblog
[I] field
[I] field_ui
[I] file
[I] filter
[I] forum
[I] help
[I] image
[I] locale
[I] menu
[I] node
[I] openid
[I] overlay
[I] path
[I] php
[I] poll
[I] profile
[I] rdf
[I] search
[I] shortcut
[I] simpletest
[I] statistics
[I] syslog
[I] system
[I] taxonomy
[I] toolbar
[I] tracker
[I] translation
[I] trigger
[I] update
[I] user
[//////////////////////////////////////]
Caging animal is NOT cute, it's cruel and inhumane.
Welcome to #UnCaged, where we target and expose and and all zoo's we come across.
#PawSec