API tools faq
paste
JTSEC1333

Anonymous JTSEC #OpAmazonia Full Recon #14

JTSEC1333
Sep 5th, 2019
1,046
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 78.72 KB | None | 0 0
raw download clone embed print report
  1. #######################################################################################################################################
  2. =======================================================================================================================================
  3. Hostname www.aquidauana.ms.gov.br ISP Universo Online S.A.
  4. Continent South America Flag
  5. BR
  6. Country Brazil Country Code BR
  7. Region Unknown Local time
  8. City Unknown Postal Code Unknown
  9. IP Address 187.17.111.104 Latitude -22.831
  10. Longitude -43.219
  11. =======================================================================================================================================
  12. #######################################################################################################################################
  13. > www.aquidauana.ms.gov.br
  14. Server: 185.93.180.131
  15. Address: 185.93.180.131#53
  16.  
  17. Non-authoritative answer:
  18. Name: www.aquidauana.ms.gov.br
  19. Address: 187.17.111.104
  20. www.aquidauana.ms.gov.br canonical name = aquidauana.ms.gov.br.
  21. >
  22. #######################################################################################################################################
  23.  
  24. % Copyright (c) Nic.br
  25. % The use of the data below is only permitted as described in
  26. % full by the terms of use at https://registro.br/termo/en.html ,
  27. % being prohibited its distribution, commercialization or
  28. % reproduction, in particular, to use it for advertising or
  29. % any similar purpose.
  30. % 2019-09-05T09:04:20-03:00
  31.  
  32. domain: ms.gov.br
  33. owner: Governo do Estado de Mato Grosso do Sul
  34. ownerid: 15.412.257/0001-28
  35. responsible: Celso Tadashi Tanaka
  36. country: BR
  37. owner-c: CGA
  38. admin-c: CGA
  39. tech-c: CGA
  40. billing-c: CGA
  41. nserver: ns1.ms.gov.br 187.86.226.15
  42. nsstat: 20190903 AA
  43. nslastaa: 20190903
  44. nserver: ns2.ms.gov.br 187.86.225.2
  45. nsstat: 20190903 AA
  46. nslastaa: 20190903
  47. nserver: ns3.ms.gov.br 187.86.226.14
  48. nsstat: 20190903 AA
  49. nslastaa: 20190903
  50. created: before 19950101
  51. changed: 20190503
  52. status: published
  53.  
  54. nic-hdl-br: CGA
  55. person: Superintendência de Gestão da Informação
  56. e-mail: [email protected]
  57. country: BR
  58. created: 19971219
  59. changed: 20150422
  60.  
  61. % Security and mail abuse issues should also be addressed to
  62. % cert.br, http://www.cert.br/ , respectivelly to [email protected]
  63. % and [email protected]
  64. %
  65. % whois.registro.br accepts only direct match queries. Types
  66. % of queries are: domain (.br), registrant (tax ID), ticket,
  67. % provider, contact handle (ID), CIDR block, IP and ASN.
  68. #######################################################################################################################################
  69.  
  70. [+] Target : www.aquidauana.ms.gov.br
  71.  
  72. [+] IP Address : 187.17.111.104
  73.  
  74. [+] Headers :
  75.  
  76. [+] Date : Thu, 05 Sep 2019 12:07:42 GMT
  77. [+] Content-Type : text/html; charset=UTF-8
  78. [+] Transfer-Encoding : chunked
  79. [+] Connection : keep-alive
  80. [+] Server : Apache
  81. [+] X-App-Status : 1
  82. [+] X-Cache-Status : BYPASS
  83. [+] Content-Encoding : gzip
  84.  
  85. [+] SSL Certificate Information :
  86.  
  87. [+] commonName : *.sslblindado.com
  88. [+] countryName : US
  89. [+] organizationName : DigiCert Inc
  90. [+] organizationalUnitName : www.digicert.com
  91. [+] commonName : RapidSSL RSA CA 2018
  92. [+] Version : 3
  93. [+] Serial Number : 02D5AC449D6415E767D95EAC8B597391
  94. [+] Not Before : Dec 20 00:00:00 2018 GMT
  95. [+] Not After : Mar 20 12:00:00 2020 GMT
  96. [+] OCSP : ('http://status.rapidssl.com',)
  97. [+] subject Alt Name : (('DNS', '*.sslblindado.com'), ('DNS', 'sslblindado.com'))
  98. [+] CA Issuers : ('http://cacerts.rapidssl.com/RapidSSLRSACA2018.crt',)
  99. [+] CRL Distribution Points : ('http://cdp.rapidssl.com/RapidSSLRSACA2018.crl',)
  100.  
  101. [+] Whois Lookup :
  102.  
  103. [+] NIR : None
  104. [+] ASN Registry : lacnic
  105. [+] ASN : 7162
  106. [+] ASN CIDR : 187.17.111.0/24
  107. [+] ASN Country Code : BR
  108. [+] ASN Date : 2008-10-22
  109. [+] ASN Description : Universo Online S.A., BR
  110. [+] cidr : 187.17.64.0/18
  111. [+] name : None
  112. [+] handle : None
  113. [+] range : 187.17.64.0 - 187.17.127.255
  114. [+] description : Universo Online S.A.
  115. [+] country : BR
  116. [+] state : None
  117. [+] city : None
  118. [+] address : None
  119. [+] postal_code : None
  120. [+] emails : ['[email protected]', '[email protected]', '[email protected]', '[email protected]']
  121. [+] created : 20081022
  122. [+] updated : 20181106
  123.  
  124. [+] Crawling Target...
  125.  
  126. [+] Looking for robots.txt........[ Not Found ]
  127. [+] Looking for sitemap.xml.......[ Not Found ]
  128. [+] Extracting CSS Links..........[ 2 ]
  129. [+] Extracting Javascript Links...[ 5 ]
  130. [+] Extracting Internal Links.....[ 0 ]
  131. [+] Extracting External Links.....[ 10 ]
  132. [+] Extracting Images.............[ 35 ]
  133.  
  134. [+] Total Links Extracted : 52
  135.  
  136. [+] Dumping Links in /opt/FinalRecon/dumps/www.aquidauana.ms.gov.br.dump
  137. [+] Completed!
  138. #######################################################################################################################################
  139. [+] Starting At 2019-09-05 08:08:15.390203
  140. [+] Collecting Information On: http://www.aquidauana.ms.gov.br/
  141. [#] Status: 200
  142. --------------------------------------------------
  143. [#] Web Server Detected: Apache
  144. [!] X-Frame-Options Headers not detect! target might be vulnerable Click Jacking
  145. - Date: Thu, 05 Sep 2019 12:08:13 GMT
  146. - Content-Type: text/html; charset=UTF-8
  147. - Transfer-Encoding: chunked
  148. - Connection: keep-alive
  149. - Server: Apache
  150. - X-App-Status: 1
  151. - X-Cache-Status: BYPASS
  152. - Content-Encoding: gzip
  153. --------------------------------------------------
  154. [#] Finding Location..!
  155. [#] as: AS19089 UOL DIVEO S.A.
  156. [#] city: São Paulo
  157. [#] country: Brazil
  158. [#] countryCode: BR
  159. [#] isp: Universo Online S.A.
  160. [#] lat: -23.5505
  161. [#] lon: -46.6333
  162. [#] org: Universo Online S.A
  163. [#] query: 187.17.111.104
  164. [#] region: SP
  165. [#] regionName: Sao Paulo
  166. [#] status: success
  167. [#] timezone: America/Sao_Paulo
  168. [#] zip: 01000-000
  169. --------------------------------------------------
  170. [x] Didn't Detect WAF Presence on: http://www.aquidauana.ms.gov.br/
  171. --------------------------------------------------
  172. [#] Starting Reverse DNS
  173. [-] Failed ! Fail
  174. --------------------------------------------------
  175. [!] Scanning Open Port
  176. [#] 80/tcp open http
  177. [#] 443/tcp open https
  178. --------------------------------------------------
  179. [+] Collecting Information Disclosure!
  180. [#] Detecting sitemap.xml file
  181. [-] sitemap.xml file not Found!?
  182. [#] Detecting robots.txt file
  183. [-] robots.txt file not Found!?
  184. [#] Detecting GNU Mailman
  185. [-] GNU Mailman App Not Detected!?
  186. --------------------------------------------------
  187. [+] Crawling Url Parameter On: http://www.aquidauana.ms.gov.br/
  188. --------------------------------------------------
  189. [#] Searching Html Form !
  190. [-] No Html Form Found!?
  191. --------------------------------------------------
  192. [!] Found 5 dom parameter
  193. [#] http://www.aquidauana.ms.gov.br//#
  194. [#] http://www.aquidauana.ms.gov.br//#
  195. [#] http://www.aquidauana.ms.gov.br//#myCarousel
  196. [#] http://www.aquidauana.ms.gov.br//#myCarousel
  197. [#] http://portal.issqn.net/tecnosis/Portal.html#versao=33
  198. --------------------------------------------------
  199. [!] 63 Internal Dynamic Parameter Discovered
  200. [+] http://www.aquidauana.ms.gov.br//?p=inicio
  201. [+] http://www.aquidauana.ms.gov.br//?p=noticias
  202. [+] http://www.aquidauana.ms.gov.br//?p=galeria
  203. [+] http://www.aquidauana.ms.gov.br//?p=diario
  204. [+] http://www.aquidauana.ms.gov.br//?p=licitacoes
  205. [+] http://www.aquidauana.ms.gov.br//?p=edital
  206. [+] http://www.aquidauana.ms.gov.br//?p=ouvidoria
  207. [+] http://www.aquidauana.ms.gov.br//?p=cidade
  208. [+] http://www.aquidauana.ms.gov.br//?p=turismo
  209. [+] http://www.aquidauana.ms.gov.br//?p=inicio
  210. [+] http://www.aquidauana.ms.gov.br//?p=noticias
  211. [+] http://www.aquidauana.ms.gov.br//?p=licitacoes
  212. [+] http://www.aquidauana.ms.gov.br//?p=fornecedores
  213. [+] http://www.aquidauana.ms.gov.br//?p=cidade
  214. [+] http://www.aquidauana.ms.gov.br//?p=turismo
  215. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3600
  216. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3599
  217. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3598
  218. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3597
  219. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3596
  220. [+] http://www.aquidauana.ms.gov.br//?p=edital
  221. [+] http://www.aquidauana.ms.gov.br//?p=ouvidoria
  222. [+] http://www.aquidauana.ms.gov.br//?p=licitacoes
  223. [+] http://www.aquidauana.ms.gov.br//?p=edital
  224. [+] http://www.aquidauana.ms.gov.br//?p=convenios
  225. [+] http://www.aquidauana.ms.gov.br//?p=mapasindicadores
  226. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3600
  227. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3599
  228. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3598
  229. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3597
  230. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3596
  231. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3595
  232. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3594
  233. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3593
  234. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3591
  235. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3590
  236. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3589
  237. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3592
  238. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3588
  239. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3587
  240. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3586
  241. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3585
  242. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3584
  243. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3583
  244. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3582
  245. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3581
  246. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3580
  247. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3579
  248. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3578
  249. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3577
  250. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3576
  251. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3575
  252. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3574
  253. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3573
  254. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3570
  255. [+] http://www.aquidauana.ms.gov.br//index.php?p=noticia&id=3569
  256. [+] http://www.aquidauana.ms.gov.br//?p=vejagaleria&id=137
  257. [+] http://www.aquidauana.ms.gov.br//?p=vejagaleria&id=136
  258. [+] http://www.aquidauana.ms.gov.br//?p=vejagaleria&id=135
  259. [+] http://www.aquidauana.ms.gov.br//?p=vejagaleria&id=134
  260. [+] http://www.aquidauana.ms.gov.br//?p=vejagaleria&id=133
  261. [+] http://www.aquidauana.ms.gov.br//?p=vejagaleria&id=132
  262. [+] http://www.aquidauana.ms.gov.br//?p=galeria
  263. --------------------------------------------------
  264. [!] 2 External Dynamic Parameter Discovered
  265. [#] https://e-gov.betha.com.br/cidadaoweb3/resource.faces?params=d3kVrCvtx4EgxfliSeYneQ==
  266. [#] https://e-gov.betha.com.br/transparencia/01031-029/con_registropedidoinformacao.faces?mun=uLUwiW917a6O0aYIDgYKslyurM2ybcRn
  267. --------------------------------------------------
  268. [!] 12 Internal links Discovered
  269. [+] http://www.aquidauana.ms.gov.br//img/ico/favicon.png
  270. [+] http://www.aquidauana.ms.gov.br//css/bootstrap.css
  271. [+] http://www.aquidauana.ms.gov.br//css/style.css
  272. [+] http://www.aquidauana.ms.gov.br//mailto:[email protected]
  273. [+] http://www.aquidauana.ms.gov.br//edoem
  274. [+] http://aquidauana.ms.gov.br/anexos/vtn-2019-itr-oficio-n-102-2019.pdf
  275. [+] http://www.aquidauana.ms.gov.br///transparencia
  276. [+] http://aquidauana.ms.gov.br/edoem
  277. [+] http://aquidauana.ms.gov.br/anexos/01-ficha-de-inscricao.pdf
  278. [+] http://aquidauana.ms.gov.br/anexos/telefones.pdf
  279. [+] http://www.aquidauana.ms.gov.br//anexos/01-orientacao-para-cadastro-central-do-usuario-betha-minha-folha.pdf
  280. [+] http://webmail.aquidauana.ms.gov.br
  281. --------------------------------------------------
  282. [!] 6 External links Discovered
  283. [#] http://e-gov.betha.com.br/educaweb
  284. [#] http://aquidauana.gestorsea.com.br/
  285. [#] http://portal.issqn.net/tecnosis/Portal.html#versao=33
  286. [#] http://sistema.cadastrorural.com.br
  287. [#] http://minhafolha.cloud.betha.com.br
  288. [#] https://sistema.ouvidorias.gov.br/publico/MS/Aquidauana/Manifestacao/RegistrarManifestacao
  289. --------------------------------------------------
  290. [#] Mapping Subdomain..
  291. [!] Found 2 Subdomain
  292. - aquidauana.ms.gov.br
  293. - www.aquidauana.ms.gov.br
  294. --------------------------------------------------
  295. [!] Done At 2019-09-05 08:08:55.503456
  296. ######################################################################################################################################
  297. [i] Scanning Site: http://www.aquidauana.ms.gov.br
  298.  
  299.  
  300.  
  301. B A S I C I N F O
  302. ====================
  303.  
  304.  
  305. [+] Site Title: Prefeitura Municipal de Aquidauana
  306. [+] IP address: 187.17.111.104
  307. [+] Web Server: Apache
  308. [+] CMS: Could Not Detect
  309. [+] Cloudflare: Not Detected
  310. [+] Robots File: Could NOT Find robots.txt!
  311.  
  312.  
  313.  
  314.  
  315. W H O I S L O O K U P
  316. ========================
  317.  
  318.  
  319. % Copyright (c) Nic.br
  320. % The use of the data below is only permitted as described in
  321. % full by the terms of use at https://registro.br/termo/en.html ,
  322. % being prohibited its distribution, commercialization or
  323. % reproduction, in particular, to use it for advertising or
  324. % any similar purpose.
  325. % 2019-09-05T09:08:04-03:00
  326.  
  327. domain: ms.gov.br
  328. owner: Governo do Estado de Mato Grosso do Sul
  329. ownerid: 15.412.257/0001-28
  330. responsible: Celso Tadashi Tanaka
  331. country: BR
  332. owner-c: CGA
  333. admin-c: CGA
  334. tech-c: CGA
  335. billing-c: CGA
  336. nserver: ns1.ms.gov.br 187.86.226.15
  337. nsstat: 20190903 AA
  338. nslastaa: 20190903
  339. nserver: ns2.ms.gov.br 187.86.225.2
  340. nsstat: 20190903 AA
  341. nslastaa: 20190903
  342. nserver: ns3.ms.gov.br 187.86.226.14
  343. nsstat: 20190903 AA
  344. nslastaa: 20190903
  345. created: before 19950101
  346. changed: 20190503
  347. status: published
  348.  
  349. nic-hdl-br: CGA
  350. person: Superintendência de Gestão da Informação
  351. e-mail: [email protected]
  352. country: BR
  353. created: 19971219
  354. changed: 20150422
  355.  
  356. % Security and mail abuse issues should also be addressed to
  357. % cert.br, http://www.cert.br/ , respectivelly to [email protected]
  358. % and [email protected]
  359. %
  360. % whois.registro.br accepts only direct match queries. Types
  361. % of queries are: domain (.br), registrant (tax ID), ticket,
  362. % provider, contact handle (ID), CIDR block, IP and ASN.
  363.  
  364.  
  365.  
  366.  
  367. G E O I P L O O K U P
  368. =========================
  369.  
  370. [i] IP Address: 187.17.111.104
  371. [i] Country: Brazil
  372. [i] State:
  373. [i] City:
  374. [i] Latitude: -22.8305
  375. [i] Longitude: -43.2192
  376.  
  377.  
  378.  
  379.  
  380. H T T P H E A D E R S
  381. =======================
  382.  
  383.  
  384. [i] HTTP/1.1 200 OK
  385. [i] Date: Thu, 05 Sep 2019 12:08:06 GMT
  386. [i] Content-Type: text/html; charset=UTF-8
  387. [i] Connection: close
  388. [i] Server: Apache
  389. [i] X-App-Status: 1
  390. [i] X-Cache-Status: BYPASS
  391.  
  392.  
  393.  
  394.  
  395. D N S L O O K U P
  396. ===================
  397.  
  398. aquidauana.ms.gov.br. 299 IN SOA ns1.dominios.uol.com.br. admin.uolhost.com.br. 2018110505 43200 3600 604800 300
  399. aquidauana.ms.gov.br. 1799 IN MX 10 mx.uhserver.com.
  400. aquidauana.ms.gov.br. 1799 IN NS ns2.dominios.uol.com.br.
  401. aquidauana.ms.gov.br. 1799 IN A 187.17.111.104
  402. aquidauana.ms.gov.br. 1799 IN NS ns3.dominios.uol.com.br.
  403. aquidauana.ms.gov.br. 1799 IN NS ns1.dominios.uol.com.br.
  404. aquidauana.ms.gov.br. 1799 IN TXT "v=spf1 include:spf.whservidor.com ?all"
  405.  
  406.  
  407.  
  408.  
  409. S U B N E T C A L C U L A T I O N
  410. ====================================
  411.  
  412. Address = 187.17.111.104
  413. Network = 187.17.111.104 / 32
  414. Netmask = 255.255.255.255
  415. Broadcast = not needed on Point-to-Point links
  416. Wildcard Mask = 0.0.0.0
  417. Hosts Bits = 0
  418. Max. Hosts = 1 (2^0 - 0)
  419. Host Range = { 187.17.111.104 - 187.17.111.104 }
  420.  
  421.  
  422.  
  423. N M A P P O R T S C A N
  424. ============================
  425.  
  426. Starting Nmap 7.70 ( https://nmap.org ) at 2019-09-05 12:08 UTC
  427. Nmap scan report for aquidauana.ms.gov.br (187.17.111.104)
  428. Host is up (0.14s latency).
  429.  
  430. PORT STATE SERVICE
  431. 21/tcp filtered ftp
  432. 22/tcp filtered ssh
  433. 23/tcp filtered telnet
  434. 80/tcp open http
  435. 110/tcp filtered pop3
  436. 143/tcp filtered imap
  437. 443/tcp open https
  438. 3389/tcp filtered ms-wbt-server
  439.  
  440. Nmap done: 1 IP address (1 host up) scanned in 3.63 seconds
  441.  
  442.  
  443.  
  444. S U B - D O M A I N F I N D E R
  445. ==================================
  446.  
  447.  
  448. [i] Total Subdomains Found : 1
  449.  
  450. [+] Subdomain: www.aquidauana.ms.gov.br
  451. [-] IP: 187.17.111.104
  452.  
  453. #######################################################################################################################################
  454. [INFO] ------TARGET info------
  455. [*] TARGET: http://www.aquidauana.ms.gov.br/
  456. [*] TARGET IP: 187.17.111.104
  457. [INFO] NO load balancer detected for www.aquidauana.ms.gov.br...
  458. [*] DNS servers: aquidauana.ms.gov.br.
  459. [*] TARGET server: Apache
  460. [*] CC: BR
  461. [*] Country: Brazil
  462. [*] RegionCode: SP
  463. [*] RegionName: Sao Paulo
  464. [*] City: São Paulo
  465. [*] ASN: AS7162
  466. [*] BGP_PREFIX: 187.17.64.0/18
  467. [*] ISP: Universo Online S.A., BR
  468. [INFO] DNS enumeration:
  469. [*] ftp.aquidauana.ms.gov.br ftp.uhserver.com. 187.17.111.106
  470. [*] mail.aquidauana.ms.gov.br service.uhserver.com. service.uolhost.uol.com.br. 200.147.3.220
  471. [*] mobile.aquidauana.ms.gov.br mail.uhserver.com. mailpro.uol.com.br. 200.147.160.56
  472. [*] webmail.aquidauana.ms.gov.br mail.uhserver.com. mailpro.uol.com.br. 200.147.99.196
  473. [INFO] Possible abuse mails are:
  474. [*] [email protected]
  475. [*] [email protected]
  476. [*] [email protected]
  477. [*] [email protected]
  478. [*] [email protected]
  479. [*] [email protected]
  480. [INFO] NO PAC (Proxy Auto Configuration) file FOUND
  481. [INFO] Starting FUZZing in http://www.aquidauana.ms.gov.br/FUzZzZzZzZz...
  482. [INFO] Status code Folders
  483. [*] 200 http://www.aquidauana.ms.gov.br/index
  484. [ALERT] Look in the source code. It may contain passwords
  485. [INFO] Links found from http://www.aquidauana.ms.gov.br/ http://187.17.111.104/:
  486. [*] http://aquidauana.gestorsea.com.br/
  487. [*] http://aquidauana.ms.gov.br/anexos/telefones.pdf
  488. [*] http://aquidauana.ms.gov.br/anexos/vtn-2019-itr-oficio-n-102-2019.pdf
  489. [*] http://aquidauana.ms.gov.br/edoem
  490. [*] http://minhafolha.cloud.betha.com.br/
  491. [*] http://portal.issqn.net/tecnosis/Portal.html#versao=33
  492. [*] https://e-gov.betha.com.br/transparencia/01031-029/con_registropedidoinformacao.faces?mun=uLUwiW917a6O0aYIDgYKslyurM2ybcRn
  493. [*] http://sistema.cadastrorural.com.br/
  494. [*] https://painelhost.uol.com.br/myProducts.html
  495. [*] https://sistema.ouvidorias.gov.br/publico/MS/Aquidauana/Manifestacao/RegistrarManifestacao
  496. [*] http://webmail.aquidauana.ms.gov.br/
  497. [*] http://www.aquidauana.ms.gov.br/edoem
  498. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3569
  499. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3570
  500. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3573
  501. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3574
  502. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3575
  503. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3576
  504. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3577
  505. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3578
  506. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3579
  507. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3580
  508. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3581
  509. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3582
  510. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3583
  511. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3584
  512. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3585
  513. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3586
  514. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3587
  515. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3588
  516. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3589
  517. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3590
  518. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3591
  519. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3592
  520. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3593
  521. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3594
  522. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3595
  523. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3596
  524. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3597
  525. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3598
  526. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3599
  527. [*] http://www.aquidauana.ms.gov.br/index.php?p=noticia&id=3600
  528. [*] http://www.aquidauana.ms.gov.br/#myCarousel
  529. [*] http://www.aquidauana.ms.gov.br/?p=cidade
  530. [*] http://www.aquidauana.ms.gov.br/?p=convenios
  531. [*] http://www.aquidauana.ms.gov.br/?p=edital
  532. [*] http://www.aquidauana.ms.gov.br/?p=fornecedores
  533. [*] http://www.aquidauana.ms.gov.br/?p=galeria
  534. [*] http://www.aquidauana.ms.gov.br/?p=inicio
  535. [*] http://www.aquidauana.ms.gov.br/?p=licitacoes
  536. [*] http://www.aquidauana.ms.gov.br/?p=mapasindicadores
  537. [*] http://www.aquidauana.ms.gov.br/?p=noticias
  538. [*] http://www.aquidauana.ms.gov.br/?p=ouvidoria
  539. [*] http://www.aquidauana.ms.gov.br/?p=turismo
  540. [*] http://www.aquidauana.ms.gov.br/?p=vejagaleria&id=132
  541. [*] http://www.aquidauana.ms.gov.br/?p=vejagaleria&id=133
  542. [*] http://www.aquidauana.ms.gov.br/?p=vejagaleria&id=134
  543. [*] http://www.aquidauana.ms.gov.br/?p=vejagaleria&id=135
  544. [*] http://www.aquidauana.ms.gov.br/?p=vejagaleria&id=136
  545. [*] http://www.aquidauana.ms.gov.br/?p=vejagaleria&id=137
  546. [*] http://www.aquidauana.ms.gov.br/transparencia
  547. [INFO] GOOGLE has 3,690,000 results (0.23 seconds) about http://www.aquidauana.ms.gov.br/
  548. [INFO] BING shows 187.17.111.104 is shared with 374,000 hosts/vhosts
  549. [INFO] Shodan detected the following opened ports on 187.17.111.104:
  550. [*] 443
  551. [*] 80
  552. [INFO] ------VirusTotal SECTION------
  553. [INFO] VirusTotal passive DNS only stores address records. The following domains resolved to the given IP address:
  554. [INFO] Latest URLs hosted in this IP address detected by at least one URL scanner or malicious URL dataset:
  555. [INFO] Latest files that are not detected by any antivirus solution and were downloaded by VirusTotal from the IP address provided:
  556. [INFO] ------Alexa Rank SECTION------
  557. [INFO] Percent of Visitors Rank in Country:
  558. [INFO] Percent of Search Traffic:
  559. [INFO] Percent of Unique Visits:
  560. [INFO] Total Sites Linking In:
  561. [*] Total Sites
  562. [INFO] Useful links related to www.aquidauana.ms.gov.br - 187.17.111.104:
  563. [*] https://www.virustotal.com/pt/ip-address/187.17.111.104/information/
  564. [*] https://www.hybrid-analysis.com/search?host=187.17.111.104
  565. [*] https://www.shodan.io/host/187.17.111.104
  566. [*] https://www.senderbase.org/lookup/?search_string=187.17.111.104
  567. [*] https://www.alienvault.com/open-threat-exchange/ip/187.17.111.104
  568. [*] http://pastebin.com/search?q=187.17.111.104
  569. [*] http://urlquery.net/search.php?q=187.17.111.104
  570. [*] http://www.alexa.com/siteinfo/www.aquidauana.ms.gov.br
  571. [*] http://www.google.com/safebrowsing/diagnostic?site=www.aquidauana.ms.gov.br
  572. [*] https://censys.io/ipv4/187.17.111.104
  573. [*] https://www.abuseipdb.com/check/187.17.111.104
  574. [*] https://urlscan.io/search/#187.17.111.104
  575. [*] https://github.com/search?q=187.17.111.104&type=Code
  576. [INFO] Useful links related to AS7162 - 187.17.64.0/18:
  577. [*] http://www.google.com/safebrowsing/diagnostic?site=AS:7162
  578. [*] https://www.senderbase.org/lookup/?search_string=187.17.64.0/18
  579. [*] http://bgp.he.net/AS7162
  580. [*] https://stat.ripe.net/AS7162
  581. [INFO] Date: 05/09/19 | Time: 08:10:08
  582. [INFO] Total time: 1 minute(s) and 47 second(s)
  583. #######################################################################################################################################
  584. Trying "aquidauana.ms.gov.br"
  585. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54599
  586. ;; flags: qr rd ra; QUERY: 1, ANSWER: 7, AUTHORITY: 3, ADDITIONAL: 0
  587.  
  588. ;; QUESTION SECTION:
  589. ;aquidauana.ms.gov.br. IN ANY
  590.  
  591. ;; ANSWER SECTION:
  592. aquidauana.ms.gov.br. 1800 IN A 187.17.111.104
  593. aquidauana.ms.gov.br. 1800 IN MX 10 mx.uhserver.com.
  594. aquidauana.ms.gov.br. 300 IN SOA ns1.dominios.uol.com.br. admin.uolhost.com.br. 2018110505 43200 3600 604800 300
  595. aquidauana.ms.gov.br. 1800 IN TXT "v=spf1 include:spf.whservidor.com ?all"
  596. aquidauana.ms.gov.br. 1800 IN NS ns3.dominios.uol.com.br.
  597. aquidauana.ms.gov.br. 1800 IN NS ns2.dominios.uol.com.br.
  598. aquidauana.ms.gov.br. 1800 IN NS ns1.dominios.uol.com.br.
  599.  
  600. ;; AUTHORITY SECTION:
  601. aquidauana.ms.gov.br. 1800 IN NS ns2.dominios.uol.com.br.
  602. aquidauana.ms.gov.br. 1800 IN NS ns1.dominios.uol.com.br.
  603. aquidauana.ms.gov.br. 1800 IN NS ns3.dominios.uol.com.br.
  604.  
  605. Received 299 bytes from 2001:18c0:121:6900:724f:b8ff:fefd:5b6a#53 in 641 ms
  606. #######################################################################################################################################
  607. ; <<>> DiG 9.11.5-P4-5.1+b1-Debian <<>> +trace aquidauana.ms.gov.br
  608. ;; global options: +cmd
  609. . 85916 IN NS l.root-servers.net.
  610. . 85916 IN NS e.root-servers.net.
  611. . 85916 IN NS d.root-servers.net.
  612. . 85916 IN NS k.root-servers.net.
  613. . 85916 IN NS i.root-servers.net.
  614. . 85916 IN NS h.root-servers.net.
  615. . 85916 IN NS j.root-servers.net.
  616. . 85916 IN NS m.root-servers.net.
  617. . 85916 IN NS b.root-servers.net.
  618. . 85916 IN NS f.root-servers.net.
  619. . 85916 IN NS g.root-servers.net.
  620. . 85916 IN NS c.root-servers.net.
  621. . 85916 IN NS a.root-servers.net.
  622. . 85916 IN RRSIG NS 8 0 518400 20190918050000 20190905040000 59944 . aiwwWWlHRaLYgoEqKvjhGLMhgtIGs7nkm/FMbx+2v/K6fx1dK6ofo/up T984AiZMFS8vbJykqQhFBSne/5nnth6CdNO+Rbbb3c3ZjRiCKTWF4gm1 QAKgdBjKgpEYDsQHLZZgofHTmUvNulOFBJiq3b9I73DvgkemOjY/yWC5 IztF75tMqPHq9FBWAmgj/a7S5JrKE+FiC5CPqb538w9X8lq0ZT2Mm82i pRgm9LFrdP/CUZYsDPAIK0/PZiEmXjMKg6hZuVsOAhz3NZgLwIyVxoLS 0RmfBRbwpaWkP9k+U42vbvdqvreEE2bDAEaxF4onLxDr2U1ntOQHE1W/ eFXCxw==
  623. ;; Received 525 bytes from 185.93.180.131#53(185.93.180.131) in 197 ms
  624.  
  625. br. 172800 IN NS a.dns.br.
  626. br. 172800 IN NS b.dns.br.
  627. br. 172800 IN NS c.dns.br.
  628. br. 172800 IN NS d.dns.br.
  629. br. 172800 IN NS e.dns.br.
  630. br. 172800 IN NS f.dns.br.
  631. br. 86400 IN DS 2471 13 2 5E4F35998B8F909557FA119C4CBFDCA2D660A26F069EF006B403758A 07D1A2E4
  632. br. 86400 IN RRSIG DS 8 1 86400 20190918050000 20190905040000 59944 . W+7bFcruhklKL/3NrZdZhP2JZ+L9UjIR/grARWysNFDbQquDdMYJQWyX /2dlDX52Hveph2uwoDuf7tK3O3VVrXSIpmIXmAPUBrgFJo3ExChX6dav qtwFjH5Lj82AmrYXrY/NClTpvusX6WmMEbx0IbAxUZWijfuQKVYDeWCi ++eAFedoE+ZtpRDez5slefRKsjYJ4Zd28Un2iipytxFKVFnYVwSjCRSa /X87aa8WCUioP2trh02xdeVGiwAqlvFmuA3rR6W8vcGajk6NstgArEnx oLu4IWt4gDV8fZFX2k/yqBO9JJ5pOw1ETRzLAfcTJPLLlmAY2yfH4+7K TAX2uQ==
  633. ;; Received 748 bytes from 192.5.5.241#53(f.root-servers.net) in 106 ms
  634.  
  635. ms.gov.br. 3600 IN NS ns1.ms.gov.br.
  636. ms.gov.br. 3600 IN NS ns2.ms.gov.br.
  637. ms.gov.br. 3600 IN NS ns3.ms.gov.br.
  638. ms.gov.br. 900 IN NSEC msp.gov.br. NS RRSIG NSEC
  639. ms.gov.br. 900 IN RRSIG NSEC 13 3 900 20190914121007 20190831111007 50774 gov.br. Lyckv/xnoR92xx3WO1XNYmnk9mUO3aebTGq+D/mQGwt5lIIbve+BmbFV 0IwH2W3wvhSMX7wpEzYBmdzm+XWotQ==
  640. ;; Received 285 bytes from 2001:12f8:a::10#53(c.dns.br) in 179 ms
  641.  
  642. aquidauana.ms.gov.br. 3600 IN NS ns1.dominios.uol.com.br.
  643. aquidauana.ms.gov.br. 3600 IN NS ns2.dominios.uol.com.br.
  644. ;; Received 102 bytes from 187.86.226.14#53(ns3.ms.gov.br) in 330 ms
  645.  
  646. aquidauana.ms.gov.br. 1800 IN A 187.17.111.104
  647. ;; Received 54 bytes from 200.98.199.199#53(ns1.dominios.uol.com.br) in 480 ms
  648. #######################################################################################################################################
  649. [*] Performing General Enumeration of Domain: aquidauana.ms.gov.br
  650. [-] DNSSEC is not configured for aquidauana.ms.gov.br
  651. [*] SOA ns1.dominios.uol.com.br 200.98.199.199
  652. [*] NS ns1.dominios.uol.com.br 200.98.199.199
  653. [*] NS ns2.dominios.uol.com.br 200.221.65.6
  654. [*] MX mx.uhserver.com 200.147.36.29
  655. [*] A aquidauana.ms.gov.br 187.17.111.104
  656. [*] TXT aquidauana.ms.gov.br v=spf1 include:spf.whservidor.com ?all
  657. [*] Enumerating SRV Records
  658. [*] SRV _smtp._tcp.aquidauana.ms.gov.br smtp.aquidauana.ms.gov.br 200.147.36.31 587 0
  659. [*] SRV _submission._tcp.aquidauana.ms.gov.br smtp.aquidauana.ms.gov.br 200.147.36.31 587 0
  660. [*] SRV _imap._tcp.aquidauana.ms.gov.br imap.aquidauana.ms.gov.br 200.147.41.245 143 0
  661. [*] SRV _pop3._tcp.aquidauana.ms.gov.br pop3.aquidauana.ms.gov.br 200.147.41.245 110 0
  662. [*] SRV _autodiscover._tcp.aquidauana.ms.gov.br autodiscover.uol.com.br 143.204.229.112 443 0
  663. [*] SRV _autodiscover._tcp.aquidauana.ms.gov.br autodiscover.uol.com.br 143.204.229.10 443 0
  664. [*] SRV _autodiscover._tcp.aquidauana.ms.gov.br autodiscover.uol.com.br 143.204.229.56 443 0
  665. [*] SRV _autodiscover._tcp.aquidauana.ms.gov.br autodiscover.uol.com.br 143.204.229.50 443 0
  666. [+] 8 Records Found
  667. #######################################################################################################################################
  668. [*] Processing domain aquidauana.ms.gov.br
  669. [*] Using system resolvers ['185.93.180.131', '194.187.251.67', '38.132.106.139', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  670. [+] Getting nameservers
  671. 200.98.199.199 - ns1.dominios.uol.com.br
  672. 200.221.65.6 - ns2.dominios.uol.com.br
  673. [-] Zone transfer failed
  674.  
  675. [+] TXT records found
  676. "v=spf1 include:spf.whservidor.com ?all"
  677.  
  678. [+] MX records found, added to target list
  679. 10 mx.uhserver.com.
  680.  
  681. [*] Scanning aquidauana.ms.gov.br for A records
  682. 187.17.111.104 - aquidauana.ms.gov.br
  683. 187.17.111.106 - ftp.aquidauana.ms.gov.br
  684. 200.147.41.245 - imap.aquidauana.ms.gov.br
  685. 200.147.41.245 - mail.aquidauana.ms.gov.br
  686. 200.147.160.56 - mobile.aquidauana.ms.gov.br
  687. 200.147.160.56 - pda.aquidauana.ms.gov.br
  688. 200.147.41.245 - pop3.aquidauana.ms.gov.br
  689. 200.147.41.245 - pop.aquidauana.ms.gov.br
  690. 200.147.36.31 - smtp.aquidauana.ms.gov.br
  691. 187.17.111.107 - ssh.aquidauana.ms.gov.br
  692. 187.17.111.104 - wap.aquidauana.ms.gov.br
  693. 200.147.160.56 - webmail.aquidauana.ms.gov.br
  694. 187.17.111.104 - www.aquidauana.ms.gov.br
  695. #######################################################################################################################################
  696.  
  697.  
  698. AVAILABLE PLUGINS
  699. -----------------
  700.  
  701. CompressionPlugin
  702. CertificateInfoPlugin
  703. RobotPlugin
  704. OpenSslCipherSuitesPlugin
  705. HeartbleedPlugin
  706. FallbackScsvPlugin
  707. SessionResumptionPlugin
  708. SessionRenegotiationPlugin
  709. EarlyDataPlugin
  710. OpenSslCcsInjectionPlugin
  711. HttpHeadersPlugin
  712.  
  713.  
  714.  
  715. CHECKING HOST(S) AVAILABILITY
  716. -----------------------------
  717.  
  718. 187.17.111.104:443 => 187.17.111.104
  719.  
  720.  
  721.  
  722.  
  723. SCAN RESULTS FOR 187.17.111.104:443 - 187.17.111.104
  724. ----------------------------------------------------
  725.  
  726. * TLSV1_3 Cipher Suites:
  727. Server rejected all cipher suites.
  728.  
  729. * Certificate Information:
  730. Content
  731. SHA1 Fingerprint: b755f383b9141f79d1cbdcfd5f699283576e10af
  732. Common Name: *.sslblindado.com
  733. Issuer: RapidSSL RSA CA 2018
  734. Serial Number: 3767909233114771650262261474629612433
  735. Not Before: 2018-12-20 00:00:00
  736. Not After: 2020-03-20 12:00:00
  737. Signature Algorithm: sha256
  738. Public Key Algorithm: RSA
  739. Key Size: 2048
  740. Exponent: 65537 (0x10001)
  741. DNS Subject Alternative Names: ['*.sslblindado.com', 'sslblindado.com']
  742.  
  743. Trust
  744. Hostname Validation: FAILED - Certificate does NOT match 187.17.111.104
  745. Android CA Store (9.0.0_r9): OK - Certificate is trusted
  746. Apple CA Store (iOS 12, macOS 10.14, watchOS 5, and tvOS 12):OK - Certificate is trusted
  747. Java CA Store (jdk-12.0.1): OK - Certificate is trusted
  748. Mozilla CA Store (2019-03-14): OK - Certificate is trusted
  749. Windows CA Store (2019-05-27): OK - Certificate is trusted
  750. Symantec 2018 Deprecation: WARNING: Certificate distrusted by Google and Mozilla on September 2018
  751. Received Chain: *.sslblindado.com --> RapidSSL RSA CA 2018
  752. Verified Chain: *.sslblindado.com --> RapidSSL RSA CA 2018 --> DigiCert Global Root CA
  753. Received Chain Contains Anchor: OK - Anchor certificate not sent
  754. Received Chain Order: OK - Order is valid
  755. Verified Chain contains SHA1: OK - No SHA1-signed certificate in the verified certificate chain
  756.  
  757. Extensions
  758. OCSP Must-Staple: NOT SUPPORTED - Extension not found
  759. Certificate Transparency: OK - 3 SCTs included
  760.  
  761. OCSP Stapling
  762. NOT SUPPORTED - Server did not send back an OCSP response
  763.  
  764. * Deflate Compression:
  765. OK - Compression disabled
  766.  
  767. * TLSV1_1 Cipher Suites:
  768. Forward Secrecy INSECURE - Not Supported
  769. RC4 OK - Not Supported
  770.  
  771. Preferred:
  772. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 404 Not Found
  773. Accepted:
  774. TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 404 Not Found
  775. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 404 Not Found
  776.  
  777. * TLSV1_2 Cipher Suites:
  778. Forward Secrecy OK - Supported
  779. RC4 OK - Not Supported
  780.  
  781. Preferred:
  782. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 404 Not Found
  783. Accepted:
  784. TLS_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 404 Not Found
  785. TLS_RSA_WITH_AES_256_CBC_SHA256 256 bits HTTP 404 Not Found
  786. TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 404 Not Found
  787. TLS_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 404 Not Found
  788. TLS_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 404 Not Found
  789. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 404 Not Found
  790. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 404 Not Found
  791. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 256 bits HTTP 404 Not Found
  792. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 404 Not Found
  793. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 404 Not Found
  794.  
  795. * OpenSSL Heartbleed:
  796. OK - Not vulnerable to Heartbleed
  797.  
  798. * Downgrade Attacks:
  799. TLS_FALLBACK_SCSV: OK - Supported
  800.  
  801. * ROBOT Attack:
  802. OK - Not vulnerable
  803.  
  804. * TLS 1.2 Session Resumption Support:
  805. With Session IDs: NOT SUPPORTED (0 successful, 5 failed, 0 errors, 5 total attempts).
  806. With TLS Tickets: NOT SUPPORTED - TLS ticket assigned but not accepted.
  807.  
  808. * Session Renegotiation:
  809. Client-initiated Renegotiation: OK - Rejected
  810. Secure Renegotiation: OK - Supported
  811.  
  812. * OpenSSL CCS Injection:
  813. OK - Not vulnerable to OpenSSL CCS injection
  814.  
  815. * TLSV1 Cipher Suites:
  816. Forward Secrecy INSECURE - Not Supported
  817. RC4 OK - Not Supported
  818.  
  819. Preferred:
  820. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 404 Not Found
  821. Accepted:
  822. TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 404 Not Found
  823. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 404 Not Found
  824.  
  825. * SSLV3 Cipher Suites:
  826. Server rejected all cipher suites.
  827.  
  828. * SSLV2 Cipher Suites:
  829. Server rejected all cipher suites.
  830.  
  831.  
  832. SCAN COMPLETED IN 38.36 S
  833. -------------------------
  834. #######################################################################################################################################
  835. Domains still to check: 1
  836. Checking if the hostname aquidauana.ms.gov.br. given is in fact a domain...
  837.  
  838. Analyzing domain: aquidauana.ms.gov.br.
  839. Checking NameServers using system default resolver...
  840. IP: 200.98.199.199 (Brazil)
  841. HostName: ns1.dominios.uol.com.br Type: NS
  842. HostName: ns1.dominios.uol.com.br Type: PTR
  843. IP: 200.221.65.6 (Brazil)
  844. HostName: ns2.dominios.uol.com.br Type: NS
  845. HostName: ns2.dominios.uol.com.br Type: PTR
  846.  
  847. Checking MailServers using system default resolver...
  848. IP: 200.147.36.29 (Brazil)
  849. HostName: mx.uhserver.com Type: MX
  850. HostName: mx.uhserver.com Type: PTR
  851.  
  852. Checking the zone transfer for each NS... (if this takes more than 10 seconds, just hit CTRL-C and it will continue. Bug in the libs)
  853. No zone transfer found on nameserver 200.221.65.6
  854. No zone transfer found on nameserver 200.98.199.199
  855.  
  856. Checking SPF record...
  857.  
  858. Checking SPF record...
  859. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 187.17.102.0/24, but only the network IP
  860. New IP found: 187.17.102.0
  861. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 189.38.62.128/25, but only the network IP
  862. New IP found: 189.38.62.128
  863. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 200.98.196.0/23, but only the network IP
  864. New IP found: 200.98.196.0
  865. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 200.98.199.0/24, but only the network IP
  866. New IP found: 200.98.199.0
  867. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 200.147.1.8/29, but only the network IP
  868. New IP found: 200.147.1.8
  869. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 200.147.14.0/20, but only the network IP
  870. New IP found: 200.147.14.0
  871. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 200.147.32.0/22, but only the network IP
  872. New IP found: 200.147.32.0
  873. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 200.147.40.0/23, but only the network IP
  874. New IP found: 200.147.40.0
  875. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 187.17.109.0/24, but only the network IP
  876. New IP found: 187.17.109.0
  877. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 187.17.106.0/24, but only the network IP
  878. New IP found: 187.17.106.0
  879.  
  880. Checking SPF record...
  881. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 187.61.39.0/28, but only the network IP
  882. New IP found: 187.61.39.0
  883. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 187.61.40.0/24, but only the network IP
  884. New IP found: 187.61.40.0
  885. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 187.61.41.0/28, but only the network IP
  886. New IP found: 187.61.41.0
  887. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 187.61.42.0/28, but only the network IP
  888. New IP found: 187.61.42.0
  889. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 186.234.238.0/24, but only the network IP
  890. New IP found: 186.234.238.0
  891. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 187.17.109.0/24, but only the network IP
  892. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 187.17.106.0/24, but only the network IP
  893. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 200.147.99.24/29, but only the network IP
  894. New IP found: 200.147.99.24
  895.  
  896. Checking 192 most common hostnames using system default resolver...
  897. IP: 187.17.111.104 (Brazil)
  898. HostName: www.aquidauana.ms.gov.br. Type: A
  899. IP: 187.17.111.106 (Brazil)
  900. HostName: ftp.aquidauana.ms.gov.br. Type: A
  901. IP: 200.147.3.220 (Brazil)
  902. HostName: mail.aquidauana.ms.gov.br. Type: A
  903. IP: 200.147.99.196 (Brazil)
  904. HostName: webmail.aquidauana.ms.gov.br. Type: A
  905. IP: 200.147.36.31 (Brazil)
  906. HostName: smtp.aquidauana.ms.gov.br. Type: A
  907. IP: 200.147.3.220 (Brazil)
  908. HostName: mail.aquidauana.ms.gov.br. Type: A
  909. HostName: pop.aquidauana.ms.gov.br. Type: A
  910. HostName: 200-147-3-220-220.static.uol.com.br Type: PTR
  911. IP: 200.147.41.245 (Brazil)
  912. HostName: imap.aquidauana.ms.gov.br. Type: A
  913. IP: 187.17.111.107 (Brazil)
  914. HostName: ssh.aquidauana.ms.gov.br. Type: A
  915. IP: 200.147.41.245 (Brazil)
  916. HostName: imap.aquidauana.ms.gov.br. Type: A
  917. HostName: pop3.aquidauana.ms.gov.br. Type: A
  918. HostName: 200-147-41-245.static.uol.com.br Type: PTR
  919.  
  920. Checking with nmap the reverse DNS hostnames of every <ip>/24 netblock using system default resolver...
  921. Checking netblock 187.61.39.0
  922. Checking netblock 187.17.102.0
  923. Checking netblock 200.147.1.0
  924. Checking netblock 187.17.106.0
  925. Checking netblock 187.61.40.0
  926. Checking netblock 200.147.99.0
  927. Checking netblock 200.221.65.0
  928. Checking netblock 200.98.199.0
  929. Checking netblock 187.17.109.0
  930. Checking netblock 200.147.36.0
  931. Checking netblock 187.61.42.0
  932. Checking netblock 187.17.111.0
  933. Checking netblock 200.147.40.0
  934. Checking netblock 187.61.41.0
  935. Checking netblock 200.147.3.0
  936. Checking netblock 186.234.238.0
  937. Checking netblock 200.147.14.0
  938. Checking netblock 200.147.32.0
  939. Checking netblock 200.147.41.0
  940. Checking netblock 200.98.196.0
  941. Checking netblock 189.38.62.0
  942.  
  943. Searching for aquidauana.ms.gov.br. emails in Google
  944. [email protected]
  945. [email protected].
  946.  
  947. Checking 26 active hosts using nmap... (nmap -sn -n -v -PP -PM -PS80,25 -PA -PY -PU53,40125 -PE --reason <ip> -oA <output_directory>/nmap/<ip>.sn)
  948. Host 187.61.39.0 is up (reset ttl 64)
  949. Host 187.17.102.0 is up (reset ttl 64)
  950. Host 200.147.1.8 is up (reset ttl 64)
  951. Host 187.17.106.0 is up (reset ttl 64)
  952. Host 187.61.40.0 is up (reset ttl 64)
  953. Host 200.147.99.24 is up (reset ttl 64)
  954. Host 200.221.65.6 is up (reset ttl 64)
  955. Host 200.98.199.199 is up (reset ttl 64)
  956. Host 187.17.109.0 is up (reset ttl 64)
  957. Host 200.147.36.29 is up (reset ttl 64)
  958. Host 187.61.42.0 is up (reset ttl 64)
  959. Host 187.17.111.104 is up (reset ttl 64)
  960. Host 187.17.111.106 is up (reset ttl 64)
  961. Host 187.17.111.107 is up (reset ttl 64)
  962. Host 200.147.40.0 is up (reset ttl 64)
  963. Host 187.61.41.0 is up (reset ttl 64)
  964. Host 200.147.99.196 is up (reset ttl 64)
  965. Host 200.147.3.220 is up (reset ttl 64)
  966. Host 186.234.238.0 is up (reset ttl 64)
  967. Host 200.147.14.0 is up (reset ttl 64)
  968. Host 200.98.199.0 is up (reset ttl 64)
  969. Host 200.147.32.0 is up (reset ttl 64)
  970. Host 200.147.36.31 is up (reset ttl 64)
  971. Host 200.147.41.245 is up (reset ttl 64)
  972. Host 200.98.196.0 is up (reset ttl 64)
  973. Host 189.38.62.128 is up (reset ttl 64)
  974.  
  975. Checking ports on every active host using nmap... (nmap -O --reason --webxml --traceroute -sS -sV -sC -Pn -n -v -F <ip> -oA <output_directory>/nmap/<ip>)
  976. Scanning ip 187.61.39.0 ():
  977. Scanning ip 187.17.102.0 ():
  978. Scanning ip 200.147.1.8 ():
  979. Scanning ip 187.17.106.0 ():
  980. Scanning ip 187.61.40.0 ():
  981. Scanning ip 200.147.99.24 ():
  982. Scanning ip 200.221.65.6 (ns2.dominios.uol.com.br (PTR)):
  983. 53/tcp open domain? syn-ack ttl 48
  984. | dns-nsid:
  985. |_ bind.version: UOL HOST
  986. | fingerprint-strings:
  987. | DNSVersionBindReqTCP:
  988. | version
  989. | bind
  990. |_ HOST
  991. Scanning ip 200.98.199.199 (ns1.dominios.uol.com.br (PTR)):
  992. Scanning ip 187.17.109.0 ():
  993. Scanning ip 200.147.36.29 (mx.uhserver.com (PTR)):
  994. Device type: storage-misc|general purpose
  995. Running: Sun embedded, Sun OpenSolaris, Sun Solaris 10|8|9
  996. Scanning ip 187.61.42.0 ():
  997. Scanning ip 187.17.111.104 (www.aquidauana.ms.gov.br.):
  998. 80/tcp open http syn-ack ttl 46 nginx
  999. |_http-title: Ops! Erro 404
  1000. 443/tcp open ssl/http syn-ack ttl 47 nginx
  1001. | http-methods:
  1002. |_ Supported Methods: GET HEAD OPTIONS
  1003. |_http-title: Ops! Erro 404
  1004. | ssl-cert: Subject: commonName=*.sslblindado.com
  1005. | Subject Alternative Name: DNS:*.sslblindado.com, DNS:sslblindado.com
  1006. | Issuer: commonName=RapidSSL RSA CA 2018/organizationName=DigiCert Inc/countryName=US
  1007. | Public Key type: rsa
  1008. | Public Key bits: 2048
  1009. | Signature Algorithm: sha256WithRSAEncryption
  1010. | Not valid before: 2018-12-20T00:00:00
  1011. | Not valid after: 2020-03-20T12:00:00
  1012. | MD5: dc13 3d3f 3873 a640 d027 f3c9 4c45 41ad
  1013. |_SHA-1: b755 f383 b914 1f79 d1cb dcfd 5f69 9283 576e 10af
  1014. |_ssl-date: TLS randomness does not represent time
  1015. | tls-alpn:
  1016. |_ http/1.1
  1017. | tls-nextprotoneg:
  1018. |_ http/1.1
  1019. Scanning ip 187.17.111.106 (ftp.aquidauana.ms.gov.br.):
  1020. 21/tcp open ftp syn-ack ttl 49 ProFTPD 1.3.5b
  1021. OS Info: Service Info: OS: Unix
  1022. Scanning ip 187.17.111.107 (ssh.aquidauana.ms.gov.br.):
  1023. 22/tcp open ssh syn-ack ttl 49 OpenSSH 5.3 (protocol 2.0)
  1024. | ssh-hostkey:
  1025. | 1024 5e:23:15:88:fc:d5:ef:ec:ce:bc:29:ef:05:5d:2f:a7 (DSA)
  1026. |_ 2048 2a:c8:8a:f6:b5:94:63:8e:7b:ac:ba:34:80:5d:70:46 (RSA)
  1027. Scanning ip 200.147.40.0 ():
  1028. Scanning ip 187.61.41.0 ():
  1029. Scanning ip 200.147.99.196 (webmail.aquidauana.ms.gov.br.):
  1030. 80/tcp open http syn-ack ttl 46 nginx
  1031. | http-methods:
  1032. |_ Supported Methods: GET HEAD POST OPTIONS
  1033. |_http-title: Did not follow redirect to https://email.uolhost.com.br/
  1034. 443/tcp open ssl/http syn-ack ttl 48 nginx
  1035. |_http-title: 400 The plain HTTP request was sent to HTTPS port
  1036. | ssl-cert: Subject: commonName=mail.uol.com.br/organizationName=Universo Online SA/stateOrProvinceName=Sao Paulo/countryName=BR
  1037. | Subject Alternative Name: DNS:mail.uol.com.br, DNS:config.uol.com.br, DNS:cal.bmail.uol.com.br, DNS:pop3.uol.com.br, DNS:email.uolhost.com.br, DNS:cal.mail.uol.com.br, DNS:smtps.bol.com.br, DNS:smtps.uol.com.br, DNS:afmail.uol.com.br, DNS:as.uol.com.br, DNS:imap.uol.com.br, DNS:webmail.uolhost.com.br, DNS:as.afiliados.uol.com.br, DNS:cal.webmail.uolhost.com.br, DNS:logocln.uolhost.com.br, DNS:mail.folha.uol.com.br, DNS:pop3.bol.com.br, DNS:config.afiliados.uol.com.br, DNS:app.correio.uol.com.br, DNS:painel-email.uol.com.br, DNS:app.correio.bol.com.br, DNS:cal.afmail.uol.com.br, DNS:smtp.uol.com.br, DNS:cal.mail.folha.uol.com.br, DNS:bmail.uol.com.br, DNS:imap.bol.com.br
  1038. | Issuer: commonName=GeoTrust RSA CA 2018/organizationName=DigiCert Inc/countryName=US
  1039. | Public Key type: rsa
  1040. | Public Key bits: 2048
  1041. | Signature Algorithm: sha256WithRSAEncryption
  1042. | Not valid before: 2018-07-19T00:00:00
  1043. | Not valid after: 2019-10-18T12:00:00
  1044. | MD5: 53e5 a7dc 81de 6793 5d5d 0d47 2b2d dd62
  1045. |_SHA-1: 6481 bde3 d83c a692 ad89 81c0 681e 83cc ec96 9835
  1046. |_ssl-date: 2019-09-05T12:30:53+00:00; -3s from scanner time.
  1047. | tls-nextprotoneg:
  1048. |_ http/1.1
  1049. |_clock-skew: -3s
  1050. Scanning ip 200.147.3.220 (200-147-3-220-220.static.uol.com.br (PTR)):
  1051. 110/tcp open pop3 syn-ack ttl 47 Dovecot pop3d
  1052. |_pop3-capabilities: SASL(PLAIN XOAUTH2) RESP-CODES USER PIPELINING AUTH-RESP-CODE CAPA TOP UIDL
  1053. 143/tcp open imap syn-ack ttl 49 Dovecot imapd
  1054. |_imap-capabilities: QUOTA CHILDREN more have ATOMIC SORT RENAME AUTH=PLAIN capabilities Pre-login NO MULTIAPPEND listed AUTH=XOAUTH2A0001 OK SASL-IR IMAP4rev1 ID UIDPLUS UNSELECT NAMESPACE post-login BINARY IMAP4
  1055. Scanning ip 186.234.238.0 ():
  1056. Scanning ip 200.147.14.0 ():
  1057. Scanning ip 200.98.199.0 ():
  1058. Scanning ip 200.147.32.0 ():
  1059. Scanning ip 200.147.36.31 (smtp.aquidauana.ms.gov.br.):
  1060. 587/tcp open smtp syn-ack ttl 49 Postfix smtpd
  1061. |_smtp-commands: a2-smithers3.uhserver.com, PIPELINING, SIZE 41943040, VRFY, ETRN, AUTH LOGIN PLAIN LOGIN PLAIN, AUTH=LOGIN PLAIN LOGIN PLAIN, ENHANCEDSTATUSCODES, 8BITMIME, DSN,
  1062. Device type: broadband router|WAP|general purpose|printer|webcam
  1063. Running (JUST GUESSING): Asus embedded (96%), Linux 2.6.X (96%), Sun Solaris 8|9|10 (92%), Lexmark embedded (91%), AXIS embedded (91%)
  1064. OS Info: Service Info: Host: a2-smithers3.uhserver.com
  1065. Scanning ip 200.147.41.245 (200-147-41-245.static.uol.com.br (PTR)):
  1066. 110/tcp open pop3 syn-ack ttl 47 Dovecot pop3d
  1067. |_pop3-capabilities: AUTH-RESP-CODE CAPA PIPELINING RESP-CODES TOP SASL(PLAIN XOAUTH2) UIDL USER
  1068. 143/tcp open imap syn-ack ttl 47 Dovecot imapd
  1069. |_imap-capabilities: AUTH=PLAIN ID more IMAP4rev1 CHILDREN BINARY NAMESPACE UIDPLUS capabilities UNSELECT NO OK listed SORT IMAP4 QUOTA Pre-login post-login ATOMIC AUTH=XOAUTH2A0001 have RENAME MULTIAPPEND SASL-IR
  1070. Scanning ip 200.98.196.0 ():
  1071. Scanning ip 189.38.62.128 ():
  1072. WebCrawling domain's web servers... up to 50 max links.
  1073.  
  1074. + URL to crawl: http://www.aquidauana.ms.gov.br.
  1075. + Date: 2019-09-05
  1076.  
  1077. + Crawling URL: http://www.aquidauana.ms.gov.br.:
  1078. + Links:
  1079. + Crawling http://www.aquidauana.ms.gov.br. (404 Not Found)
  1080. + Searching for directories...
  1081. + Searching open folders...
  1082.  
  1083.  
  1084. + URL to crawl: https://www.aquidauana.ms.gov.br.
  1085. + Date: 2019-09-05
  1086.  
  1087. + Crawling URL: https://www.aquidauana.ms.gov.br.:
  1088. + Links:
  1089. + Crawling https://www.aquidauana.ms.gov.br.
  1090. + Searching for directories...
  1091. + Searching open folders...
  1092.  
  1093.  
  1094. + URL to crawl: http://webmail.aquidauana.ms.gov.br.
  1095. + Date: 2019-09-05
  1096.  
  1097. + Crawling URL: http://webmail.aquidauana.ms.gov.br.:
  1098. + Links:
  1099. + Crawling http://webmail.aquidauana.ms.gov.br. ([SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:727))
  1100. + Searching for directories...
  1101. + Searching open folders...
  1102.  
  1103.  
  1104. + URL to crawl: https://webmail.aquidauana.ms.gov.br.
  1105. + Date: 2019-09-05
  1106.  
  1107. + Crawling URL: https://webmail.aquidauana.ms.gov.br.:
  1108. + Links:
  1109. + Crawling https://webmail.aquidauana.ms.gov.br.
  1110. + Searching for directories...
  1111. + Searching open folders...
  1112.  
  1113. --Finished--
  1114. Summary information for domain aquidauana.ms.gov.br.
  1115. -----------------------------------------
  1116. Domain Specific Information:
  1117. Email: [email protected]
  1118. Email: [email protected].
  1119.  
  1120. Domain Ips Information:
  1121. IP: 187.61.39.0
  1122. Type: SPF
  1123. Is Active: True (reset ttl 64)
  1124. IP: 187.17.102.0
  1125. Type: SPF
  1126. Is Active: True (reset ttl 64)
  1127. IP: 200.147.1.8
  1128. Type: SPF
  1129. Is Active: True (reset ttl 64)
  1130. IP: 187.17.106.0
  1131. Type: SPF
  1132. Type: SPF
  1133. Is Active: True (reset ttl 64)
  1134. IP: 187.61.40.0
  1135. Type: SPF
  1136. Is Active: True (reset ttl 64)
  1137. IP: 200.147.99.24
  1138. Type: SPF
  1139. Is Active: True (reset ttl 64)
  1140. IP: 200.221.65.6
  1141. HostName: ns2.dominios.uol.com.br Type: NS
  1142. HostName: ns2.dominios.uol.com.br Type: PTR
  1143. Country: Brazil
  1144. Is Active: True (reset ttl 64)
  1145. Port: 53/tcp open domain? syn-ack ttl 48
  1146. Script Info: | dns-nsid:
  1147. Script Info: |_ bind.version: UOL HOST
  1148. Script Info: | fingerprint-strings:
  1149. Script Info: | DNSVersionBindReqTCP:
  1150. Script Info: | version
  1151. Script Info: | bind
  1152. Script Info: |_ HOST
  1153. IP: 200.98.199.199
  1154. HostName: ns1.dominios.uol.com.br Type: NS
  1155. HostName: ns1.dominios.uol.com.br Type: PTR
  1156. Country: Brazil
  1157. Is Active: True (reset ttl 64)
  1158. IP: 187.17.109.0
  1159. Type: SPF
  1160. Type: SPF
  1161. Is Active: True (reset ttl 64)
  1162. IP: 200.147.36.29
  1163. HostName: mx.uhserver.com Type: MX
  1164. HostName: mx.uhserver.com Type: PTR
  1165. Country: Brazil
  1166. Is Active: True (reset ttl 64)
  1167. Script Info: Device type: storage-misc|general purpose
  1168. Script Info: Running: Sun embedded, Sun OpenSolaris, Sun Solaris 10|8|9
  1169. IP: 187.61.42.0
  1170. Type: SPF
  1171. Is Active: True (reset ttl 64)
  1172. IP: 187.17.111.104
  1173. HostName: www.aquidauana.ms.gov.br. Type: A
  1174. Country: Brazil
  1175. Is Active: True (reset ttl 64)
  1176. Port: 80/tcp open http syn-ack ttl 46 nginx
  1177. Script Info: |_http-title: Ops! Erro 404
  1178. Port: 443/tcp open ssl/http syn-ack ttl 47 nginx
  1179. Script Info: | http-methods:
  1180. Script Info: |_ Supported Methods: GET HEAD OPTIONS
  1181. Script Info: |_http-title: Ops! Erro 404
  1182. Script Info: | ssl-cert: Subject: commonName=*.sslblindado.com
  1183. Script Info: | Subject Alternative Name: DNS:*.sslblindado.com, DNS:sslblindado.com
  1184. Script Info: | Issuer: commonName=RapidSSL RSA CA 2018/organizationName=DigiCert Inc/countryName=US
  1185. Script Info: | Public Key type: rsa
  1186. Script Info: | Public Key bits: 2048
  1187. Script Info: | Signature Algorithm: sha256WithRSAEncryption
  1188. Script Info: | Not valid before: 2018-12-20T00:00:00
  1189. Script Info: | Not valid after: 2020-03-20T12:00:00
  1190. Script Info: | MD5: dc13 3d3f 3873 a640 d027 f3c9 4c45 41ad
  1191. Script Info: |_SHA-1: b755 f383 b914 1f79 d1cb dcfd 5f69 9283 576e 10af
  1192. Script Info: |_ssl-date: TLS randomness does not represent time
  1193. Script Info: | tls-alpn:
  1194. Script Info: |_ http/1.1
  1195. Script Info: | tls-nextprotoneg:
  1196. Script Info: |_ http/1.1
  1197. IP: 187.17.111.106
  1198. HostName: ftp.aquidauana.ms.gov.br. Type: A
  1199. Country: Brazil
  1200. Is Active: True (reset ttl 64)
  1201. Port: 21/tcp open ftp syn-ack ttl 49 ProFTPD 1.3.5b
  1202. Os Info: OS: Unix
  1203. IP: 187.17.111.107
  1204. HostName: ssh.aquidauana.ms.gov.br. Type: A
  1205. Country: Brazil
  1206. Is Active: True (reset ttl 64)
  1207. Port: 22/tcp open ssh syn-ack ttl 49 OpenSSH 5.3 (protocol 2.0)
  1208. Script Info: | ssh-hostkey:
  1209. Script Info: | 1024 5e:23:15:88:fc:d5:ef:ec:ce:bc:29:ef:05:5d:2f:a7 (DSA)
  1210. Script Info: |_ 2048 2a:c8:8a:f6:b5:94:63:8e:7b:ac:ba:34:80:5d:70:46 (RSA)
  1211. IP: 200.147.40.0
  1212. Type: SPF
  1213. Is Active: True (reset ttl 64)
  1214. IP: 187.61.41.0
  1215. Type: SPF
  1216. Is Active: True (reset ttl 64)
  1217. IP: 200.147.99.196
  1218. HostName: webmail.aquidauana.ms.gov.br. Type: A
  1219. Country: Brazil
  1220. Is Active: True (reset ttl 64)
  1221. Port: 80/tcp open http syn-ack ttl 46 nginx
  1222. Script Info: | http-methods:
  1223. Script Info: |_ Supported Methods: GET HEAD POST OPTIONS
  1224. Script Info: |_http-title: Did not follow redirect to https://email.uolhost.com.br/
  1225. Port: 443/tcp open ssl/http syn-ack ttl 48 nginx
  1226. Script Info: |_http-title: 400 The plain HTTP request was sent to HTTPS port
  1227. Script Info: | ssl-cert: Subject: commonName=mail.uol.com.br/organizationName=Universo Online SA/stateOrProvinceName=Sao Paulo/countryName=BR
  1228. Script Info: | Subject Alternative Name: DNS:mail.uol.com.br, DNS:config.uol.com.br, DNS:cal.bmail.uol.com.br, DNS:pop3.uol.com.br, DNS:email.uolhost.com.br, DNS:cal.mail.uol.com.br, DNS:smtps.bol.com.br, DNS:smtps.uol.com.br, DNS:afmail.uol.com.br, DNS:as.uol.com.br, DNS:imap.uol.com.br, DNS:webmail.uolhost.com.br, DNS:as.afiliados.uol.com.br, DNS:cal.webmail.uolhost.com.br, DNS:logocln.uolhost.com.br, DNS:mail.folha.uol.com.br, DNS:pop3.bol.com.br, DNS:config.afiliados.uol.com.br, DNS:app.correio.uol.com.br, DNS:painel-email.uol.com.br, DNS:app.correio.bol.com.br, DNS:cal.afmail.uol.com.br, DNS:smtp.uol.com.br, DNS:cal.mail.folha.uol.com.br, DNS:bmail.uol.com.br, DNS:imap.bol.com.br
  1229. Script Info: | Issuer: commonName=GeoTrust RSA CA 2018/organizationName=DigiCert Inc/countryName=US
  1230. Script Info: | Public Key type: rsa
  1231. Script Info: | Public Key bits: 2048
  1232. Script Info: | Signature Algorithm: sha256WithRSAEncryption
  1233. Script Info: | Not valid before: 2018-07-19T00:00:00
  1234. Script Info: | Not valid after: 2019-10-18T12:00:00
  1235. Script Info: | MD5: 53e5 a7dc 81de 6793 5d5d 0d47 2b2d dd62
  1236. Script Info: |_SHA-1: 6481 bde3 d83c a692 ad89 81c0 681e 83cc ec96 9835
  1237. Script Info: |_ssl-date: 2019-09-05T12:30:53+00:00; -3s from scanner time.
  1238. Script Info: | tls-nextprotoneg:
  1239. Script Info: |_ http/1.1
  1240. Script Info: |_clock-skew: -3s
  1241. IP: 200.147.3.220
  1242. HostName: mail.aquidauana.ms.gov.br. Type: A
  1243. HostName: pop.aquidauana.ms.gov.br. Type: A
  1244. HostName: 200-147-3-220-220.static.uol.com.br Type: PTR
  1245. Country: Brazil
  1246. Is Active: True (reset ttl 64)
  1247. Port: 110/tcp open pop3 syn-ack ttl 47 Dovecot pop3d
  1248. Script Info: |_pop3-capabilities: SASL(PLAIN XOAUTH2) RESP-CODES USER PIPELINING AUTH-RESP-CODE CAPA TOP UIDL
  1249. Port: 143/tcp open imap syn-ack ttl 49 Dovecot imapd
  1250. Script Info: |_imap-capabilities: QUOTA CHILDREN more have ATOMIC SORT RENAME AUTH=PLAIN capabilities Pre-login NO MULTIAPPEND listed AUTH=XOAUTH2A0001 OK SASL-IR IMAP4rev1 ID UIDPLUS UNSELECT NAMESPACE post-login BINARY IMAP4
  1251. IP: 186.234.238.0
  1252. Type: SPF
  1253. Is Active: True (reset ttl 64)
  1254. IP: 200.147.14.0
  1255. Type: SPF
  1256. Is Active: True (reset ttl 64)
  1257. IP: 200.98.199.0
  1258. Type: SPF
  1259. Is Active: True (reset ttl 64)
  1260. IP: 200.147.32.0
  1261. Type: SPF
  1262. Is Active: True (reset ttl 64)
  1263. IP: 200.147.36.31
  1264. HostName: smtp.aquidauana.ms.gov.br. Type: A
  1265. Country: Brazil
  1266. Is Active: True (reset ttl 64)
  1267. Port: 587/tcp open smtp syn-ack ttl 49 Postfix smtpd
  1268. Script Info: |_smtp-commands: a2-smithers3.uhserver.com, PIPELINING, SIZE 41943040, VRFY, ETRN, AUTH LOGIN PLAIN LOGIN PLAIN, AUTH=LOGIN PLAIN LOGIN PLAIN, ENHANCEDSTATUSCODES, 8BITMIME, DSN,
  1269. Script Info: Device type: broadband router|WAP|general purpose|printer|webcam
  1270. Script Info: Running (JUST GUESSING): Asus embedded (96%), Linux 2.6.X (96%), Sun Solaris 8|9|10 (92%), Lexmark embedded (91%), AXIS embedded (91%)
  1271. Os Info: Host: a2-smithers3.uhserver.com
  1272. IP: 200.147.41.245
  1273. HostName: imap.aquidauana.ms.gov.br. Type: A
  1274. HostName: pop3.aquidauana.ms.gov.br. Type: A
  1275. HostName: 200-147-41-245.static.uol.com.br Type: PTR
  1276. Country: Brazil
  1277. Is Active: True (reset ttl 64)
  1278. Port: 110/tcp open pop3 syn-ack ttl 47 Dovecot pop3d
  1279. Script Info: |_pop3-capabilities: AUTH-RESP-CODE CAPA PIPELINING RESP-CODES TOP SASL(PLAIN XOAUTH2) UIDL USER
  1280. Port: 143/tcp open imap syn-ack ttl 47 Dovecot imapd
  1281. Script Info: |_imap-capabilities: AUTH=PLAIN ID more IMAP4rev1 CHILDREN BINARY NAMESPACE UIDPLUS capabilities UNSELECT NO OK listed SORT IMAP4 QUOTA Pre-login post-login ATOMIC AUTH=XOAUTH2A0001 have RENAME MULTIAPPEND SASL-IR
  1282. IP: 200.98.196.0
  1283. Type: SPF
  1284. Is Active: True (reset ttl 64)
  1285. IP: 189.38.62.128
  1286. Type: SPF
  1287. Is Active: True (reset ttl 64)
  1288. #######################################################################################################################################
  1289. dnsenum VERSION:1.2.4
  1290.  
  1291. ----- www.aquidauana.ms.gov.br -----
  1292.  
  1293.  
  1294. Host's addresses:
  1295. __________________
  1296.  
  1297. www.aquidauana.ms.gov.br. 1586 IN A 187.17.111.104
  1298.  
  1299.  
  1300. Name Servers:
  1301. ______________
  1302.  
  1303. ns2.dominios.uol.com.br. 1163 IN A 200.221.65.6
  1304. ns1.dominios.uol.com.br. 3055 IN A 200.98.199.199
  1305.  
  1306.  
  1307. Mail (MX) Servers:
  1308. ___________________
  1309.  
  1310. mx.uhserver.com. 492 IN A 200.147.36.29
  1311.  
  1312.  
  1313. Trying Zone Transfers and getting Bind Versions:
  1314. _________________________________________________
  1315.  
  1316.  
  1317. Trying Zone Transfer for www.aquidauana.ms.gov.br on ns2.dominios.uol.com.br ...
  1318.  
  1319. Trying Zone Transfer for www.aquidauana.ms.gov.br on ns1.dominios.uol.com.br ...
  1320.  
  1321. brute force file not specified, bay.
  1322. #######################################################################################################################################
  1323. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-05 08:13 EDT
  1324. Nmap scan report for 187.17.111.104
  1325. Host is up (0.48s latency).
  1326. Not shown: 478 filtered ports, 3 closed ports
  1327. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  1328. PORT STATE SERVICE
  1329. 80/tcp open http
  1330. 443/tcp open https
  1331.  
  1332. Nmap done: 1 IP address (1 host up) scanned in 189.23 seconds
  1333. #######################################################################################################################################
  1334. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-05 08:16 EDT
  1335. Nmap scan report for 187.17.111.104
  1336. Host is up (0.26s latency).
  1337. Not shown: 2 filtered ports
  1338. PORT STATE SERVICE
  1339. 53/udp open|filtered domain
  1340. 67/udp open|filtered dhcps
  1341. 68/udp open|filtered dhcpc
  1342. 69/udp open|filtered tftp
  1343. 88/udp open|filtered kerberos-sec
  1344. 123/udp open|filtered ntp
  1345. 139/udp open|filtered netbios-ssn
  1346. 161/udp open|filtered snmp
  1347. 162/udp open|filtered snmptrap
  1348. 389/udp open|filtered ldap
  1349. 500/udp open|filtered isakmp
  1350. 520/udp open|filtered route
  1351. 2049/udp open|filtered nfs
  1352.  
  1353. Nmap done: 1 IP address (1 host up) scanned in 5.07 seconds
  1354. #######################################################################################################################################
  1355. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-05 08:16 EDT
  1356. NSE: Loaded 164 scripts for scanning.
  1357. NSE: Script Pre-scanning.
  1358. Initiating NSE at 08:16
  1359. Completed NSE at 08:16, 0.00s elapsed
  1360. Initiating NSE at 08:16
  1361. Completed NSE at 08:16, 0.00s elapsed
  1362. Initiating Parallel DNS resolution of 1 host. at 08:16
  1363. Completed Parallel DNS resolution of 1 host. at 08:16, 0.02s elapsed
  1364. Initiating SYN Stealth Scan at 08:16
  1365. Scanning 187.17.111.104 [1 port]
  1366. Completed SYN Stealth Scan at 08:16, 0.55s elapsed (1 total ports)
  1367. Initiating Service scan at 08:16
  1368. Initiating OS detection (try #1) against 187.17.111.104
  1369. Retrying OS detection (try #2) against 187.17.111.104
  1370. Initiating Traceroute at 08:16
  1371. Completed Traceroute at 08:16, 0.78s elapsed
  1372. Initiating Parallel DNS resolution of 14 hosts. at 08:16
  1373. Completed Parallel DNS resolution of 14 hosts. at 08:16, 1.77s elapsed
  1374. NSE: Script scanning 187.17.111.104.
  1375. Initiating NSE at 08:16
  1376. Completed NSE at 08:16, 0.01s elapsed
  1377. Initiating NSE at 08:16
  1378. Completed NSE at 08:16, 0.00s elapsed
  1379. Nmap scan report for 187.17.111.104
  1380. Host is up (0.16s latency).
  1381.  
  1382. PORT STATE SERVICE VERSION
  1383. 80/tcp filtered http
  1384. Too many fingerprints match this host to give specific OS details
  1385. Network Distance: 16 hops
  1386.  
  1387. TRACEROUTE (using proto 1/icmp)
  1388. HOP RTT ADDRESS
  1389. 1 245.35 ms 10.237.204.1
  1390. 2 245.41 ms 45.131.4.2
  1391. 3 245.40 ms 109.236.95.224
  1392. 4 245.45 ms hu0-4-0-0.ccr21.ams04.atlas.cogentco.com (149.11.39.41)
  1393. 5 245.44 ms be3458.ccr42.ams03.atlas.cogentco.com (154.54.39.185)
  1394. 6 245.57 ms be2317.ccr41.jfk02.atlas.cogentco.com (154.54.30.185)
  1395. 7 245.59 ms be2490.ccr42.jfk02.atlas.cogentco.com (154.54.42.85)
  1396. 8 245.61 ms be2112.ccr41.atl01.atlas.cogentco.com (154.54.7.158)
  1397. 9 246.75 ms be3482.ccr21.mia01.atlas.cogentco.com (154.54.24.146)
  1398. 10 246.83 ms be3400.ccr21.mia03.atlas.cogentco.com (154.54.47.18)
  1399. 11 418.12 ms 38.104.94.90
  1400. 12 418.12 ms 38.104.94.90
  1401. 13 522.31 ms 186.234.28.121
  1402. 14 522.28 ms 186.234.29.18
  1403. 15 522.35 ms 186.234.29.18
  1404. 16 522.15 ms 187.17.111.104
  1405.  
  1406. NSE: Script Post-scanning.
  1407. Initiating NSE at 08:16
  1408. Completed NSE at 08:16, 0.00s elapsed
  1409. Initiating NSE at 08:16
  1410. Completed NSE at 08:16, 0.00s elapsed
  1411. #######################################################################################################################################
  1412.  
  1413. wig - WebApp Information Gatherer
  1414.  
  1415.  
  1416. Scanning http://187.17.111.104...
  1417. _________________ SITE INFO __________________
  1418. IP Title
  1419. 187.17.111.104 Ops! Erro 404
  1420.  
  1421. __________________ VERSION ___________________
  1422. Name Versions Type
  1423. nginx Platform
  1424.  
  1425. ______________________________________________
  1426. Time: 67.1 sec Urls: 599 Fingerprints: 40401
  1427. #######################################################################################################################################
  1428. HTTP/1.1 404 Not Found
  1429. Server: nginx
  1430. Date: Thu, 05 Sep 2019 12:18:01 GMT
  1431. Content-Type: text/html; charset=utf-8
  1432. Connection: keep-alive
  1433.  
  1434. HTTP/1.1 404 Not Found
  1435. Server: nginx
  1436. Date: Thu, 05 Sep 2019 12:18:02 GMT
  1437. Content-Type: text/html; charset=utf-8
  1438. Connection: keep-alive
  1439. #######################################################################################################################################
  1440. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-05 08:18 EDT
  1441. NSE: Loaded 164 scripts for scanning.
  1442. NSE: Script Pre-scanning.
  1443. Initiating NSE at 08:18
  1444. Completed NSE at 08:18, 0.00s elapsed
  1445. Initiating NSE at 08:18
  1446. Completed NSE at 08:18, 0.00s elapsed
  1447. Initiating Parallel DNS resolution of 1 host. at 08:18
  1448. Completed Parallel DNS resolution of 1 host. at 08:18, 0.02s elapsed
  1449. Initiating SYN Stealth Scan at 08:18
  1450. Scanning 187.17.111.104 [1 port]
  1451. Discovered open port 443/tcp on 187.17.111.104
  1452. Completed SYN Stealth Scan at 08:18, 0.59s elapsed (1 total ports)
  1453. Initiating Service scan at 08:18
  1454. Scanning 1 service on 187.17.111.104
  1455. Completed Service scan at 08:18, 14.45s elapsed (1 service on 1 host)
  1456. Initiating OS detection (try #1) against 187.17.111.104
  1457. Retrying OS detection (try #2) against 187.17.111.104
  1458. adjust_timeouts2: packet supposedly had rtt of -3151174 microseconds. Ignoring time.
  1459. adjust_timeouts2: packet supposedly had rtt of -3151174 microseconds. Ignoring time.
  1460. Initiating Traceroute at 08:18
  1461. Completed Traceroute at 08:18, 3.21s elapsed
  1462. Initiating Parallel DNS resolution of 15 hosts. at 08:18
  1463. Completed Parallel DNS resolution of 15 hosts. at 08:18, 0.28s elapsed
  1464. NSE: Script scanning 187.17.111.104.
  1465. Initiating NSE at 08:18
  1466. Completed NSE at 08:22, 234.35s elapsed
  1467. Initiating NSE at 08:22
  1468. Completed NSE at 08:22, 4.00s elapsed
  1469. Nmap scan report for 187.17.111.104
  1470. Host is up (0.31s latency).
  1471.  
  1472. PORT STATE SERVICE VERSION
  1473. 443/tcp open ssl/http nginx
  1474. | http-brute:
  1475. |_ Path "/" does not require authentication
  1476. |_http-chrono: Request times for /; avg: 2063.24ms; min: 1799.88ms; max: 2648.46ms
  1477. |_http-csrf: Couldn't find any CSRF vulnerabilities.
  1478. |_http-date: Thu, 05 Sep 2019 12:18:58 GMT; -6s from local time.
  1479. |_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.
  1480. |_http-dombased-xss: Couldn't find any DOM based XSS.
  1481. |_http-drupal-enum: Nothing found amongst the top 100 resources,use --script-args number=<number|all> for deeper analysis)
  1482. | http-errors:
  1483. | Spidering limited to: maxpagecount=40; withinhost=187.17.111.104
  1484. | Found the following error pages:
  1485. |
  1486. | Error Code: 404
  1487. |_ http://187.17.111.104:443/
  1488. |_http-feed: Couldn't find any feeds.
  1489. |_http-fetch: Please enter the complete path of the directory to save data in.
  1490. | http-headers:
  1491. | Server: nginx
  1492. | Date: Thu, 05 Sep 2019 12:19:18 GMT
  1493. | Content-Type: text/html
  1494. | Content-Length: 264
  1495. | Connection: close
  1496. |
  1497. |_ (Request type: GET)
  1498. |_http-jsonp-detection: Couldn't find any JSONP endpoints.
  1499. |_http-litespeed-sourcecode-download: Request with null byte did not work. This web server might not be vulnerable
  1500. |_http-mobileversion-checker: No mobile version detected.
  1501. | http-security-headers:
  1502. | Strict_Transport_Security:
  1503. |_ HSTS not configured in HTTPS Server
  1504. | http-sitemap-generator:
  1505. | Directory structure:
  1506. | Longest directory structure:
  1507. | Depth: 0
  1508. | Dir: /
  1509. | Total files found (by extension):
  1510. |_
  1511. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
  1512. |_http-title: 400 The plain HTTP request was sent to HTTPS port
  1513. | http-vhosts:
  1514. | 126 names had status 400
  1515. |_web : 404
  1516. |_http-wordpress-enum: Nothing found amongst the top 100 resources,use --script-args search-limit=<number|all> for deeper analysis)
  1517. |_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php
  1518. |_http-xssed: No previously reported XSS vuln.
  1519. |_vulscan: ERROR: Script execution failed (use -d to debug)
  1520. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  1521. Device type: general purpose|storage-misc|specialized
  1522. Running (JUST GUESSING): Linux 4.X (89%), HP embedded (85%), Crestron 2-Series (85%)
  1523. OS CPE: cpe:/o:linux:linux_kernel:4.10 cpe:/h:hp:p2000_g3 cpe:/o:crestron:2_series
  1524. Aggressive OS guesses: Linux 4.10 (89%), HP P2000 G3 NAS device (85%), Crestron XPanel control system (85%)
  1525. No exact OS matches for host (test conditions non-ideal).
  1526. Uptime guess: 0.003 days (since Thu Sep 5 08:18:36 2019)
  1527. Network Distance: 17 hops
  1528. TCP Sequence Prediction: Difficulty=257 (Good luck!)
  1529. IP ID Sequence Generation: All zeros
  1530.  
  1531. TRACEROUTE (using port 443/tcp)
  1532. HOP RTT ADDRESS
  1533. 1 306.52 ms 10.237.204.1
  1534. 2 201.29 ms 45.131.4.3
  1535. 3 201.26 ms 109.236.95.228
  1536. 4 201.33 ms hu0-1-0-3.ccr21.ams04.atlas.cogentco.com (149.11.38.225)
  1537. 5 201.35 ms be3434.ccr42.ams03.atlas.cogentco.com (154.54.59.49)
  1538. 6 201.41 ms be12488.ccr42.lon13.atlas.cogentco.com (130.117.51.41)
  1539. 7 201.46 ms be2807.ccr42.dca01.atlas.cogentco.com (154.54.40.110)
  1540. 8 201.46 ms be2806.ccr41.dca01.atlas.cogentco.com (154.54.40.106)
  1541. 9 306.65 ms be3483.ccr22.mia01.atlas.cogentco.com (154.54.28.50)
  1542. 10 306.68 ms be3401.ccr21.mia03.atlas.cogentco.com (154.54.47.30)
  1543. 11 417.60 ms 38.104.94.90
  1544. 12 522.32 ms 186.234.28.121
  1545. 13 522.19 ms 186.234.26.65
  1546. 14 522.22 ms 186.234.26.65
  1547. 15 522.30 ms 186.234.29.18
  1548. 16 ...
  1549. 17 522.20 ms 187.17.111.104
  1550.  
  1551. NSE: Script Post-scanning.
  1552. Initiating NSE at 08:22
  1553. Completed NSE at 08:22, 0.00s elapsed
  1554. Initiating NSE at 08:22
  1555. Completed NSE at 08:22, 0.00s elapsed
  1556. #######################################################################################################################################
  1557. Version: 1.11.13-static
  1558. OpenSSL 1.0.2-chacha (1.0.2g-dev)
  1559.  
  1560. Connected to 187.17.111.104
  1561.  
  1562. Testing SSL server 187.17.111.104 on port 443 using SNI name 187.17.111.104
  1563.  
  1564. TLS Fallback SCSV:
  1565. Server supports TLS Fallback SCSV
  1566.  
  1567. TLS renegotiation:
  1568. Secure session renegotiation supported
  1569.  
  1570. TLS Compression:
  1571. Compression disabled
  1572.  
  1573. Heartbleed:
  1574. TLS 1.2 not vulnerable to heartbleed
  1575. TLS 1.1 not vulnerable to heartbleed
  1576. TLS 1.0 not vulnerable to heartbleed
  1577.  
  1578. Supported Server Cipher(s):
  1579. Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
  1580. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256
  1581. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256
  1582. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
  1583. Accepted TLSv1.2 128 bits AES128-GCM-SHA256
  1584. Accepted TLSv1.2 256 bits AES256-GCM-SHA384
  1585. Accepted TLSv1.2 128 bits AES128-SHA256
  1586. Accepted TLSv1.2 256 bits AES256-SHA256
  1587. Accepted TLSv1.2 128 bits AES128-SHA
  1588. Accepted TLSv1.2 256 bits AES256-SHA
  1589. Preferred TLSv1.1 128 bits AES128-SHA
  1590. Accepted TLSv1.1 256 bits AES256-SHA
  1591. Preferred TLSv1.0 128 bits AES128-SHA
  1592. Accepted TLSv1.0 256 bits AES256-SHA
  1593.  
  1594. SSL Certificate:
  1595. Signature Algorithm: sha256WithRSAEncryption
  1596. RSA Key Strength: 2048
  1597.  
  1598. Subject: *.sslblindado.com
  1599. Altnames: DNS:*.sslblindado.com, DNS:sslblindado.com
  1600. Issuer: RapidSSL RSA CA 2018
  1601.  
  1602. Not valid before: Dec 20 00:00:00 2018 GMT
  1603. Not valid after: Mar 20 12:00:00 2020 GMT
  1604. #######################################################################################################################################
  1605. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-05 08:31 EDT
  1606. NSE: Loaded 47 scripts for scanning.
  1607. NSE: Script Pre-scanning.
  1608. Initiating NSE at 08:31
  1609. Completed NSE at 08:31, 0.00s elapsed
  1610. Initiating NSE at 08:31
  1611. Completed NSE at 08:31, 0.00s elapsed
  1612. Initiating Ping Scan at 08:31
  1613. Scanning 187.17.111.104 [4 ports]
  1614. Completed Ping Scan at 08:31, 0.43s elapsed (1 total hosts)
  1615. Initiating Parallel DNS resolution of 1 host. at 08:31
  1616. Completed Parallel DNS resolution of 1 host. at 08:31, 0.03s elapsed
  1617. Initiating SYN Stealth Scan at 08:31
  1618. Scanning 187.17.111.104 [65535 ports]
  1619. Discovered open port 80/tcp on 187.17.111.104
  1620. Discovered open port 443/tcp on 187.17.111.104
  1621. SYN Stealth Scan Timing: About 2.99% done; ETC: 08:48 (0:16:45 remaining)
  1622. SYN Stealth Scan Timing: About 10.56% done; ETC: 08:40 (0:08:37 remaining)
  1623. SYN Stealth Scan Timing: About 19.31% done; ETC: 08:39 (0:06:20 remaining)
  1624. SYN Stealth Scan Timing: About 29.63% done; ETC: 08:38 (0:04:47 remaining)
  1625. SYN Stealth Scan Timing: About 39.69% done; ETC: 08:37 (0:03:49 remaining)
  1626. SYN Stealth Scan Timing: About 49.77% done; ETC: 08:37 (0:03:03 remaining)
  1627. SYN Stealth Scan Timing: About 65.73% done; ETC: 08:36 (0:01:50 remaining)
  1628. SYN Stealth Scan Timing: About 77.10% done; ETC: 08:36 (0:01:12 remaining)
  1629. SYN Stealth Scan Timing: About 89.15% done; ETC: 08:36 (0:00:33 remaining)
  1630. Completed SYN Stealth Scan at 08:36, 291.85s elapsed (65535 total ports)
  1631. Initiating Service scan at 08:36
  1632. Scanning 2 services on 187.17.111.104
  1633. Completed Service scan at 08:36, 14.68s elapsed (2 services on 1 host)
  1634. Initiating OS detection (try #1) against 187.17.111.104
  1635. Retrying OS detection (try #2) against 187.17.111.104
  1636. Initiating Traceroute at 08:36
  1637. Completed Traceroute at 08:36, 0.32s elapsed
  1638. Initiating Parallel DNS resolution of 2 hosts. at 08:36
  1639. Completed Parallel DNS resolution of 2 hosts. at 08:36, 0.02s elapsed
  1640. NSE: Script scanning 187.17.111.104.
  1641. Initiating NSE at 08:36
  1642. Completed NSE at 08:36, 4.12s elapsed
  1643. Initiating NSE at 08:36
  1644. Completed NSE at 08:36, 3.81s elapsed
  1645. Nmap scan report for 187.17.111.104
  1646. Host is up (0.30s latency).
  1647. Not shown: 65530 filtered ports
  1648. PORT STATE SERVICE VERSION
  1649. 25/tcp closed smtp
  1650. 80/tcp open http nginx
  1651. |_vulscan: ERROR: Script execution failed (use -d to debug)
  1652. 139/tcp closed netbios-ssn
  1653. 443/tcp open ssl/http nginx
  1654. |_vulscan: ERROR: Script execution failed (use -d to debug)
  1655. 445/tcp closed microsoft-ds
  1656. Aggressive OS guesses: Linux 4.10 (90%), HP P2000 G3 NAS device (90%), Linux 3.16 - 4.6 (88%), Linux 4.4 (88%), FreeBSD 11.0-RELEASE (86%), Linux 3.10 - 4.11 (86%), Linux 3.13 (86%), Linux 3.13 or 4.2 (86%), Linux 4.1 (86%), Linux 4.2 (86%)
  1657. No exact OS matches for host (test conditions non-ideal).
  1658. Uptime guess: 0.001 days (since Thu Sep 5 08:35:53 2019)
  1659. Network Distance: 2 hops
  1660. TCP Sequence Prediction: Difficulty=263 (Good luck!)
  1661. IP ID Sequence Generation: All zeros
  1662.  
  1663. TRACEROUTE (using port 445/tcp)
  1664. HOP RTT ADDRESS
  1665. 1 314.84 ms 10.237.204.1
  1666. 2 314.82 ms 187.17.111.104
  1667.  
  1668. NSE: Script Post-scanning.
  1669. Initiating NSE at 08:36
  1670. Completed NSE at 08:36, 0.00s elapsed
  1671. Initiating NSE at 08:36
  1672. Completed NSE at 08:36, 0.00s elapsed
  1673. #######################################################################################################################################
  1674. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-05 08:36 EDT
  1675. NSE: Loaded 47 scripts for scanning.
  1676. NSE: Script Pre-scanning.
  1677. Initiating NSE at 08:36
  1678. Completed NSE at 08:36, 0.00s elapsed
  1679. Initiating NSE at 08:36
  1680. Completed NSE at 08:36, 0.00s elapsed
  1681. Initiating Parallel DNS resolution of 1 host. at 08:36
  1682. Completed Parallel DNS resolution of 1 host. at 08:36, 0.03s elapsed
  1683. Initiating UDP Scan at 08:36
  1684. Scanning 187.17.111.104 [15 ports]
  1685. Completed UDP Scan at 08:36, 4.88s elapsed (15 total ports)
  1686. Initiating Service scan at 08:36
  1687. Scanning 13 services on 187.17.111.104
  1688. Service scan Timing: About 7.69% done; ETC: 08:58 (0:19:36 remaining)
  1689. Completed Service scan at 08:38, 102.59s elapsed (13 services on 1 host)
  1690. Initiating OS detection (try #1) against 187.17.111.104
  1691. Retrying OS detection (try #2) against 187.17.111.104
  1692. Initiating Traceroute at 08:38
  1693. Completed Traceroute at 08:38, 7.20s elapsed
  1694. Initiating Parallel DNS resolution of 1 host. at 08:38
  1695. Completed Parallel DNS resolution of 1 host. at 08:38, 0.00s elapsed
  1696. NSE: Script scanning 187.17.111.104.
  1697. Initiating NSE at 08:38
  1698. Completed NSE at 08:38, 7.97s elapsed
  1699. Initiating NSE at 08:38
  1700. Completed NSE at 08:38, 2.12s elapsed
  1701. Nmap scan report for 187.17.111.104
  1702. Host is up (0.29s latency).
  1703.  
  1704. PORT STATE SERVICE VERSION
  1705. 53/udp open|filtered domain
  1706. 67/udp open|filtered dhcps
  1707. 68/udp open|filtered dhcpc
  1708. 69/udp open|filtered tftp
  1709. 88/udp open|filtered kerberos-sec
  1710. 123/udp open|filtered ntp
  1711. 137/udp filtered netbios-ns
  1712. 138/udp filtered netbios-dgm
  1713. 139/udp open|filtered netbios-ssn
  1714. 161/udp open|filtered snmp
  1715. 162/udp open|filtered snmptrap
  1716. 389/udp open|filtered ldap
  1717. 500/udp open|filtered isakmp
  1718. |_ike-version: ERROR: Script execution failed (use -d to debug)
  1719. 520/udp open|filtered route
  1720. 2049/udp open|filtered nfs
  1721. Too many fingerprints match this host to give specific OS details
  1722.  
  1723. TRACEROUTE (using port 138/udp)
  1724. HOP RTT ADDRESS
  1725. 1 175.99 ms 10.237.204.1
  1726. 2 ... 3
  1727. 4 103.82 ms 10.237.204.1
  1728. 5 314.38 ms 10.237.204.1
  1729. 6 314.37 ms 10.237.204.1
  1730. 7 314.36 ms 10.237.204.1
  1731. 8 314.35 ms 10.237.204.1
  1732. 9 208.66 ms 10.237.204.1
  1733. 10 104.55 ms 10.237.204.1
  1734. 11 ... 18
  1735. 19 177.24 ms 10.237.204.1
  1736. 20 104.78 ms 10.237.204.1
  1737. 21 ... 27
  1738. 28 104.73 ms 10.237.204.1
  1739. 29 ...
  1740. 30 105.34 ms 10.237.204.1
  1741.  
  1742. NSE: Script Post-scanning.
  1743. Initiating NSE at 08:38
  1744. Completed NSE at 08:38, 0.00s elapsed
  1745. Initiating NSE at 08:38
  1746. Completed NSE at 08:38, 0.00s elapsed
  1747. #######################################################################################################################################
  1748. Anonymous JTSEC #OpAmazonia Full Recon #14
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!