API tools faq
paste
JTSEC1333

Anonymous JTSEC #OpAmazonia Full Recon #24

JTSEC1333
Sep 9th, 2019
1,171
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 94.04 KB | None | 0 0
raw download clone embed print report
  1. #######################################################################################################################################
  2. =======================================================================================================================================
  3. Hostname gopsp.org.br ISP Liquid Web, L.L.C
  4. Continent North America Flag
  5. US
  6. Country United States Country Code US
  7. Region Michigan Local time 09 Sep 2019 09:30 EDT
  8. City Lansing Postal Code 48917
  9. IP Address 67.225.228.134 Latitude 42.735
  10. Longitude -84.625
  11. ======================================================================================================================================
  12. ######################################################################################################################################
  13. > gopsp.org.br
  14. Server: 185.93.180.131
  15. Address: 185.93.180.131#53
  16.  
  17. Non-authoritative answer:
  18. Name: gopsp.org.br
  19. Address: 67.225.228.134
  20. >
  21. #######################################################################################################################################
  22.  
  23. domain: gopsp.org.br
  24. owner: Grande Oriente Paulista
  25. ownerid: 47.331.871/0001-51
  26. responsible: Pascoal Marracini
  27. country: BR
  28. owner-c: GROPA6
  29. admin-c: GROPA6
  30. tech-c: GROPA6
  31. billing-c: GROPA6
  32. nserver: ns1.locaweb.com.br
  33. nsstat: 20190908 AA
  34. nslastaa: 20190908
  35. nserver: ns2.locaweb.com.br
  36. nsstat: 20190908 AA
  37. nslastaa: 20190908
  38. nserver: ns3.locaweb.com.br
  39. nsstat: 20190908 AA
  40. nslastaa: 20190908
  41. saci: yes
  42. created: 20160718 #15875900
  43. changed: 20190802
  44. expires: 20240718
  45. status: published
  46.  
  47. nic-hdl-br: GROPA6
  48. person: Grande Oriente Paulista
  49. e-mail: [email protected]
  50. country: BR
  51. created: 20160623
  52. changed: 20160718
  53.  
  54. ######################################################################################################################################
  55. [+] Target : gopsp.org.br
  56.  
  57. [+] IP Address : 67.225.228.134
  58.  
  59. [+] Headers :
  60.  
  61. [+] Date : Mon, 09 Sep 2019 13:39:39 GMT
  62. [+] Server : Apache/2.4.41 (cPanel) OpenSSL/1.0.2s mod_bwlimited/1.4
  63. [+] X-Powered-By : PHP/5.6.40
  64. [+] Expires : Thu, 19 Nov 1981 08:52:00 GMT
  65. [+] Cache-Control : no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  66. [+] Pragma : no-cache
  67. [+] Content-Encoding : gzip
  68. [+] Vary : Accept-Encoding
  69. [+] Set-Cookie : PHPSESSID=rmqn16t38t18jhsj2mnatak0i6; path=/
  70. [+] Keep-Alive : timeout=2, max=500
  71. [+] Connection : Keep-Alive
  72. [+] Transfer-Encoding : chunked
  73. [+] Content-Type : text/html; charset=iso-8859-1
  74.  
  75. [+] SSL Certificate Information :
  76.  
  77. [+] commonName : gopsp.org.br
  78. [+] countryName : US
  79. [+] stateOrProvinceName : TX
  80. [+] localityName : Houston
  81. [+] organizationName : cPanel, Inc.
  82. [+] commonName : cPanel, Inc. Certification Authority
  83. [+] Version : 3
  84. [+] Serial Number : D31A0C0A2CF1B24716E776B5B1F1E40A
  85. [+] Not Before : Aug 31 00:00:00 2019 GMT
  86. [+] Not After : Nov 29 23:59:59 2019 GMT
  87. [+] OCSP : ('http://ocsp.comodoca.com',)
  88. [+] subject Alt Name : (('DNS', 'gopsp.org.br'), ('DNS', 'autodiscover.gopsp.org.br'), ('DNS', 'cpanel.gopsp.org.br'), ('DNS', 'mail.gopsp.org.br'), ('DNS', 'webdisk.gopsp.org.br'), ('DNS', 'webmail.gopsp.org.br'), ('DNS', 'www.gopsp.org.br'))
  89. [+] CA Issuers : ('http://crt.comodoca.com/cPanelIncCertificationAuthority.crt',)
  90. [+] CRL Distribution Points : ('http://crl.comodoca.com/cPanelIncCertificationAuthority.crl',)
  91.  
  92. [+] Whois Lookup :
  93.  
  94. [+] NIR : None
  95. [+] ASN Registry : arin
  96. [+] ASN : 32244
  97. [+] ASN CIDR : 67.225.128.0/17
  98. [+] ASN Country Code : US
  99. [+] ASN Date : 2007-11-26
  100. [+] ASN Description : LIQUIDWEB - Liquid Web, L.L.C, US
  101. [+] cidr : 67.225.128.0/17
  102. [+] name : LIQUIDWEB
  103. [+] handle : NET-67-225-128-0-1
  104. [+] range : 67.225.128.0 - 67.225.255.255
  105. [+] description : Liquid Web, L.L.C
  106. [+] country : US
  107. [+] state : MI
  108. [+] city : Lansing
  109. [+] address : 4210 Creyts Rd.
  110. [+] postal_code : 48917
  111. [+] emails : ['[email protected]', '[email protected]']
  112. [+] created : 2007-11-26
  113. [+] updated : 2016-12-19
  114.  
  115. [+] Crawling Target...
  116.  
  117. [+] Looking for robots.txt........[ Found ]
  118. [+] Extracting robots Links.......[ 1 ]
  119. #######################################################################################################################################
  120. [i] Scanning Site: https://gopsp.org.br
  121.  
  122.  
  123.  
  124. B A S I C I N F O
  125. ====================
  126.  
  127.  
  128. [+] Site Title: GOPSP | Grande Oriente Paulista
  129. [+] IP address: 67.225.228.134
  130. [+] Web Server: Apache/2.4.41 (cPanel) OpenSSL/1.0.2s mod_bwlimited/1.4
  131. [+] CMS: Could Not Detect
  132. [+] Cloudflare: Not Detected
  133. [+] Robots File: Found
  134.  
  135. -------------[ contents ]----------------
  136. User-agent: *
  137. Disallow: /uploads
  138.  
  139. -----------[end of contents]-------------
  140.  
  141.  
  142.  
  143. W H O I S L O O K U P
  144. ========================
  145.  
  146.  
  147. % Copyright (c) Nic.br
  148. % The use of the data below is only permitted as described in
  149. % full by the terms of use at https://registro.br/termo/en.html ,
  150. % being prohibited its distribution, commercialization or
  151. % reproduction, in particular, to use it for advertising or
  152. % any similar purpose.
  153. % 2019-09-09T10:40:18-03:00
  154.  
  155. domain: gopsp.org.br
  156. owner: Grande Oriente Paulista
  157. ownerid: 47.331.871/0001-51
  158. responsible: Pascoal Marracini
  159. country: BR
  160. owner-c: GROPA6
  161. admin-c: GROPA6
  162. tech-c: GROPA6
  163. billing-c: GROPA6
  164. nserver: ns1.locaweb.com.br
  165. nsstat: 20190908 AA
  166. nslastaa: 20190908
  167. nserver: ns2.locaweb.com.br
  168. nsstat: 20190908 AA
  169. nslastaa: 20190908
  170. nserver: ns3.locaweb.com.br
  171. nsstat: 20190908 AA
  172. nslastaa: 20190908
  173. saci: yes
  174. created: 20160718 #15875900
  175. changed: 20190802
  176. expires: 20240718
  177. status: published
  178.  
  179. nic-hdl-br: GROPA6
  180. person: Grande Oriente Paulista
  181. e-mail: [email protected]
  182. country: BR
  183. created: 20160623
  184. changed: 20160718
  185.  
  186. % Security and mail abuse issues should also be addressed to
  187. % cert.br, http://www.cert.br/ , respectivelly to [email protected]
  188. % and [email protected]
  189. %
  190. % whois.registro.br accepts only direct match queries. Types
  191. % of queries are: domain (.br), registrant (tax ID), ticket,
  192. % provider, contact handle (ID), CIDR block, IP and ASN.
  193.  
  194.  
  195.  
  196.  
  197. G E O I P L O O K U P
  198. =========================
  199.  
  200. [i] IP Address: 67.225.228.134
  201. [i] Country: United States
  202. [i] State: Michigan
  203. [i] City: Lansing
  204. [i] Latitude: 42.7348
  205. [i] Longitude: -84.6245
  206.  
  207.  
  208.  
  209.  
  210. H T T P H E A D E R S
  211. =======================
  212.  
  213.  
  214. [i] HTTP/1.1 200 OK
  215. [i] Date: Mon, 09 Sep 2019 13:40:20 GMT
  216. [i] Server: Apache/2.4.41 (cPanel) OpenSSL/1.0.2s mod_bwlimited/1.4
  217. [i] X-Powered-By: PHP/5.6.40
  218. [i] Expires: Thu, 19 Nov 1981 08:52:00 GMT
  219. [i] Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  220. [i] Pragma: no-cache
  221. [i] Set-Cookie: PHPSESSID=mu0rkj7trdf66m46e4o51vsit0; path=/
  222. [i] Vary: Accept-Encoding
  223. [i] Connection: close
  224. [i] Content-Type: text/html; charset=iso-8859-1
  225.  
  226.  
  227.  
  228.  
  229. D N S L O O K U P
  230. ===================
  231.  
  232. gopsp.org.br. 3599 IN A 67.225.228.134
  233. gopsp.org.br. 3599 IN TXT "v=spf1 a mx include:_spf.elasticemail.com ~all"
  234. gopsp.org.br. 3599 IN SOA ns1.locaweb.com.br. postmaster.locaweb.com.br. 2016081001 3600 600 1209600 3600
  235. gopsp.org.br. 3599 IN NS ns3.locaweb.com.br.
  236. gopsp.org.br. 3599 IN NS ns1.locaweb.com.br.
  237. gopsp.org.br. 3599 IN MX 10 mx.a.locaweb.com.br.
  238. gopsp.org.br. 3599 IN NS ns2.locaweb.com.br.
  239. gopsp.org.br. 3599 IN MX 10 mx.b.locaweb.com.br.
  240. gopsp.org.br. 3599 IN MX 20 mx.jk.locaweb.com.br.
  241.  
  242.  
  243.  
  244.  
  245. S U B N E T C A L C U L A T I O N
  246. ====================================
  247.  
  248. Address = 67.225.228.134
  249. Network = 67.225.228.134 / 32
  250. Netmask = 255.255.255.255
  251. Broadcast = not needed on Point-to-Point links
  252. Wildcard Mask = 0.0.0.0
  253. Hosts Bits = 0
  254. Max. Hosts = 1 (2^0 - 0)
  255. Host Range = { 67.225.228.134 - 67.225.228.134 }
  256.  
  257.  
  258.  
  259. N M A P P O R T S C A N
  260. ============================
  261.  
  262. Starting Nmap 7.70 ( https://nmap.org ) at 2019-09-09 13:40 UTC
  263. Nmap scan report for gopsp.org.br (67.225.228.134)
  264. Host is up (0.028s latency).
  265. rDNS record for 67.225.228.134: srv01.imserver.com.br
  266.  
  267. PORT STATE SERVICE
  268. 21/tcp filtered ftp
  269. 22/tcp filtered ssh
  270. 23/tcp filtered telnet
  271. 80/tcp open http
  272. 110/tcp filtered pop3
  273. 143/tcp filtered imap
  274. 443/tcp open https
  275. 3389/tcp filtered ms-wbt-server
  276.  
  277. Nmap done: 1 IP address (1 host up) scanned in 1.77 seconds
  278.  
  279.  
  280.  
  281. S U B - D O M A I N F I N D E R
  282. ==================================
  283.  
  284.  
  285. [i] Total Subdomains Found : 6
  286.  
  287. [+] Subdomain: www.brasil3.gopsp.org.br
  288. [-] IP: 67.225.228.134
  289.  
  290. [+] Subdomain: www.betha.gopsp.org.br
  291. [-] IP: 67.225.228.134
  292.  
  293. [+] Subdomain: teste.gopsp.org.br
  294. [-] IP: 191.252.4.30
  295.  
  296. [+] Subdomain: blog.gopsp.org.br
  297. [-] IP: 191.252.4.30
  298.  
  299. [+] Subdomain: webdisk.gopsp.org.br
  300. [-] IP: 67.225.228.134
  301.  
  302. [+] Subdomain: cpanel.gopsp.org.br
  303. [-] IP: 67.225.228.134
  304. #######################################################################################################################################
  305. [INFO] ------TARGET info------
  306. [*] TARGET: https://gopsp.org.br/
  307. [*] TARGET IP: 67.225.228.134
  308. [INFO] NO load balancer detected for gopsp.org.br...
  309. [*] DNS servers: ns1.locaweb.com.br.
  310. [*] TARGET server: Apache/2.4.41 (cPanel) OpenSSL/1.0.2s mod_bwlimited/1.4
  311. [*] CC: US
  312. [*] Country: United States
  313. [*] RegionCode: MI
  314. [*] RegionName: Michigan
  315. [*] City: Lansing
  316. [*] ASN: AS32244
  317. [*] BGP_PREFIX: 67.225.128.0/17
  318. [*] ISP: LIQUIDWEB - Liquid Web, L.L.C, US
  319. [INFO] SSL/HTTPS certificate detected
  320. [*] Issuer: issuer=C = US, ST = TX, L = Houston, O = "cPanel, Inc.", CN = "cPanel, Inc. Certification Authority"
  321. [*] Subject: subject=CN = gopsp.org.br
  322. [INFO] DNS enumeration:
  323. [*] ad.gopsp.org.br 67.225.228.134
  324. [*] admin.gopsp.org.br 67.225.228.134
  325. [*] ads.gopsp.org.br 67.225.228.134
  326. [*] alpha.gopsp.org.br srv01.imserver.com.br. 67.225.228.134
  327. [*] api.gopsp.org.br 67.225.228.134
  328. [*] api-online.gopsp.org.br 67.225.228.134
  329. [*] apolo.gopsp.org.br 67.225.228.134
  330. [*] app.gopsp.org.br 191.252.4.30
  331. [*] beta.gopsp.org.br 67.225.228.134
  332. [*] bi.gopsp.org.br 67.225.228.134
  333. [*] blog.gopsp.org.br 191.252.4.30
  334. [*] cdn.gopsp.org.br 67.225.228.134
  335. [*] events.gopsp.org.br 67.225.228.134
  336. [*] ex.gopsp.org.br 67.225.228.134
  337. [*] files.gopsp.org.br 67.225.228.134
  338. [*] ftp.gopsp.org.br ftp-orion06.locaweb.com.br. 179.188.15.200
  339. [*] gateway.gopsp.org.br 67.225.228.134
  340. [*] go.gopsp.org.br 67.225.228.134
  341. [*] help.gopsp.org.br 67.225.228.134
  342. [*] ib.gopsp.org.br 67.225.228.134
  343. [*] images.gopsp.org.br 67.225.228.134
  344. [*] internetbanking.gopsp.org.br 67.225.228.134
  345. [*] intranet.gopsp.org.br 67.225.228.134
  346. [*] jobs.gopsp.org.br 67.225.228.134
  347. [*] join.gopsp.org.br 67.225.228.134
  348. [*] live.gopsp.org.br 67.225.228.134
  349. [*] login.gopsp.org.br 67.225.228.134
  350. [*] m.gopsp.org.br 67.225.228.134
  351. [*] mail.gopsp.org.br pop.gopsp.org.br. mail.ita.locamail.com.br. 191.252.112.195
  352. [*] mail2.gopsp.org.br 67.225.228.134
  353. [*] mobile.gopsp.org.br pop.gopsp.org.br. mail.ita.locamail.com.br. 191.252.112.195
  354. [*] moodle.gopsp.org.br 67.225.228.134
  355. [*] mx.gopsp.org.br 67.225.228.134
  356. [*] mx2.gopsp.org.br mx.b.locaweb.com.br. 177.153.23.242
  357. [*] mx3.gopsp.org.br mx.jk.locaweb.com.br. 200.234.204.130
  358. [*] my.gopsp.org.br 67.225.228.134
  359. [*] new.gopsp.org.br 67.225.228.134
  360. [*] news.gopsp.org.br 67.225.228.134
  361. [*] ns1.gopsp.org.br ns1.locaweb.com.br. 189.126.108.2
  362. [*] ns2.gopsp.org.br ns2.locaweb.com.br. 201.76.40.2
  363. [*] ns3.gopsp.org.br ns3.locaweb.com.br. 187.45.246.2
  364. [*] oauth.gopsp.org.br 67.225.228.134
  365. [*] old.gopsp.org.br 67.225.228.134
  366. [*] one.gopsp.org.br 67.225.228.134
  367. [*] open.gopsp.org.br 67.225.228.134
  368. [*] out.gopsp.org.br 67.225.228.134
  369. [*] outlook.gopsp.org.br 67.225.228.134
  370. [*] portfolio.gopsp.org.br 67.225.228.134
  371. [*] raw.gopsp.org.br 67.225.228.134
  372. [*] repo.gopsp.org.br 67.225.228.134
  373. [*] router.gopsp.org.br 67.225.228.134
  374. [*] search.gopsp.org.br 67.225.228.134
  375. [*] siem.gopsp.org.br 67.225.228.134
  376. [*] slack.gopsp.org.br 67.225.228.134
  377. [*] slackbot.gopsp.org.br 67.225.228.134
  378. [*] snmp.gopsp.org.br 67.225.228.134
  379. [*] stream.gopsp.org.br 67.225.228.134
  380. [*] support.gopsp.org.br 67.225.228.134
  381. [*] syslog.gopsp.org.br 67.225.228.134
  382. [*] tags.gopsp.org.br 67.225.228.134
  383. [*] test.gopsp.org.br 67.225.228.134
  384. [*] upload.gopsp.org.br 67.225.228.134
  385. [*] video.gopsp.org.br 67.225.228.134
  386. [*] vpn.gopsp.org.br 67.225.228.134
  387. [*] webconf.gopsp.org.br 67.225.228.134
  388. [*] webmail.gopsp.org.br webmail.ita.locamail.com.br. 186.202.140.235 186.202.140.244 186.202.140.220
  389. [*] webportal.gopsp.org.br 67.225.228.134
  390. [*] wiki.gopsp.org.br 67.225.228.134
  391. [*] www2.gopsp.org.br 67.225.228.134
  392. [*] www3.gopsp.org.br 67.225.228.134
  393. [*] zendesk.gopsp.org.br 67.225.228.134
  394. [INFO] Possible abuse mails are:
  395. [*] [email protected]
  396. [*] [email protected]
  397. [*] [email protected]
  398. [*] [email protected]
  399. [*] [email protected]
  400. [INFO] NO PAC (Proxy Auto Configuration) file FOUND
  401. [ALERT] robots.txt file FOUND in http://gopsp.org.br/robots.txt
  402. [INFO] Checking for HTTP status codes recursively from http://gopsp.org.br/robots.txt
  403. [INFO] Status code Folders
  404. [*] 200 http://gopsp.org.br/uploads
  405. [INFO] Starting FUZZing in http://gopsp.org.br/FUzZzZzZzZz...
  406. [INFO] Status code Folders
  407. [*] 200 http://gopsp.org.br/index
  408. [*] 200 http://gopsp.org.br/images
  409. [*] 200 http://gopsp.org.br/download
  410. [*] 200 http://gopsp.org.br/2006
  411. [*] 200 http://gopsp.org.br/news
  412. [*] 200 http://gopsp.org.br/crack
  413. [*] 200 http://gopsp.org.br/serial
  414. [*] 200 http://gopsp.org.br/warez
  415. [*] 200 http://gopsp.org.br/full
  416. [*] 200 http://gopsp.org.br/12
  417. [ALERT] Look in the source code. It may contain passwords
  418. [INFO] Links found from https://gopsp.org.br/ http://67.225.228.134/:
  419. [*] http://67.225.228.134/cgi-sys/defaultwebpage.cgi
  420. [*] http://masonweb.com.br/
  421. [*] http://mmp.org.br/Account/Login.aspx?ReturnUrl=/
  422. [*] https://gopsp.org.br/
  423. [*] https://gopsp.org.br/albuns/listar
  424. [*] https://gopsp.org.br/albuns/visualizar/1
  425. [*] https://gopsp.org.br/contato
  426. [*] https://gopsp.org.br/convites/listar
  427. [*] https://gopsp.org.br/convites/visualizar/1
  428. [*] https://gopsp.org.br/esqueceu-senha
  429. [*] https://gopsp.org.br/inicio
  430. [*] https://gopsp.org.br/institucional/administracao
  431. [*] https://gopsp.org.br/institucional/grao-mestres
  432. [*] https://gopsp.org.br/institucional/nossa-historia
  433. [*] https://gopsp.org.br/lojas/listar
  434. [*] https://gopsp.org.br/maconaria
  435. [*] https://gopsp.org.br/mensagem-grao-mestre/listar
  436. [*] https://gopsp.org.br/mensagem-grao-mestre/visualizar/391
  437. [*] https://gopsp.org.br/#myCarousel
  438. [*] https://gopsp.org.br/noticias/listar
  439. [*] https://gopsp.org.br/noticias/visualizar/368
  440. [*] https://gopsp.org.br/noticias/visualizar/378
  441. [*] https://gopsp.org.br/noticias/visualizar/386
  442. [*] https://gopsp.org.br/noticias/visualizar/388
  443. [*] https://gopsp.org.br/noticias/visualizar/393
  444. [*] https://gopsp.org.br/noticias/visualizar/394
  445. [*] https://gopsp.org.br/noticias/visualizar/395
  446. [*] https://gopsp.org.br/primeiro-acesso
  447. [*] https://gopsp.org.br/videos/listar
  448. [*] https://gopsp.org.br/videos/visualizar/4
  449. [*] http://www.casadomacombarretos.com.br/
  450. [*] http://www.cmisecretariaejecutiva.org/
  451. [*] http://www.comab.org.br/
  452. [INFO] GOOGLE has 918,000 results (0.38 seconds) about http://gopsp.org.br/
  453. [INFO] BING shows 67.225.228.134 is shared with 10,000 hosts/vhosts
  454. [INFO] Shodan detected the following opened ports on 67.225.228.134:
  455. [*] 443
  456. [*] 53
  457. [*] 80
  458. [INFO] ------VirusTotal SECTION------
  459. [INFO] VirusTotal passive DNS only stores address records. The following domains resolved to the given IP address:
  460. [INFO] Latest URLs hosted in this IP address detected by at least one URL scanner or malicious URL dataset:
  461. [INFO] Latest files that are not detected by any antivirus solution and were downloaded by VirusTotal from the IP address provided:
  462. [INFO] ------Alexa Rank SECTION------
  463. [INFO] Percent of Visitors Rank in Country:
  464. [INFO] Percent of Search Traffic:
  465. [INFO] Percent of Unique Visits:
  466. [INFO] Total Sites Linking In:
  467. [*] Total Sites
  468. [INFO] Useful links related to gopsp.org.br - 67.225.228.134:
  469. [*] https://www.virustotal.com/pt/ip-address/67.225.228.134/information/
  470. [*] https://www.hybrid-analysis.com/search?host=67.225.228.134
  471. [*] https://www.shodan.io/host/67.225.228.134
  472. [*] https://www.senderbase.org/lookup/?search_string=67.225.228.134
  473. [*] https://www.alienvault.com/open-threat-exchange/ip/67.225.228.134
  474. [*] http://pastebin.com/search?q=67.225.228.134
  475. [*] http://urlquery.net/search.php?q=67.225.228.134
  476. [*] http://www.alexa.com/siteinfo/gopsp.org.br
  477. [*] http://www.google.com/safebrowsing/diagnostic?site=gopsp.org.br
  478. [*] https://censys.io/ipv4/67.225.228.134
  479. [*] https://www.abuseipdb.com/check/67.225.228.134
  480. [*] https://urlscan.io/search/#67.225.228.134
  481. [*] https://github.com/search?q=67.225.228.134&type=Code
  482. [INFO] Useful links related to AS32244 - 67.225.128.0/17:
  483. [*] http://www.google.com/safebrowsing/diagnostic?site=AS:32244
  484. [*] https://www.senderbase.org/lookup/?search_string=67.225.128.0/17
  485. [*] http://bgp.he.net/AS32244
  486. [*] https://stat.ripe.net/AS32244
  487. [INFO] Date: 09/09/19 | Time: 09:42:49
  488. [INFO] Total time: 2 minute(s) and 38 second(s)
  489. #######################################################################################################################################
  490. [*] Load target domain: gopsp.org.br
  491. - starting scanning @ 2019-09-09 09:42:57
  492.  
  493. [+] Running & Checking source to be used
  494. ---------------------------------------------
  495.  
  496. ⍥ Shodan [ ✕ ]
  497. ⍥ Webarchive [ ✔ ]
  498. ⍥ Dnsdumpster [ ✔ ]
  499. ⍥ Censys [ ✕ ]
  500. ⍥ Bufferover [ ✔ ]
  501. ⍥ Threatcrowd [ ✔ ]
  502. ⍥ Securitytrails [ ✕ ]
  503. ⍥ Binaryedge [ ✕ ]
  504. ⍥ Certsh [ ✔ ]
  505. ⍥ Virustotal [ ✕ ]
  506. ⍥ Certspotter [ ✔ ]
  507. ⍥ Entrust [ ✔ ]
  508. ⍥ Hackertarget [ ✔ ]
  509. ⍥ Threatminer [ ✔ ]
  510. ⍥ Riddler [ ✔ ]
  511. jq: error (at <stdin>:0): Cannot iterate over null (null)
  512. ⍥ Findsubdomain [ ✔ ]
  513.  
  514. [+] Get & Count subdomain total From source
  515. ---------------------------------------------
  516.  
  517. ⍥ Hackertarget: Total Subdomain (7)
  518. ⍥ Findsubdomain: Total Subdomain (0)
  519. ⍥ Certspotter: Total Subdomain (15)
  520. ⍥ Threatminer: Total Subdomain (0)
  521. ⍥ Certsh: Total Subdomain (14)
  522. ⍥ BufferOver: Total Subdomain (13)
  523. ⍥ Entrust: Total Subdomain (5)
  524. ⍥ Threatcrowd: Total Subdomain (0)
  525. ⍥ Dnsdumpster: Total Subdomain (0)
  526. ⍥ Riddler: Total Subdomain (0)
  527. ⍥ Webarchive: Total Subdomain (3)
  528.  
  529. [+] Parsing & Sorting list Domain
  530. ---------------------------------------------
  531.  
  532. ⍥ Total [18]
  533.  
  534. - alpha.gopsp.org.br
  535. - app.gopsp.org.br
  536. - autodiscover.gopsp.org.br
  537. - betha.gopsp.org.br
  538. - blog.gopsp.org.br
  539. - brasil3.gopsp.org.br
  540. - cpanel.gopsp.org.br
  541. - gopsp.org.br
  542. - mail.gopsp.org.br
  543. - pop.gopsp.org.br
  544. - teste.gopsp.org.br
  545. - webdisk.gopsp.org.br
  546. - webmail.gopsp.org.br
  547. - www.alpha.gopsp.org.br
  548. - www.betha.gopsp.org.br
  549. - www.brasil3.gopsp.org.br
  550. - www.gopsp.org.br
  551. - www.teste.gopsp.org.br
  552.  
  553. ⍥ Total [18]
  554.  
  555. [+] Probe subdomain for working on http/https
  556. ---------------------------------------------
  557.  
  558. - http://gopsp.org.br
  559. - http://alpha.gopsp.org.br
  560. - http://brasil3.gopsp.org.br
  561. - http://cpanel.gopsp.org.br
  562. - http://pop.gopsp.org.br
  563. - http://mail.gopsp.org.br
  564. - http://autodiscover.gopsp.org.br
  565. - https://gopsp.org.br
  566. - https://brasil3.gopsp.org.br
  567. - https://alpha.gopsp.org.br
  568. - https://cpanel.gopsp.org.br
  569. - http://webdisk.gopsp.org.br
  570. - http://www.alpha.gopsp.org.br
  571. - https://mail.gopsp.org.br
  572. - https://pop.gopsp.org.br
  573. - http://webmail.gopsp.org.br
  574. - http://www.gopsp.org.br
  575. - https://webdisk.gopsp.org.br
  576. - http://www.betha.gopsp.org.br
  577. - http://www.brasil3.gopsp.org.br
  578. - https://www.alpha.gopsp.org.br
  579. - https://www.gopsp.org.br
  580. - https://www.betha.gopsp.org.br
  581. - https://www.brasil3.gopsp.org.br
  582. - https://webmail.gopsp.org.br
  583.  
  584. ⍥ Total [24]
  585.  
  586.  
  587. [+] Check Live Host: Ping Sweep - ICMP PING
  588. ---------------------------------------------
  589.  
  590. ⍥ [DEAD] alpha.gopsp.org.br
  591. ⍥ [LIVE] app.gopsp.org.br
  592. ⍥ [LIVE] autodiscover.gopsp.org.br
  593. ⍥ [DEAD] betha.gopsp.org.br
  594. ⍥ [LIVE] blog.gopsp.org.br
  595. ⍥ [DEAD] brasil3.gopsp.org.br
  596. ⍥ [DEAD] cpanel.gopsp.org.br
  597. ⍥ [DEAD] gopsp.org.br
  598. ⍥ [LIVE] mail.gopsp.org.br
  599. ⍥ [LIVE] pop.gopsp.org.br
  600. ⍥ [LIVE] teste.gopsp.org.br
  601. ⍥ [DEAD] webdisk.gopsp.org.br
  602. ⍥ [LIVE] webmail.gopsp.org.br
  603. ⍥ [DEAD] www.alpha.gopsp.org.br
  604. ⍥ [DEAD] www.betha.gopsp.org.br
  605. ⍥ [DEAD] www.brasil3.gopsp.org.br
  606. ⍥ [DEAD] www.gopsp.org.br
  607. ⍥ [LIVE] www.teste.gopsp.org.br
  608.  
  609. [+] Check Resolving: Subdomains & Domains
  610. ---------------------------------------------
  611.  
  612. ⍥ Resolving domains to: 67.225.228.134
  613. ⍥ Resolving domains to: 191.252.4.30
  614. ⍥ Resolving domains to: 186.202.140.232
  615. ⍥ Resolving domains to: 67.225.228.134
  616. ⍥ Resolving domains to: 191.252.4.30
  617. ⍥ Resolving domains to: 67.225.228.134
  618. ⍥ Resolving domains to: 67.225.228.134
  619. ⍥ Resolving domains to: 67.225.228.134
  620. ⍥ Resolving domains to: 191.252.112.195
  621. ⍥ Resolving domains to: 191.252.112.195
  622. ⍥ Resolving domains to: 191.252.4.30
  623. ⍥ Resolving domains to: 67.225.228.134
  624. ⍥ Resolving domains to: 186.202.140.220
  625. ⍥ Resolving domains to: 67.225.228.134
  626. ⍥ Resolving domains to: 67.225.228.134
  627. ⍥ Resolving domains to: 67.225.228.134
  628. ⍥ Resolving domains to: 67.225.228.134
  629. ⍥ Resolving domains to: 191.252.4.30
  630.  
  631. [+] Subdomain TakeOver - Check Possible Vulns
  632. ---------------------------------------------
  633.  
  634. ⍥ [FAILS] En: Unknown http://gopsp.org.br
  635. ⍥ [FAILS] En: Unknown http://alpha.gopsp.org.br
  636. ⍥ [FAILS] En: Unknown http://brasil3.gopsp.org.br
  637. ⍥ [FAILS] En: Unknown http://cpanel.gopsp.org.br
  638. ⍥ [FAILS] En: Unknown http://pop.gopsp.org.br
  639. ⍥ [FAILS] En: Unknown http://autodiscover.gopsp.org.br
  640. ⍥ [FAILS] En: Unknown https://alpha.gopsp.org.br
  641. ⍥ [FAILS] En: Unknown https://gopsp.org.br
  642. ⍥ [FAILS] En: Unknown https://cpanel.gopsp.org.br
  643. ⍥ [FAILS] En: Unknown https://brasil3.gopsp.org.br
  644. ⍥ [FAILS] En: Unknown http://webdisk.gopsp.org.br
  645. ⍥ [FAILS] En: Unknown http://www.alpha.gopsp.org.br
  646. ⍥ [FAILS] En: Unknown https://pop.gopsp.org.br
  647. ⍥ [FAILS] En: Unknown https://mail.gopsp.org.br
  648. ⍥ [FAILS] En: Unknown http://webmail.gopsp.org.br
  649. ⍥ [FAILS] En: Unknown https://webdisk.gopsp.org.br
  650. ⍥ [FAILS] En: Unknown http://www.betha.gopsp.org.br
  651. ⍥ [FAILS] En: Unknown https://www.alpha.gopsp.org.br
  652. ⍥ [FAILS] En: Unknown http://www.gopsp.org.br
  653. ⍥ [FAILS] En: Unknown http://www.brasil3.gopsp.org.br
  654. ⍥ [FAILS] En: Unknown https://www.betha.gopsp.org.br
  655. ⍥ [FAILS] En: Unknown https://www.gopsp.org.br
  656. ⍥ [FAILS] En: Unknown https://www.brasil3.gopsp.org.br
  657. ⍥ [FAILS] En: Unknown https://webmail.gopsp.org.br
  658.  
  659. [+] Checks status code on port 80 and 443
  660. ---------------------------------------------
  661.  
  662. ⍥ [301] http://gopsp.org.br
  663. ⍥ [301] http://alpha.gopsp.org.br
  664. ⍥ [200] http://brasil3.gopsp.org.br
  665. ⍥ [302] http://cpanel.gopsp.org.br
  666. ⍥ [302] http://pop.gopsp.org.br
  667. ⍥ [200] http://autodiscover.gopsp.org.br
  668. ⍥ [200] https://alpha.gopsp.org.br
  669. ⍥ [200] https://gopsp.org.br
  670. ⍥ [401] https://cpanel.gopsp.org.br
  671. ⍥ [200] https://brasil3.gopsp.org.br
  672. ⍥ [302] http://webdisk.gopsp.org.br
  673. ⍥ [301] http://www.alpha.gopsp.org.br
  674. ⍥ [000] https://pop.gopsp.org.br
  675. ⍥ [000] https://mail.gopsp.org.br
  676. ⍥ [302] http://webmail.gopsp.org.br
  677. ⍥ [401] https://webdisk.gopsp.org.br
  678. ⍥ [200] http://www.betha.gopsp.org.br
  679. ⍥ [301] https://www.alpha.gopsp.org.br
  680. ⍥ [301] http://www.gopsp.org.br
  681. ⍥ [200] http://www.brasil3.gopsp.org.br
  682. ⍥ [200] https://www.betha.gopsp.org.br
  683. ⍥ [301] https://www.gopsp.org.br
  684. ⍥ [200] https://www.brasil3.gopsp.org.br
  685. ⍥ [000] https://webmail.gopsp.org.br
  686.  
  687. [+] Web Screenshots: from domain list
  688. ---------------------------------------------
  689.  
  690. [+] 24 URLs to be screenshot
  691.  
  692. [ERROR][http://gopsp.org.br:80] Screenshot somehow failed
  693.  
  694. [ERROR][http://alpha.gopsp.org.br:80] Screenshot somehow failed
  695.  
  696. [ERROR][http://cpanel.gopsp.org.br:80] Screenshot somehow failed
  697.  
  698. [ERROR][https://alpha.gopsp.org.br:443] Screenshot somehow failed
  699.  
  700. [ERROR][https://gopsp.org.br:443] Screenshot somehow failed
  701.  
  702. [ERROR][http://webdisk.gopsp.org.br:80] Screenshot somehow failed
  703.  
  704. [ERROR][http://www.alpha.gopsp.org.br:80] Screenshot somehow failed
  705.  
  706. [ERROR][https://webdisk.gopsp.org.br:443] HTTP Authentication requested, try to pass credentials with -u and -b options
  707. [ERROR][https://www.alpha.gopsp.org.br:443] Screenshot somehow failed
  708.  
  709. [ERROR][http://www.gopsp.org.br:80] Screenshot somehow failed
  710.  
  711. [ERROR][https://www.gopsp.org.br:443] Screenshot somehow failed
  712.  
  713. [+] 13 actual URLs screenshot
  714. [+] 11 error(s)
  715. http://gopsp.org.br:80
  716. http://alpha.gopsp.org.br:80
  717. http://cpanel.gopsp.org.br:80
  718. https://alpha.gopsp.org.br:443
  719. https://gopsp.org.br:443
  720. http://webdisk.gopsp.org.br:80
  721. http://www.alpha.gopsp.org.br:80
  722. https://webdisk.gopsp.org.br:443
  723. https://www.alpha.gopsp.org.br:443
  724. http://www.gopsp.org.br:80
  725. https://www.gopsp.org.br:443
  726.  
  727. [+] Sud⍥my has been sucessfully completed
  728. ---------------------------------------------
  729.  
  730. ⍥ Location output:
  731. - output/09-09-2019/gopsp.org.br
  732. - output/09-09-2019/gopsp.org.br/report
  733. - output/09-09-2019/gopsp.org.br/screenshots
  734.  
  735.  
  736. #######################################################################################################################################
  737. Trying "gopsp.org.br"
  738. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22550
  739. ;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 3, ADDITIONAL: 6
  740.  
  741. ;; QUESTION SECTION:
  742. ;gopsp.org.br. IN ANY
  743.  
  744. ;; ANSWER SECTION:
  745. gopsp.org.br. 3600 IN SOA ns1.locaweb.com.br. postmaster.locaweb.com.br. 2016081001 3600 600 1209600 3600
  746. gopsp.org.br. 3600 IN TXT "v=spf1 a mx include:_spf.elasticemail.com ~all"
  747. gopsp.org.br. 3600 IN MX 10 mx.a.locaweb.com.br.
  748. gopsp.org.br. 3600 IN MX 20 mx.jk.locaweb.com.br.
  749. gopsp.org.br. 3600 IN MX 10 mx.b.locaweb.com.br.
  750. gopsp.org.br. 3600 IN A 67.225.228.134
  751. gopsp.org.br. 3600 IN NS ns3.locaweb.com.br.
  752. gopsp.org.br. 3600 IN NS ns2.locaweb.com.br.
  753. gopsp.org.br. 3600 IN NS ns1.locaweb.com.br.
  754.  
  755. ;; AUTHORITY SECTION:
  756. gopsp.org.br. 3600 IN NS ns1.locaweb.com.br.
  757. gopsp.org.br. 3600 IN NS ns2.locaweb.com.br.
  758. gopsp.org.br. 3600 IN NS ns3.locaweb.com.br.
  759.  
  760. ;; ADDITIONAL SECTION:
  761. ns2.locaweb.com.br. 1277 IN A 201.76.40.2
  762. ns2.locaweb.com.br. 1277 IN AAAA 2804:218:d2::cafe
  763. ns3.locaweb.com.br. 1277 IN A 187.45.246.2
  764. ns3.locaweb.com.br. 1277 IN AAAA 2804:218:d3::faca
  765. ns1.locaweb.com.br. 1556 IN A 189.126.108.2
  766. ns1.locaweb.com.br. 1277 IN AAAA 2804:218:d1::ca5a
  767.  
  768. Received 456 bytes from 2001:18c0:121:6900:724f:b8ff:fefd:5b6a#53 in 322 ms
  769. ######################################################################################################################################
  770. ; <<>> DiG 9.11.5-P4-5.1+b1-Debian <<>> +trace gopsp.org.br
  771. ;; global options: +cmd
  772. . 85200 IN NS a.root-servers.net.
  773. . 85200 IN NS h.root-servers.net.
  774. . 85200 IN NS d.root-servers.net.
  775. . 85200 IN NS j.root-servers.net.
  776. . 85200 IN NS k.root-servers.net.
  777. . 85200 IN NS g.root-servers.net.
  778. . 85200 IN NS l.root-servers.net.
  779. . 85200 IN NS b.root-servers.net.
  780. . 85200 IN NS i.root-servers.net.
  781. . 85200 IN NS c.root-servers.net.
  782. . 85200 IN NS m.root-servers.net.
  783. . 85200 IN NS f.root-servers.net.
  784. . 85200 IN NS e.root-servers.net.
  785. . 85200 IN RRSIG NS 8 0 518400 20190922050000 20190909040000 59944 . UdevRT5xRd+xLrIiCOgOJvCQyYg+GtsS+27xyFTrdzuu147InV6Z3rJG 588jQ6Qkv54DO2olI94IRTo+7rGpvBg3QR3uPNAI2CXyL3RtADrjQ1Eh AhvGuq3VAjGoLh4upughjB5Vz3ZFnj8hv+KeEodYDXEk58uAHnWM+fVt EI660UE2Lsm20pjkt6DC7ePkdad9c4tSboSCWUtqWJASkWDMJ27Jn4ww EWGx/QqfPV+gnd/dvB1iGbuk9KeUR7ZSVktrfsgAf3MWVx2yL9irmqf3 8haedccQxutc8B19xH9jUrW3BdLV0/BzINhBjmG1DVRi5P69ZonS5f/G PVh+Zg==
  786. ;; Received 525 bytes from 185.93.180.131#53(185.93.180.131) in 1338 ms
  787.  
  788. br. 172800 IN NS a.dns.br.
  789. br. 172800 IN NS b.dns.br.
  790. br. 172800 IN NS c.dns.br.
  791. br. 172800 IN NS d.dns.br.
  792. br. 172800 IN NS e.dns.br.
  793. br. 172800 IN NS f.dns.br.
  794. br. 86400 IN DS 2471 13 2 5E4F35998B8F909557FA119C4CBFDCA2D660A26F069EF006B403758A 07D1A2E4
  795. br. 86400 IN RRSIG DS 8 1 86400 20190922050000 20190909040000 59944 . eathNtSWCMFofqyFnBqLlcsVVKDFAlK+PamhkBp3lhY4m7S4PvLLwgkn //H85vSB0LAn38S0rDACEJKfhIVXapb6BQXMkHAcY9ULvb30tckH7J2k q+ivqz/dvBpyFIpRcmIf1M6ugMvlSxeU16gRvUPcCodj5iX3rzwa+vU6 xp+DD8GKOf6uNe5F3Si/1yB51c59JAa9V2IIH+aYQRziP8VKt9zQtMQR v2qGYOEnKHBdpt+Slv1uIwFNL5o941DtR7OQl/IZ9LRPq7zuQtHDirPA /+4LeVKOYEFyy61xg5KBq+17yMAYk59mCl3OQc+KjMbdK1iZat1ucnbn F4poUQ==
  796. ;; Received 740 bytes from 198.41.0.4#53(a.root-servers.net) in 111 ms
  797.  
  798. gopsp.org.br. 3600 IN NS ns1.locaweb.com.br.
  799. gopsp.org.br. 3600 IN NS ns3.locaweb.com.br.
  800. gopsp.org.br. 3600 IN NS ns2.locaweb.com.br.
  801. 8ibcveen5720n44l12on35ti99p48dfq.org.br. 900 IN NSEC3 1 1 10 1ED197E8FB8CAF6322BC 8ICM44EE54CNOQDKEDVKHHOQFOIQG8RR NS SOA RRSIG DNSKEY NSEC3PARAM
  802. 8ibcveen5720n44l12on35ti99p48dfq.org.br. 900 IN RRSIG NSEC3 13 3 900 20190923142508 20190909132508 50774 org.br. POHX2yzwVItWfgepNS5RUO+X0Py3v1asktbwGIPFbsWE9LEMkURRMJ50 t7KPnfolXAL/l7Nf5yNduH1IFTG+3A==
  803. s02nj6vqgl2gqaaum4crgvqn1jihuqab.org.br. 900 IN NSEC3 1 1 10 1ED197E8FB8CAF6322BC S064UIRLQCM5TUK930EGMC0PM1HOQALS NS DS RRSIG
  804. s02nj6vqgl2gqaaum4crgvqn1jihuqab.org.br. 900 IN RRSIG NSEC3 13 3 900 20190920144512 20190906134512 50774 org.br. bI7PQJSNVeOwvN5ZyvlKNmJFDlixr/XE1icsSLRqLKBgDk19sSjQD74Z baLSNFVwR5KdcfYfgJjWP29ydhZqcA==
  805. ;; Received 518 bytes from 2001:12f8:8::10#53(b.dns.br) in 114 ms
  806.  
  807. ;; expected opt record in response
  808. gopsp.org.br. 3600 IN A 67.225.228.134
  809. ;; Received 46 bytes from 2804:218:d2::cafe#53(ns2.locaweb.com.br) in 160 ms
  810. #######################################################################################################################################
  811. [*] Performing General Enumeration of Domain: gopsp.org.br
  812. [!] Wildcard resolution is enabled on this domain
  813. [!] It is resolving to 67.225.228.134
  814. [!] All queries will resolve to this address!!
  815. [-] DNSSEC is not configured for gopsp.org.br
  816. [*] SOA ns1.locaweb.com.br 189.126.108.2
  817. [*] NS ns2.locaweb.com.br 201.76.40.2
  818. [*] NS ns2.locaweb.com.br 2804:218:d2::cafe
  819. [*] NS ns3.locaweb.com.br 187.45.246.2
  820. [*] NS ns3.locaweb.com.br 2804:218:d3::faca
  821. [*] NS ns1.locaweb.com.br 189.126.108.2
  822. [*] NS ns1.locaweb.com.br 2804:218:d1::ca5a
  823. [*] MX mx.a.locaweb.com.br 186.202.4.42
  824. [*] MX mx.jk.locaweb.com.br 200.234.204.130
  825. [*] MX mx.b.locaweb.com.br 177.153.23.242
  826. [*] A gopsp.org.br 67.225.228.134
  827. [*] TXT gopsp.org.br v=spf1 a mx include:_spf.elasticemail.com ~all
  828. [*] Enumerating SRV Records
  829. [-] No SRV Records Found for gopsp.org.br
  830. [+] 0 Records Found
  831. #######################################################################################################################################
  832. [*] Processing domain gopsp.org.br
  833. [*] Using system resolvers ['185.93.180.131', '194.187.251.67', '38.132.106.139', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  834. [+] Getting nameservers
  835. 201.76.40.2 - ns2.locaweb.com.br
  836. 187.45.246.2 - ns3.locaweb.com.br
  837. 189.126.108.2 - ns1.locaweb.com.br
  838. [-] Zone transfer failed
  839.  
  840. [+] TXT records found
  841. "v=spf1 a mx include:_spf.elasticemail.com ~all"
  842.  
  843. [+] MX records found, added to target list
  844. 10 mx.a.locaweb.com.br.
  845. 20 mx.jk.locaweb.com.br.
  846. 10 mx.b.locaweb.com.br.
  847.  
  848. [+] Wildcard domain found - 67.225.228.134
  849. [*] Scanning gopsp.org.br for A records
  850. 191.252.4.30 - app.gopsp.org.br
  851. 186.202.140.232 - autodiscover.gopsp.org.br
  852. 191.252.4.30 - blog.gopsp.org.br
  853. 179.188.15.200 - ftp.gopsp.org.br
  854. 191.252.112.195 - imap.gopsp.org.br
  855. 191.252.112.194 - imap3.gopsp.org.br
  856. 191.252.112.195 - mail.gopsp.org.br
  857. 191.252.112.195 - mobile.gopsp.org.br
  858. 186.202.4.42 - mx1.gopsp.org.br
  859. 177.153.23.242 - mx2.gopsp.org.br
  860. 200.234.204.130 - mx3.gopsp.org.br
  861. 189.126.108.2 - ns1.gopsp.org.br
  862. 187.45.246.2 - ns3.gopsp.org.br
  863. 201.76.40.2 - ns2.gopsp.org.br
  864. 186.202.48.30 - painel.gopsp.org.br
  865. 191.252.112.195 - pda.gopsp.org.br
  866. 191.252.112.195 - pop.gopsp.org.br
  867. 191.252.112.195 - pop3.gopsp.org.br
  868. 191.252.112.195 - smtp.gopsp.org.br
  869. 54.38.226.140 - tracking.gopsp.org.br
  870. 94.23.161.19 - tracking.gopsp.org.br
  871. 188.165.1.80 - tracking.gopsp.org.br
  872. 46.105.88.234 - tracking.gopsp.org.br
  873. 164.132.95.123 - tracking.gopsp.org.br
  874. 186.202.140.244 - webmail.gopsp.org.br
  875. 186.202.140.235 - webmail.gopsp.org.br
  876. 186.202.140.220 - webmail.gopsp.org.br
  877. #######################################################################################################################################
  878.  
  879.  
  880.  
  881. AVAILABLE PLUGINS
  882. -----------------
  883.  
  884. CompressionPlugin
  885. CertificateInfoPlugin
  886. RobotPlugin
  887. OpenSslCipherSuitesPlugin
  888. SessionResumptionPlugin
  889. EarlyDataPlugin
  890. HeartbleedPlugin
  891. FallbackScsvPlugin
  892. SessionRenegotiationPlugin
  893. OpenSslCcsInjectionPlugin
  894. HttpHeadersPlugin
  895.  
  896.  
  897.  
  898. CHECKING HOST(S) AVAILABILITY
  899. -----------------------------
  900.  
  901. 67.225.228.134:443 => 67.225.228.134
  902.  
  903.  
  904.  
  905.  
  906. SCAN RESULTS FOR 67.225.228.134:443 - 67.225.228.134
  907. ----------------------------------------------------
  908.  
  909. * SSLV2 Cipher Suites:
  910. Server rejected all cipher suites.
  911.  
  912. * Certificate Information:
  913. Content
  914. SHA1 Fingerprint: 27d9cf57edd65b4fd3dc82e076aeb7f73bf4b91d
  915. Common Name: goba.org.br
  916. Issuer: cPanel, Inc. Certification Authority
  917. Serial Number: 198705539120532982707046231779006044473
  918. Not Before: 2019-07-05 00:00:00
  919. Not After: 2019-10-03 23:59:59
  920. Signature Algorithm: sha256
  921. Public Key Algorithm: RSA
  922. Key Size: 2048
  923. Exponent: 65537 (0x10001)
  924. DNS Subject Alternative Names: ['goba.org.br', 'autodiscover.goba.org.br', 'cpanel.goba.org.br', 'mail.goba.org.br', 'webdisk.goba.org.br', 'webmail.goba.org.br', 'www.goba.org.br']
  925.  
  926. Trust
  927. Hostname Validation: FAILED - Certificate does NOT match 67.225.228.134
  928. Android CA Store (9.0.0_r9): OK - Certificate is trusted
  929. Apple CA Store (iOS 12, macOS 10.14, watchOS 5, and tvOS 12):OK - Certificate is trusted
  930. Java CA Store (jdk-12.0.1): OK - Certificate is trusted
  931. Mozilla CA Store (2019-03-14): OK - Certificate is trusted
  932. Windows CA Store (2019-05-27): OK - Certificate is trusted
  933. Symantec 2018 Deprecation: WARNING: Certificate distrusted by Google and Mozilla on September 2018
  934. Received Chain: goba.org.br --> cPanel, Inc. Certification Authority --> COMODO RSA Certification Authority
  935. Verified Chain: goba.org.br --> cPanel, Inc. Certification Authority --> COMODO RSA Certification Authority
  936. Received Chain Contains Anchor: OK - Anchor certificate not sent
  937. Received Chain Order: OK - Order is valid
  938. Verified Chain contains SHA1: OK - No SHA1-signed certificate in the verified certificate chain
  939.  
  940. Extensions
  941. OCSP Must-Staple: NOT SUPPORTED - Extension not found
  942. Certificate Transparency: WARNING - Only 2 SCTs included but Google recommends 3 or more
  943.  
  944. OCSP Stapling
  945. OCSP Response Status: successful
  946. Validation w/ Mozilla Store: OK - Response is trusted
  947. Responder Id: 7E035A65416BA77E0AE1B89D08EA1D8E1D6AC765
  948. Cert Status: good
  949. Cert Serial Number: 957D4B7768AA13A1AC850A3833E95939
  950. This Update: Sep 6 17:02:00 2019 GMT
  951. Next Update: Sep 13 17:02:00 2019 GMT
  952.  
  953. * TLSV1_3 Cipher Suites:
  954. Server rejected all cipher suites.
  955.  
  956. * Deflate Compression:
  957. OK - Compression disabled
  958.  
  959. * TLSV1_1 Cipher Suites:
  960. Forward Secrecy OK - Supported
  961. RC4 OK - Not Supported
  962.  
  963. Preferred:
  964. None - Server followed client cipher suite preference.
  965. Accepted:
  966. TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  967. TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  968. TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  969. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  970. TLS_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  971. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  972. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  973. TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  974. TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  975. TLS_DHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  976. TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  977.  
  978. * TLSV1_2 Cipher Suites:
  979. Forward Secrecy OK - Supported
  980. RC4 OK - Not Supported
  981.  
  982. Preferred:
  983. None - Server followed client cipher suite preference.
  984. Accepted:
  985. TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  986. TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  987. TLS_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 200 OK
  988. TLS_RSA_WITH_AES_256_CBC_SHA256 256 bits HTTP 200 OK
  989. TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  990. TLS_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 200 OK
  991. TLS_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 200 OK
  992. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  993. TLS_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  994. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 200 OK
  995. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 256 bits HTTP 200 OK
  996. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  997. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 200 OK
  998. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 200 OK
  999. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  1000. TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  1001. TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  1002. TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 200 OK
  1003. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 256 bits HTTP 200 OK
  1004. TLS_DHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  1005. TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 200 OK
  1006. TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 200 OK
  1007. TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  1008.  
  1009. * TLSV1 Cipher Suites:
  1010. Forward Secrecy OK - Supported
  1011. RC4 OK - Not Supported
  1012.  
  1013. Preferred:
  1014. None - Server followed client cipher suite preference.
  1015. Accepted:
  1016. TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  1017. TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  1018. TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  1019. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  1020. TLS_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  1021. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  1022. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  1023. TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  1024. TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  1025. TLS_DHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  1026. TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  1027.  
  1028. * Downgrade Attacks:
  1029. TLS_FALLBACK_SCSV: OK - Supported
  1030.  
  1031. * OpenSSL Heartbleed:
  1032. OK - Not vulnerable to Heartbleed
  1033.  
  1034. * TLS 1.2 Session Resumption Support:
  1035. With Session IDs: OK - Supported (5 successful, 0 failed, 0 errors, 5 total attempts).
  1036. With TLS Tickets: OK - Supported
  1037.  
  1038. * Session Renegotiation:
  1039. Client-initiated Renegotiation: OK - Rejected
  1040. Secure Renegotiation: OK - Supported
  1041.  
  1042. * OpenSSL CCS Injection:
  1043. OK - Not vulnerable to OpenSSL CCS injection
  1044.  
  1045. * SSLV3 Cipher Suites:
  1046. Server rejected all cipher suites.
  1047.  
  1048. * ROBOT Attack:
  1049. OK - Not vulnerable
  1050.  
  1051.  
  1052. SCAN COMPLETED IN 18.28 S
  1053. -------------------------
  1054. #######################################################################################################################################
  1055. Domains still to check: 1
  1056. Checking if the hostname gopsp.org.br. given is in fact a domain...
  1057.  
  1058. Analyzing domain: gopsp.org.br.
  1059. Checking NameServers using system default resolver...
  1060. IP: 201.76.40.2 (Brazil)
  1061. HostName: ns2.locaweb.com.br Type: NS
  1062. HostName: ns2.locaweb.com.br Type: PTR
  1063. IP: 189.126.108.2 (Brazil)
  1064. HostName: ns1.locaweb.com.br Type: NS
  1065. HostName: ns1.locaweb.com.br Type: PTR
  1066. IP: 187.45.246.2 (Brazil)
  1067. HostName: ns3.locaweb.com.br Type: NS
  1068. HostName: ns3.locaweb.com.br Type: PTR
  1069.  
  1070. Checking MailServers using system default resolver...
  1071. IP: 200.234.204.130 (Brazil)
  1072. HostName: mx.jk.locaweb.com.br Type: MX
  1073. HostName: mx.jk.locaweb.com.br Type: PTR
  1074. IP: 186.202.4.42 (Brazil)
  1075. HostName: mx.a.locaweb.com.br Type: MX
  1076. HostName: mx.a.locaweb.com.br Type: PTR
  1077. IP: 177.153.23.242 (Brazil)
  1078. HostName: mx.b.locaweb.com.br Type: MX
  1079. WARNING!! This domain has wildcards activated for hostnames resolution. We are checking "www" anyway, but perhaps it doesn't exists!
  1080.  
  1081. Checking the zone transfer for each NS... (if this takes more than 10 seconds, just hit CTRL-C and it will continue. Bug in the libs)
  1082. No zone transfer found on nameserver 187.45.246.2
  1083. No zone transfer found on nameserver 201.76.40.2
  1084. No zone transfer found on nameserver 189.126.108.2
  1085.  
  1086. Checking SPF record...
  1087.  
  1088. Checking SPF record...
  1089. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 176.31.7.0/25, but only the network IP
  1090. New IP found: 176.31.7.0
  1091. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 178.33.84.64/27, but only the network IP
  1092. New IP found: 178.33.84.64
  1093. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 174.142.165.40/29, but only the network IP
  1094. New IP found: 174.142.165.40
  1095. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 174.142.128.32/27, but only the network IP
  1096. New IP found: 174.142.128.32
  1097. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 5.135.241.64/26, but only the network IP
  1098. New IP found: 5.135.241.64
  1099. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 5.135.31.128/27, but only the network IP
  1100. New IP found: 5.135.31.128
  1101. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 188.165.95.224/27, but only the network IP
  1102. New IP found: 188.165.95.224
  1103. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 176.31.140.80/28, but only the network IP
  1104. New IP found: 176.31.140.80
  1105.  
  1106. Checking SPF record...
  1107. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 176.31.69.160/28, but only the network IP
  1108. New IP found: 176.31.69.160
  1109. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 176.31.145.240/28, but only the network IP
  1110. New IP found: 176.31.145.240
  1111. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 188.165.144.128/28, but only the network IP
  1112. New IP found: 188.165.144.128
  1113. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 37.59.169.64/28, but only the network IP
  1114. New IP found: 37.59.169.64
  1115. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 37.59.131.32/28, but only the network IP
  1116. New IP found: 37.59.131.32
  1117. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 198.50.170.32/28, but only the network IP
  1118. New IP found: 198.50.170.32
  1119. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 178.33.9.160/28, but only the network IP
  1120. New IP found: 178.33.9.160
  1121. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 174.142.73.240/28, but only the network IP
  1122. New IP found: 174.142.73.240
  1123. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 96.45.68.0/24, but only the network IP
  1124. New IP found: 96.45.68.0
  1125. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 162.254.227.0/24, but only the network IP
  1126. New IP found: 162.254.227.0
  1127. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 46.105.146.0/25, but only the network IP
  1128. New IP found: 46.105.146.0
  1129.  
  1130. Checking SPF record...
  1131. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 5.196.146.128/25, but only the network IP
  1132. New IP found: 5.196.146.128
  1133. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 192.99.26.0/25, but only the network IP
  1134. New IP found: 192.99.26.0
  1135. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 104.243.65.0/25, but only the network IP
  1136. New IP found: 104.243.65.0
  1137. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 51.254.70.0/26, but only the network IP
  1138. New IP found: 51.254.70.0
  1139. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 67.227.85.0/24, but only the network IP
  1140. New IP found: 67.227.85.0
  1141. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 67.227.87.0/24, but only the network IP
  1142. New IP found: 67.227.87.0
  1143. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 178.33.242.0/24, but only the network IP
  1144. New IP found: 178.33.242.0
  1145. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 216.169.98.0/23, but only the network IP
  1146. New IP found: 216.169.98.0
  1147. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 217.182.181.0/24, but only the network IP
  1148. New IP found: 217.182.181.0
  1149. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 54.36.22.0/24, but only the network IP
  1150. New IP found: 54.36.22.0
  1151. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 51.38.210.0/24, but only the network IP
  1152. New IP found: 51.38.210.0
  1153. WARNING! SPF record allows an entire network to send mails. Probably an ISP network. We are not going to check the entire network by now: 142.44.153.0/24, but only the network IP
  1154. New IP found: 142.44.153.0
  1155.  
  1156. Checking 1 most common hostnames using system default resolver...
  1157. IP: 67.225.228.134 (United States)
  1158. HostName: www.gopsp.org.br. Type: A
  1159.  
  1160. Checking with nmap the reverse DNS hostnames of every <ip>/24 netblock using system default resolver...
  1161. Checking netblock 104.243.65.0
  1162. Checking netblock 142.44.153.0
  1163. Checking netblock 5.135.31.0
  1164. Checking netblock 51.254.70.0
  1165. Checking netblock 176.31.140.0
  1166. Checking netblock 198.50.170.0
  1167. Checking netblock 178.33.242.0
  1168. Checking netblock 46.105.146.0
  1169. Checking netblock 201.76.40.0
  1170. Checking netblock 188.165.144.0
  1171. Checking netblock 187.45.246.0
  1172. Checking netblock 5.135.241.0
  1173. Checking netblock 178.33.9.0
  1174. Checking netblock 67.225.228.0
  1175. Checking netblock 177.153.23.0
  1176. Checking netblock 176.31.69.0
  1177. Checking netblock 51.38.210.0
  1178. Checking netblock 188.165.95.0
  1179. Checking netblock 176.31.7.0
  1180. Checking netblock 174.142.165.0
  1181. Checking netblock 5.196.146.0
  1182. Checking netblock 174.142.128.0
  1183. Checking netblock 162.254.227.0
  1184. Checking netblock 37.59.169.0
  1185. Checking netblock 189.126.108.0
  1186. Checking netblock 54.36.22.0
  1187. Checking netblock 67.227.87.0
  1188. Checking netblock 216.169.98.0
  1189. Checking netblock 200.234.204.0
  1190. Checking netblock 178.33.84.0
  1191. Checking netblock 176.31.145.0
  1192. Checking netblock 174.142.73.0
  1193. Checking netblock 67.227.85.0
  1194. Checking netblock 192.99.26.0
  1195. Checking netblock 186.202.4.0
  1196. Checking netblock 96.45.68.0
  1197. Checking netblock 37.59.131.0
  1198. Checking netblock 217.182.181.0
  1199.  
  1200. Searching for gopsp.org.br. emails in Google
  1201. [email protected]
  1202. [email protected].
  1203. [email protected]
  1204. [email protected],
  1205. [email protected]&
  1206. [email protected]
  1207.  
  1208. Checking 38 active hosts using nmap... (nmap -sn -n -v -PP -PM -PS80,25 -PA -PY -PU53,40125 -PE --reason <ip> -oA <output_directory>/nmap/<ip>.sn)
  1209. Host 104.243.65.0 is up (reset ttl 64)
  1210. Host 142.44.153.0 is up (echo-reply ttl 118)
  1211. Host 5.135.31.128 is up (reset ttl 64)
  1212. Host 51.254.70.0 is up (reset ttl 64)
  1213. Host 176.31.140.80 is up (reset ttl 64)
  1214. Host 198.50.170.32 is up (echo-reply ttl 120)
  1215. Host 178.33.242.0 is up (reset ttl 64)
  1216. Host 46.105.146.0 is up (reset ttl 64)
  1217. Host 201.76.40.2 is up (reset ttl 64)
  1218. Host 188.165.144.128 is up (reset ttl 64)
  1219. Host 187.45.246.2 is up (reset ttl 64)
  1220. Host 5.135.241.64 is up (reset ttl 64)
  1221. Host 178.33.9.160 is up (reset ttl 64)
  1222. Host 67.225.228.134 is up (reset ttl 64)
  1223. Host 177.153.23.242 is up (reset ttl 64)
  1224. Host 176.31.69.160 is up (reset ttl 64)
  1225. Host 51.38.210.0 is up (reset ttl 64)
  1226. Host 188.165.95.224 is up (reset ttl 64)
  1227. Host 176.31.7.0 is up (reset ttl 64)
  1228. Host 174.142.165.40 is up (echo-reply ttl 120)
  1229. Host 5.196.146.128 is up (reset ttl 64)
  1230. Host 174.142.128.32 is up (echo-reply ttl 120)
  1231. Host 162.254.227.0 is up (reset ttl 64)
  1232. Host 37.59.169.64 is up (reset ttl 64)
  1233. Host 189.126.108.2 is up (reset ttl 64)
  1234. Host 54.36.22.0 is up (reset ttl 64)
  1235. Host 67.227.87.0 is up (reset ttl 64)
  1236. Host 216.169.98.0 is up (reset ttl 64)
  1237. Host 200.234.204.130 is up (reset ttl 64)
  1238. Host 178.33.84.64 is up (reset ttl 64)
  1239. Host 176.31.145.240 is up (reset ttl 64)
  1240. Host 174.142.73.240 is up (echo-reply ttl 120)
  1241. Host 67.227.85.0 is up (reset ttl 64)
  1242. Host 192.99.26.0 is up (echo-reply ttl 120)
  1243. Host 186.202.4.42 is up (echo-reply ttl 234)
  1244. Host 96.45.68.0 is up (reset ttl 64)
  1245. Host 37.59.131.32 is up (reset ttl 64)
  1246. Host 217.182.181.0 is up (reset ttl 64)
  1247.  
  1248. Checking ports on every active host using nmap... (nmap -O --reason --webxml --traceroute -sS -sV -sC -Pn -n -v -F <ip> -oA <output_directory>/nmap/<ip>)
  1249. Scanning ip 104.243.65.0 ():
  1250. Scanning ip 142.44.153.0 ():
  1251. Scanning ip 5.135.31.128 ():
  1252. Scanning ip 51.254.70.0 ():
  1253. Scanning ip 176.31.140.80 ():
  1254. Scanning ip 198.50.170.32 ():
  1255. Scanning ip 178.33.242.0 ():
  1256. Scanning ip 46.105.146.0 ():
  1257. Scanning ip 201.76.40.2 (ns2.locaweb.com.br (PTR)):
  1258. 1723/tcp open tcpwrapped syn-ack ttl 45
  1259. |_pptp-version: ERROR: Script execution failed (use -d to debug)
  1260. Scanning ip 188.165.144.128 ():
  1261. Scanning ip 187.45.246.2 (ns3.locaweb.com.br (PTR)):
  1262. 21/tcp open tcpwrapped syn-ack ttl 46
  1263. Scanning ip 5.135.241.64 ():
  1264. Scanning ip 178.33.9.160 ():
  1265. Scanning ip 67.225.228.134 (www.gopsp.org.br.):
  1266. Scanning ip 177.153.23.242 (mx.b.locaweb.com.br):
  1267. Device type: storage-misc|general purpose
  1268. Running: Sun embedded, Sun OpenSolaris, Sun Solaris 10|8|9
  1269. Scanning ip 176.31.69.160 ():
  1270. Scanning ip 51.38.210.0 ():
  1271. Scanning ip 188.165.95.224 ():
  1272. Scanning ip 176.31.7.0 ():
  1273. Scanning ip 174.142.165.40 ():
  1274. Device type: firewall|general purpose|media device
  1275. Scanning ip 5.196.146.128 ():
  1276. Scanning ip 174.142.128.32 ():
  1277. Scanning ip 162.254.227.0 ():
  1278. Scanning ip 37.59.169.64 ():
  1279. Scanning ip 189.126.108.2 (ns1.locaweb.com.br (PTR)):
  1280. 587/tcp open tcpwrapped syn-ack ttl 46
  1281. |_smtp-commands: Couldn't establish connection on port 587
  1282. Scanning ip 54.36.22.0 ():
  1283. Scanning ip 67.227.87.0 ():
  1284. Scanning ip 216.169.98.0 ():
  1285. Scanning ip 200.234.204.130 (mx.jk.locaweb.com.br (PTR)):
  1286. Device type: storage-misc|general purpose
  1287. Running: Sun embedded, Sun OpenSolaris, Sun Solaris 10|8|9
  1288. Scanning ip 178.33.84.64 ():
  1289. Scanning ip 176.31.145.240 ():
  1290. Scanning ip 174.142.73.240 ():
  1291. Scanning ip 67.227.85.0 ():
  1292. Scanning ip 192.99.26.0 ():
  1293. Scanning ip 186.202.4.42 (mx.a.locaweb.com.br (PTR)):
  1294. Scanning ip 96.45.68.0 ():
  1295. Scanning ip 37.59.131.32 ():
  1296. Scanning ip 217.182.181.0 ():
  1297. WebCrawling domain's web servers... up to 50 max links.
  1298. --Finished--
  1299. Summary information for domain gopsp.org.br.
  1300. -----------------------------------------
  1301. Domain Specific Information:
  1302. Email: [email protected]
  1303. Email: [email protected].
  1304. Email: [email protected]
  1305. Email: [email protected],
  1306. Email: [email protected]&
  1307. Email: [email protected]
  1308.  
  1309. Domain Ips Information:
  1310. IP: 104.243.65.0
  1311. Type: SPF
  1312. Is Active: True (reset ttl 64)
  1313. IP: 142.44.153.0
  1314. Type: SPF
  1315. Is Active: True (echo-reply ttl 118)
  1316. IP: 5.135.31.128
  1317. Type: SPF
  1318. Is Active: True (reset ttl 64)
  1319. IP: 51.254.70.0
  1320. Type: SPF
  1321. Is Active: True (reset ttl 64)
  1322. IP: 176.31.140.80
  1323. Type: SPF
  1324. Is Active: True (reset ttl 64)
  1325. IP: 198.50.170.32
  1326. Type: SPF
  1327. Is Active: True (echo-reply ttl 120)
  1328. IP: 178.33.242.0
  1329. Type: SPF
  1330. Is Active: True (reset ttl 64)
  1331. IP: 46.105.146.0
  1332. Type: SPF
  1333. Is Active: True (reset ttl 64)
  1334. IP: 201.76.40.2
  1335. HostName: ns2.locaweb.com.br Type: NS
  1336. HostName: ns2.locaweb.com.br Type: PTR
  1337. Country: Brazil
  1338. Is Active: True (reset ttl 64)
  1339. Port: 1723/tcp open tcpwrapped syn-ack ttl 45
  1340. Script Info: |_pptp-version: ERROR: Script execution failed (use -d to debug)
  1341. IP: 188.165.144.128
  1342. Type: SPF
  1343. Is Active: True (reset ttl 64)
  1344. IP: 187.45.246.2
  1345. HostName: ns3.locaweb.com.br Type: NS
  1346. HostName: ns3.locaweb.com.br Type: PTR
  1347. Country: Brazil
  1348. Is Active: True (reset ttl 64)
  1349. Port: 21/tcp open tcpwrapped syn-ack ttl 46
  1350. IP: 5.135.241.64
  1351. Type: SPF
  1352. Is Active: True (reset ttl 64)
  1353. IP: 178.33.9.160
  1354. Type: SPF
  1355. Is Active: True (reset ttl 64)
  1356. IP: 67.225.228.134
  1357. HostName: www.gopsp.org.br. Type: A
  1358. Country: United States
  1359. Is Active: True (reset ttl 64)
  1360. IP: 177.153.23.242
  1361. HostName: mx.b.locaweb.com.br Type: MX
  1362. Country: Brazil
  1363. Is Active: True (reset ttl 64)
  1364. Script Info: Device type: storage-misc|general purpose
  1365. Script Info: Running: Sun embedded, Sun OpenSolaris, Sun Solaris 10|8|9
  1366. IP: 176.31.69.160
  1367. Type: SPF
  1368. Is Active: True (reset ttl 64)
  1369. IP: 51.38.210.0
  1370. Type: SPF
  1371. Is Active: True (reset ttl 64)
  1372. IP: 188.165.95.224
  1373. Type: SPF
  1374. Is Active: True (reset ttl 64)
  1375. IP: 176.31.7.0
  1376. Type: SPF
  1377. Is Active: True (reset ttl 64)
  1378. IP: 174.142.165.40
  1379. Type: SPF
  1380. Is Active: True (echo-reply ttl 120)
  1381. Script Info: Device type: firewall|general purpose|media device
  1382. IP: 5.196.146.128
  1383. Type: SPF
  1384. Is Active: True (reset ttl 64)
  1385. IP: 174.142.128.32
  1386. Type: SPF
  1387. Is Active: True (echo-reply ttl 120)
  1388. IP: 162.254.227.0
  1389. Type: SPF
  1390. Is Active: True (reset ttl 64)
  1391. IP: 37.59.169.64
  1392. Type: SPF
  1393. Is Active: True (reset ttl 64)
  1394. IP: 189.126.108.2
  1395. HostName: ns1.locaweb.com.br Type: NS
  1396. HostName: ns1.locaweb.com.br Type: PTR
  1397. Country: Brazil
  1398. Is Active: True (reset ttl 64)
  1399. Port: 587/tcp open tcpwrapped syn-ack ttl 46
  1400. Script Info: |_smtp-commands: Couldn't establish connection on port 587
  1401. IP: 54.36.22.0
  1402. Type: SPF
  1403. Is Active: True (reset ttl 64)
  1404. IP: 67.227.87.0
  1405. Type: SPF
  1406. Is Active: True (reset ttl 64)
  1407. IP: 216.169.98.0
  1408. Type: SPF
  1409. Is Active: True (reset ttl 64)
  1410. IP: 200.234.204.130
  1411. HostName: mx.jk.locaweb.com.br Type: MX
  1412. HostName: mx.jk.locaweb.com.br Type: PTR
  1413. Country: Brazil
  1414. Is Active: True (reset ttl 64)
  1415. Script Info: Device type: storage-misc|general purpose
  1416. Script Info: Running: Sun embedded, Sun OpenSolaris, Sun Solaris 10|8|9
  1417. IP: 178.33.84.64
  1418. Type: SPF
  1419. Is Active: True (reset ttl 64)
  1420. IP: 176.31.145.240
  1421. Type: SPF
  1422. Is Active: True (reset ttl 64)
  1423. IP: 174.142.73.240
  1424. Type: SPF
  1425. Is Active: True (echo-reply ttl 120)
  1426. IP: 67.227.85.0
  1427. Type: SPF
  1428. Is Active: True (reset ttl 64)
  1429. IP: 192.99.26.0
  1430. Type: SPF
  1431. Is Active: True (echo-reply ttl 120)
  1432. IP: 186.202.4.42
  1433. HostName: mx.a.locaweb.com.br Type: MX
  1434. HostName: mx.a.locaweb.com.br Type: PTR
  1435. Country: Brazil
  1436. Is Active: True (echo-reply ttl 234)
  1437. IP: 96.45.68.0
  1438. Type: SPF
  1439. Is Active: True (reset ttl 64)
  1440. IP: 37.59.131.32
  1441. Type: SPF
  1442. Is Active: True (reset ttl 64)
  1443. IP: 217.182.181.0
  1444. Type: SPF
  1445. Is Active: True (reset ttl 64)
  1446. #######################################################################################################################################
  1447. dnsenum VERSION:1.2.4
  1448.  
  1449. ----- gopsp.org.br -----
  1450.  
  1451.  
  1452. Host's addresses:
  1453. __________________
  1454.  
  1455. gopsp.org.br. 1629 IN A 67.225.228.134
  1456.  
  1457.  
  1458. Wildcard detection using: iwamdhnmibup
  1459. _______________________________________
  1460.  
  1461. iwamdhnmibup.gopsp.org.br. 3600 IN A 67.225.228.134
  1462.  
  1463.  
  1464. !!!!!!!!!!!!!!!!!!!!!!!!!!!!
  1465.  
  1466. Wildcards detected, all subdomains will point to the same IP address
  1467. Omitting results containing 67.225.228.134.
  1468. Maybe you are using OpenDNS servers.
  1469.  
  1470. !!!!!!!!!!!!!!!!!!!!!!!!!!!!
  1471.  
  1472.  
  1473. Name Servers:
  1474. ______________
  1475.  
  1476. ns1.locaweb.com.br. 2796 IN A 189.126.108.2
  1477. ns3.locaweb.com.br. 2796 IN A 187.45.246.2
  1478. ns2.locaweb.com.br. 2795 IN A 201.76.40.2
  1479.  
  1480.  
  1481. Mail (MX) Servers:
  1482. ___________________
  1483.  
  1484. mx.jk.locaweb.com.br. 186 IN A 200.234.204.130
  1485. mx.a.locaweb.com.br. 31229 IN A 186.202.4.42
  1486. mx.b.locaweb.com.br. 2413 IN A 177.153.23.242
  1487.  
  1488.  
  1489. Trying Zone Transfers and getting Bind Versions:
  1490. _________________________________________________
  1491.  
  1492.  
  1493. Trying Zone Transfer for gopsp.org.br on ns1.locaweb.com.br ...
  1494.  
  1495. Trying Zone Transfer for gopsp.org.br on ns3.locaweb.com.br ...
  1496.  
  1497. Trying Zone Transfer for gopsp.org.br on ns2.locaweb.com.br ...
  1498.  
  1499. brute force file not specified, bay.
  1500. #######################################################################################################################################
  1501. ---------------------------------------------------------------------------------------------------------------------------------------
  1502.  
  1503. [1/100] /?sa=X
  1504. [x] Error downloading /?sa=X
  1505. [2/100] /advanced_search
  1506. [x] Error downloading /advanced_search
  1507. [3/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D345%26tipo%3D2
  1508. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D345%26tipo%3D2
  1509. [4/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D350%26tipo%3D2
  1510. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D350%26tipo%3D2
  1511. [5/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D346%26tipo%3D2
  1512. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D346%26tipo%3D2
  1513. [6/100] http://app.gopsp.org.br/app/Content/dist/historia.pdf
  1514. [7/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D349%26tipo%3D2
  1515. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D349%26tipo%3D2
  1516. [8/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D390%26tipo%3D2
  1517. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D390%26tipo%3D2
  1518. [9/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D353%26tipo%3D2
  1519. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D353%26tipo%3D2
  1520. [10/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D354%26tipo%3D2
  1521. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D354%26tipo%3D2
  1522. [11/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D342%26tipo%3D2
  1523. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D342%26tipo%3D2
  1524. [12/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D386%26tipo%3D2
  1525. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D386%26tipo%3D2
  1526. [13/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D387%26tipo%3D2
  1527. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D387%26tipo%3D2
  1528. [14/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D360%26tipo%3D2
  1529. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D360%26tipo%3D2
  1530. [15/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D373%26tipo%3D2
  1531. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D373%26tipo%3D2
  1532. [16/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D389%26tipo%3D2
  1533. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D389%26tipo%3D2
  1534. [17/100] https://gopsp.org.br/baixarDocumento.php%3Fid%3D336%26tipo%3D2
  1535. [x] Error downloading https://gopsp.org.br/baixarDocumento.php%3Fid%3D336%26tipo%3D2
  1536. [18/100] http://app.gopsp.org.br/app/Content/dist/convenio_uniprevcard_email_mkt.pdf
  1537. [19/100] http://arls343.gopsp.org.br/baixarDocumento.php%3Fid%3D11%26tipo%3D11
  1538. =======================================================================================================================================
  1539.  
  1540. [+] List of users found:
  1541. --------------------------
  1542. Raul Audi Junior
  1543. Audi Comunica��o
  1544.  
  1545. [+] List of software found:
  1546. -----------------------------
  1547. ��Microsoft� Word 2010
  1548. Acrobat Distiller 10.1.16 (Macintosh)
  1549. Adobe Graphics Manager
  1550. ======================================================================================================================================
  1551. #######################################################################################################################################
  1552. [-] Enumerating subdomains now for gopsp.org.br
  1553. [-] verbosity is enabled, will show the subdomains results in realtime
  1554. [-] Searching now in Baidu..
  1555. [-] Searching now in Yahoo..
  1556. [-] Searching now in Google..
  1557. [-] Searching now in Bing..
  1558. [-] Searching now in Ask..
  1559. [-] Searching now in Netcraft..
  1560. [-] Searching now in DNSdumpster..
  1561. [-] Searching now in Virustotal..
  1562. [-] Searching now in ThreatCrowd..
  1563. [-] Searching now in SSL Certificates..
  1564. [-] Searching now in PassiveDNS..
  1565. SSL Certificates: autodiscover.gopsp.org.br
  1566. SSL Certificates: cpanel.gopsp.org.br
  1567. SSL Certificates: mail.gopsp.org.br
  1568. SSL Certificates: webdisk.gopsp.org.br
  1569. SSL Certificates: webmail.gopsp.org.br
  1570. SSL Certificates: www.gopsp.org.br
  1571. SSL Certificates: betha.gopsp.org.br
  1572. SSL Certificates: www.betha.gopsp.org.br
  1573. SSL Certificates: alpha.gopsp.org.br
  1574. SSL Certificates: www.alpha.gopsp.org.br
  1575. SSL Certificates: teste.gopsp.org.br
  1576. SSL Certificates: www.teste.gopsp.org.br
  1577. SSL Certificates: brasil3.gopsp.org.br
  1578. SSL Certificates: www.brasil3.gopsp.org.br
  1579. Bing: blog.gopsp.org.br
  1580. Bing: arls343.gopsp.org.br
  1581. Bing: homolog.gopsp.org.br
  1582. Bing: app.gopsp.org.br
  1583. Yahoo: blog.gopsp.org.br
  1584. Yahoo: arls343.gopsp.org.br
  1585. Yahoo: homolog.gopsp.org.br
  1586. [-] Saving results to file: /usr/share/sniper/loot/workspace/gopsp.org.br/domains/domains-gopsp.org.br.txt
  1587. [-] Total Unique Subdomains Found: 18
  1588. www.gopsp.org.br
  1589. alpha.gopsp.org.br
  1590. www.alpha.gopsp.org.br
  1591. app.gopsp.org.br
  1592. arls343.gopsp.org.br
  1593. autodiscover.gopsp.org.br
  1594. betha.gopsp.org.br
  1595. www.betha.gopsp.org.br
  1596. blog.gopsp.org.br
  1597. brasil3.gopsp.org.br
  1598. www.brasil3.gopsp.org.br
  1599. cpanel.gopsp.org.br
  1600. homolog.gopsp.org.br
  1601. mail.gopsp.org.br
  1602. teste.gopsp.org.br
  1603. www.teste.gopsp.org.br
  1604. webdisk.gopsp.org.br
  1605. webmail.gopsp.org.br
  1606. #######################################################################################################################################
  1607. teste.gopsp.org.br,191.252.4.30
  1608. app.gopsp.org.br,191.252.4.30
  1609. homolog.gopsp.org.br,191.252.4.30
  1610. gopsp.org.br,67.225.228.134
  1611. autodiscover.gopsp.org.br,186.202.140.232
  1612. cpanel.gopsp.org.br,67.225.228.134
  1613. ftp.gopsp.org.br,179.188.15.200
  1614. www.gopsp.org.br,67.225.228.134
  1615. ns2.gopsp.org.br,201.76.40.2,2804:218:d2::cafe
  1616. imap3.gopsp.org.br,191.252.112.194
  1617. ns3.gopsp.org.br,187.45.246.2,2804:218:d3::faca
  1618. ns1.gopsp.org.br,189.126.108.2,2804:218:d1::ca5a
  1619. alpha.gopsp.org.br,67.225.228.134
  1620. www.brasil3.gopsp.org.br,67.225.228.134
  1621. www.betha.gopsp.org.br,67.225.228.134
  1622. webdisk.gopsp.org.br,67.225.228.134
  1623. www.alpha.gopsp.org.br,67.225.228.134
  1624. www.teste.gopsp.org.br,191.252.4.30
  1625. webmail.gopsp.org.br,186.202.140.235,186.202.140.220,186.202.140.244
  1626. brasil3.gopsp.org.br,67.225.228.134
  1627. www.app.gopsp.org.br,191.252.4.30
  1628. blog.gopsp.org.br,191.252.4.30
  1629. #######################################################################################################################################
  1630. ===============================================
  1631. -=Subfinder v1.1.3 github.com/subfinder/subfinder
  1632. ===============================================
  1633.  
  1634.  
  1635. Running Source: Ask
  1636. Running Source: Archive.is
  1637. Running Source: Baidu
  1638. Running Source: Bing
  1639. Running Source: CertDB
  1640. Running Source: CertificateTransparency
  1641. Running Source: Certspotter
  1642. Running Source: Commoncrawl
  1643. Running Source: Crt.sh
  1644. Running Source: Dnsdb
  1645. Running Source: DNSDumpster
  1646. Running Source: DNSTable
  1647. Running Source: Dogpile
  1648. Running Source: Exalead
  1649. Running Source: Findsubdomains
  1650. Running Source: Googleter
  1651. Running Source: Hackertarget
  1652. Running Source: Ipv4Info
  1653. Running Source: PTRArchive
  1654. Running Source: Sitedossier
  1655. Running Source: Threatcrowd
  1656. Running Source: ThreatMiner
  1657. Running Source: WaybackArchive
  1658. Running Source: Yahoo
  1659.  
  1660. Found Wildcard DNS at gopsp.org.br
  1661. - 67.225.228.134
  1662. Running enumeration on gopsp.org.br
  1663.  
  1664. ipv4info: <nil>
  1665.  
  1666. waybackarchive: parse http://web.archive.org/cdx/search/cdx?url=*.gopsp.org.br/*&output=json&fl=original&collapse=urlkey&page=: net/url: invalid control character in URL
  1667.  
  1668.  
  1669. Starting Bruteforcing of gopsp.org.br with 9985 words
  1670.  
  1671. Total 48 Unique subdomains found for gopsp.org.br
  1672.  
  1673. .gopsp.org.br
  1674. alpha.gopsp.org.br
  1675. antigo.gopsp.org.br
  1676. app.gopsp.org.br
  1677. app.gopsp.org.br
  1678. arls343.gopsp.org.br
  1679. autodiscover.gopsp.org.br
  1680. autodiscover.gopsp.org.br
  1681. betha.gopsp.org.br
  1682. blog.gopsp.org.br
  1683. blog.gopsp.org.br
  1684. brasil3.gopsp.org.br
  1685. calendario.gopsp.org.br
  1686. cpanel.gopsp.org.br
  1687. ftp.gopsp.org.br
  1688. gerenciador.gopsp.org.br
  1689. homolog.gopsp.org.br
  1690. homolog.gopsp.org.br
  1691. imap.gopsp.org.br
  1692. imap3.gopsp.org.br
  1693. mail.gopsp.org.br
  1694. mail.gopsp.org.br
  1695. mobile.gopsp.org.br
  1696. mx1.gopsp.org.br
  1697. mx2.gopsp.org.br
  1698. mx3.gopsp.org.br
  1699. mx4.gopsp.org.br
  1700. ns1.gopsp.org.br
  1701. ns2.gopsp.org.br
  1702. ns3.gopsp.org.br
  1703. painel.gopsp.org.br
  1704. pda.gopsp.org.br
  1705. pop.gopsp.org.br
  1706. pop3.gopsp.org.br
  1707. relatorio.gopsp.org.br
  1708. smtp.gopsp.org.br
  1709. teste.gopsp.org.br
  1710. teste.gopsp.org.br
  1711. tracking.gopsp.org.br
  1712. webdisk.gopsp.org.br
  1713. webmail.gopsp.org.br
  1714. webmail.gopsp.org.br
  1715. www.alpha.gopsp.org.br
  1716. www.app.gopsp.org.br
  1717. www.betha.gopsp.org.br
  1718. www.brasil3.gopsp.org.br
  1719. www.gopsp.org.br
  1720. www.teste.gopsp.org.br
  1721. #######################################################################################################################################
  1722. [*] Processing domain gopsp.org.br
  1723. [*] Using system resolvers ['38.132.106.139', '194.187.251.67', '185.93.180.131', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  1724. [+] Getting nameservers
  1725. 189.126.108.2 - ns1.locaweb.com.br
  1726. 187.45.246.2 - ns3.locaweb.com.br
  1727. 201.76.40.2 - ns2.locaweb.com.br
  1728. [-] Zone transfer failed
  1729.  
  1730. [+] TXT records found
  1731. "v=spf1 a mx include:_spf.elasticemail.com ~all"
  1732.  
  1733. [+] MX records found, added to target list
  1734. 20 mx.jk.locaweb.com.br.
  1735. 10 mx.a.locaweb.com.br.
  1736. 10 mx.b.locaweb.com.br.
  1737.  
  1738. [+] Wildcard domain found - 67.225.228.134
  1739. [*] Scanning gopsp.org.br for A records
  1740. 191.252.4.30 - app.gopsp.org.br
  1741. 186.202.140.232 - autodiscover.gopsp.org.br
  1742. 191.252.4.30 - blog.gopsp.org.br
  1743. 179.188.15.200 - ftp.gopsp.org.br
  1744. 191.252.112.195 - imap.gopsp.org.br
  1745. 191.252.112.195 - mail.gopsp.org.br
  1746. 191.252.112.195 - mobile.gopsp.org.br
  1747. 189.126.108.2 - ns1.gopsp.org.br
  1748. 201.76.40.2 - ns2.gopsp.org.br
  1749. 187.45.246.2 - ns3.gopsp.org.br
  1750. 191.252.112.195 - pda.gopsp.org.br
  1751. 191.252.112.195 - pop.gopsp.org.br
  1752. 191.252.112.195 - pop3.gopsp.org.br
  1753. 191.252.112.195 - smtp.gopsp.org.br
  1754. 186.202.140.220 - webmail.gopsp.org.br
  1755. 186.202.140.244 - webmail.gopsp.org.br
  1756. 186.202.140.235 - webmail.gopsp.org.br
  1757. #######################################################################################################################################
  1758. alpha.gopsp.org.br
  1759. autodiscover.gopsp.org.br
  1760. betha.gopsp.org.br
  1761. brasil3.gopsp.org.br
  1762. cpanel.gopsp.org.br
  1763. mail.gopsp.org.br
  1764. teste.gopsp.org.br
  1765. webdisk.gopsp.org.br
  1766. webmail.gopsp.org.br
  1767. www.alpha.gopsp.org.br
  1768. www.betha.gopsp.org.br
  1769. www.brasil3.gopsp.org.br
  1770. www.gopsp.org.br
  1771. www.teste.gopsp.org.br
  1772. #######################################################################################################################################
  1773. alpha.gopsp.org.br
  1774. autodiscover.gopsp.org.br
  1775. blog.gopsp.org.br
  1776. cpanel.gopsp.org.br
  1777. mail.gopsp.org.br
  1778. pop.gopsp.org.br
  1779. teste.gopsp.org.br
  1780. webdisk.gopsp.org.br
  1781. webmail.gopsp.org.br
  1782. www.alpha.gopsp.org.br
  1783. www.betha.gopsp.org.br
  1784. www.gopsp.org.br
  1785. www.teste.gopsp.org.br
  1786. #######################################################################################################################################
  1787. [*] Found SPF record:
  1788. [*] v=spf1 a mx include:_spf.elasticemail.com ~all
  1789. [*] SPF record contains an All item: ~all
  1790. [*] Found DMARC record:
  1791. [*] v=DMARC1; p=none; ruf=mailto:[email protected]
  1792. [+] DMARC policy set to none
  1793. [*] Forensics reports will be sent: mailto:[email protected]
  1794. [+] Spoofing possible for gopsp.org.br!
  1795. #######################################################################################################################################
  1796. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-09 11:43 EDT
  1797. Nmap scan report for gopsp.org.br (67.225.228.134)
  1798. Host is up (0.29s latency).
  1799. rDNS record for 67.225.228.134: srv01.imserver.com.br
  1800. Not shown: 2 filtered ports
  1801. PORT STATE SERVICE
  1802. 53/udp open|filtered domain
  1803. 67/udp open|filtered dhcps
  1804. 68/udp open|filtered dhcpc
  1805. 69/udp open|filtered tftp
  1806. 88/udp open|filtered kerberos-sec
  1807. 123/udp open|filtered ntp
  1808. 139/udp open|filtered netbios-ssn
  1809. 161/udp open|filtered snmp
  1810. 162/udp open|filtered snmptrap
  1811. 389/udp open|filtered ldap
  1812. 500/udp open|filtered isakmp
  1813. 520/udp open|filtered route
  1814. 2049/udp open|filtered nfs
  1815.  
  1816. Nmap done: 1 IP address (1 host up) scanned in 6.27 seconds
  1817. #######################################################################################################################################
  1818. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-09 11:01 EDT
  1819. Nmap scan report for srv01.imserver.com.br (67.225.228.134)
  1820. Host is up (0.081s latency).
  1821. Not shown: 477 filtered ports, 3 closed ports
  1822. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  1823. PORT STATE SERVICE
  1824. 53/tcp open domain
  1825. 80/tcp open http
  1826. 443/tcp open https
  1827.  
  1828. Nmap done: 1 IP address (1 host up) scanned in 5.07 seconds
  1829. #######################################################################################################################################
  1830. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-09 11:01 EDT
  1831. Nmap scan report for srv01.imserver.com.br (67.225.228.134)
  1832. Host is up (0.089s latency).
  1833. Not shown: 2 filtered ports
  1834. PORT STATE SERVICE
  1835. 53/udp open domain
  1836. 67/udp open|filtered dhcps
  1837. 68/udp open|filtered dhcpc
  1838. 69/udp open|filtered tftp
  1839. 88/udp open|filtered kerberos-sec
  1840. 123/udp open|filtered ntp
  1841. 139/udp open|filtered netbios-ssn
  1842. 161/udp open|filtered snmp
  1843. 162/udp open|filtered snmptrap
  1844. 389/udp open|filtered ldap
  1845. 500/udp open|filtered isakmp
  1846. 520/udp open|filtered route
  1847. 2049/udp open|filtered nfs
  1848.  
  1849. Nmap done: 1 IP address (1 host up) scanned in 1.99 seconds
  1850. #######################################################################################################################################
  1851. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-09 11:01 EDT
  1852. Nmap scan report for srv01.imserver.com.br (67.225.228.134)
  1853. Host is up (0.10s latency).
  1854.  
  1855. PORT STATE SERVICE VERSION
  1856. 53/tcp open domain ISC BIND 9.8.2rc1 (RedHat Enterprise Linux 6)
  1857. |_dns-fuzz: Server didn't response to our probe, can't fuzz
  1858. | dns-nsec-enum:
  1859. |_ No NSEC records found
  1860. | dns-nsec3-enum:
  1861. |_ DNSSEC NSEC3 not supported
  1862. | dns-nsid:
  1863. |_ bind.version: 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3
  1864. |_vulscan: ERROR: Script execution failed (use -d to debug)
  1865. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  1866. Device type: general purpose|storage-misc|firewall
  1867. Running (JUST GUESSING): Linux 2.6.X|3.X (89%), Synology DiskStation Manager 5.X (88%), WatchGuard Fireware 11.X (86%)
  1868. OS CPE: cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:linux:linux_kernel:3.10 cpe:/o:linux:linux_kernel cpe:/a:synology:diskstation_manager:5.1 cpe:/o:watchguard:fireware:11.8
  1869. Aggressive OS guesses: Linux 2.6.32 or 3.10 (89%), Linux 2.6.32 (88%), Synology DiskStation Manager 5.1 (88%), Linux 2.6.39 (88%), Linux 3.4 (87%), Linux 3.1 - 3.2 (87%), Linux 3.10 (86%), WatchGuard Fireware 11.8 (86%), Linux 2.6.32 - 2.6.39 (85%)
  1870. No exact OS matches for host (test conditions non-ideal).
  1871. Network Distance: 12 hops
  1872. Service Info: OS: Linux; CPE: cpe:/o:redhat:enterprise_linux:6
  1873.  
  1874. Host script results:
  1875. | dns-blacklist:
  1876. | SPAM
  1877. |_ l2.apews.org - SPAM
  1878. | dns-brute:
  1879. | DNS Brute-force hostnames:
  1880. | ns1.imserver.com.br - 67.225.228.134
  1881. | ns2.imserver.com.br - 72.52.229.187
  1882. | mail.imserver.com.br - 67.225.228.134
  1883. | www.imserver.com.br - 67.225.228.134
  1884. |_ ftp.imserver.com.br - 67.225.228.134
  1885.  
  1886. TRACEROUTE (using port 53/tcp)
  1887. HOP RTT ADDRESS
  1888. 1 89.16 ms 10.250.204.1
  1889. 2 89.20 ms 104.245.145.161
  1890. 3 89.24 ms te0-0-2-1.225.nr11.b010988-1.yyz02.atlas.cogentco.com (38.104.156.9)
  1891. 4 89.26 ms te0-0-0-1.agr13.yyz02.atlas.cogentco.com (154.24.54.37)
  1892. 5 89.24 ms te0-9-0-9.ccr31.yyz02.atlas.cogentco.com (154.54.43.141)
  1893. 6 89.30 ms be2993.ccr21.cle04.atlas.cogentco.com (154.54.31.225)
  1894. 7 89.32 ms be2717.ccr41.ord01.atlas.cogentco.com (154.54.6.221)
  1895. 8 89.35 ms be2765.ccr41.ord03.atlas.cogentco.com (154.54.45.18)
  1896. 9 89.37 ms 38.32.96.98
  1897. 10 57.27 ms lw-dc3-core2.rtr.liquidweb.com (209.59.157.50)
  1898. 11 82.31 ms lw-dc3-storm1.rtr.liquidweb.com (69.167.128.141)
  1899. 12 137.82 ms srv01.imserver.com.br (67.225.228.134)
  1900. #######################################################################################################################################
  1901. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-09 11:01 EDT
  1902. NSE: Loaded 164 scripts for scanning.
  1903. NSE: Script Pre-scanning.
  1904. Initiating NSE at 11:01
  1905. Completed NSE at 11:01, 0.00s elapsed
  1906. Initiating NSE at 11:01
  1907. Completed NSE at 11:01, 0.00s elapsed
  1908. Initiating Parallel DNS resolution of 1 host. at 11:01
  1909. Completed Parallel DNS resolution of 1 host. at 11:01, 0.02s elapsed
  1910. Initiating SYN Stealth Scan at 11:01
  1911. Scanning srv01.imserver.com.br (67.225.228.134) [1 port]
  1912. Discovered open port 80/tcp on 67.225.228.134
  1913. Completed SYN Stealth Scan at 11:01, 0.13s elapsed (1 total ports)
  1914. Initiating Service scan at 11:01
  1915. Scanning 1 service on srv01.imserver.com.br (67.225.228.134)
  1916. Completed Service scan at 11:02, 6.16s elapsed (1 service on 1 host)
  1917. Initiating OS detection (try #1) against srv01.imserver.com.br (67.225.228.134)
  1918. Retrying OS detection (try #2) against srv01.imserver.com.br (67.225.228.134)
  1919. Initiating Traceroute at 11:02
  1920. Completed Traceroute at 11:02, 0.23s elapsed
  1921. Initiating Parallel DNS resolution of 12 hosts. at 11:02
  1922. Completed Parallel DNS resolution of 12 hosts. at 11:02, 0.24s elapsed
  1923. NSE: Script scanning 67.225.228.134.
  1924. Initiating NSE at 11:02
  1925. NSE: [http-wordpress-enum 67.225.228.134:80] got no answers from pipelined queries
  1926. Completed NSE at 11:05, 171.89s elapsed
  1927. Initiating NSE at 11:05
  1928. Completed NSE at 11:05, 2.00s elapsed
  1929. Nmap scan report for srv01.imserver.com.br (67.225.228.134)
  1930. Host is up (0.11s latency).
  1931.  
  1932. PORT STATE SERVICE VERSION
  1933. 80/tcp open http Apache httpd 2.4.41 ((cPanel) OpenSSL/1.0.2s mod_bwlimited/1.4)
  1934. | http-brute:
  1935. |_ Path "/" does not require authentication
  1936. |_http-chrono: Request times for /; avg: 16202.33ms; min: 16151.27ms; max: 16278.11ms
  1937. |_http-csrf: Couldn't find any CSRF vulnerabilities.
  1938. |_http-date: Mon, 09 Sep 2019 15:02:10 GMT; -3s from local time.
  1939. |_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.
  1940. |_http-dombased-xss: Couldn't find any DOM based XSS.
  1941. |_http-errors: Couldn't find any error pages.
  1942. |_http-feed: Couldn't find any feeds.
  1943. |_http-fetch: Please enter the complete path of the directory to save data in.
  1944. | http-headers:
  1945. | Date: Mon, 09 Sep 2019 15:02:12 GMT
  1946. | Server: Apache/2.4.41 (cPanel) OpenSSL/1.0.2s mod_bwlimited/1.4
  1947. | Last-Modified: Wed, 30 Jan 2019 02:06:03 GMT
  1948. | ETag: "200271-a3-580a35a1678c0"
  1949. | Accept-Ranges: bytes
  1950. | Content-Length: 163
  1951. | Vary: Accept-Encoding
  1952. | Connection: close
  1953. | Content-Type: text/html
  1954. |
  1955. |_ (Request type: HEAD)
  1956. | http-iis-short-name-brute:
  1957. | VULNERABLE:
  1958. | Microsoft IIS tilde character "~" short name disclosure and denial of service
  1959. | State: VULNERABLE (Exploitable)
  1960. | Vulnerable IIS servers disclose folder and file names with a Windows 8.3 naming scheme inside the root folder.
  1961. | Shortnames can be used to guess or brute force sensitive filenames. Attackers can exploit this vulnerability to
  1962. | cause a denial of service condition.
  1963. |
  1964. | Extra information:
  1965. |
  1966. | 8.3 filenames found:
  1967. | Folders
  1968. | ~1
  1969. | ~2
  1970. | ~3
  1971. | ~4
  1972. |
  1973. | References:
  1974. | https://www.securityfocus.com/archive/1/523424
  1975. | https://github.com/irsdl/IIS-ShortName-Scanner
  1976. |_ http://soroush.secproject.com/downloadable/microsoft_iis_tilde_character_vulnerability_feature.pdf
  1977. |_http-jsonp-detection: Couldn't find any JSONP endpoints.
  1978. |_http-litespeed-sourcecode-download: Request with null byte did not work. This web server might not be vulnerable
  1979. | http-methods:
  1980. | Supported Methods: OPTIONS HEAD GET POST TRACE
  1981. |_ Potentially risky methods: TRACE
  1982. |_http-mobileversion-checker: No mobile version detected.
  1983. | http-php-version: Logo query returned unknown hash f1fb042c62910c34be16ad91cbbd71fa
  1984. |_Credits query returned unknown hash f1fb042c62910c34be16ad91cbbd71fa
  1985. |_http-security-headers:
  1986. | http-sitemap-generator:
  1987. | Directory structure:
  1988. | /
  1989. | Other: 1
  1990. | Longest directory structure:
  1991. | Depth: 0
  1992. | Dir: /
  1993. | Total files found (by extension):
  1994. |_ Other: 1
  1995. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
  1996. |_http-title: Site doesn't have a title (text/html).
  1997. | http-trace: TRACE is enabled
  1998. | Headers:
  1999. | Date: Mon, 09 Sep 2019 15:02:11 GMT
  2000. | Server: Apache/2.4.41 (cPanel) OpenSSL/1.0.2s mod_bwlimited/1.4
  2001. | Connection: close
  2002. | Transfer-Encoding: chunked
  2003. |_Content-Type: message/http
  2004. | http-vhosts:
  2005. | 125 names had status 200
  2006. | mail.imserver.com.br : 302 -> http://www.masonweb.com.br
  2007. |_www.imserver.com.br : 302 -> http://www.masonweb.com.br
  2008. | http-waf-detect: IDS/IPS/WAF detected:
  2009. |_srv01.imserver.com.br:80/?p4yl04d3=<script>alert(document.cookie)</script>
  2010. |_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php
  2011. |_http-xssed: No previously reported XSS vuln.
  2012. |_vulscan: ERROR: Script execution failed (use -d to debug)
  2013. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  2014. Device type: general purpose|firewall|storage-misc
  2015. Running (JUST GUESSING): Linux 2.6.X|3.X (90%), WatchGuard Fireware 11.X (89%), Synology DiskStation Manager 5.X (88%)
  2016. OS CPE: cpe:/o:linux:linux_kernel:2.6.32 cpe:/o:linux:linux_kernel:3.10 cpe:/o:watchguard:fireware:11.8 cpe:/o:linux:linux_kernel cpe:/a:synology:diskstation_manager:5.1
  2017. Aggressive OS guesses: Linux 2.6.32 (90%), Linux 2.6.39 (90%), Linux 3.10 (89%), Linux 3.4 (89%), WatchGuard Fireware 11.8 (89%), Linux 3.1 - 3.2 (89%), Synology DiskStation Manager 5.1 (88%), Linux 2.6.32 or 3.10 (87%), Linux 2.6.32 - 2.6.39 (85%)
  2018. No exact OS matches for host (test conditions non-ideal).
  2019. Uptime guess: 2.396 days (since Sat Sep 7 01:35:19 2019)
  2020. Network Distance: 12 hops
  2021. TCP Sequence Prediction: Difficulty=261 (Good luck!)
  2022. IP ID Sequence Generation: All zeros
  2023.  
  2024. TRACEROUTE (using port 80/tcp)
  2025. HOP RTT ADDRESS
  2026. 1 85.27 ms 10.250.204.1
  2027. 2 85.35 ms 104.245.145.161
  2028. 3 85.39 ms te0-0-2-1.225.nr11.b010988-1.yyz02.atlas.cogentco.com (38.104.156.9)
  2029. 4 85.42 ms te0-0-0-1.agr14.yyz02.atlas.cogentco.com (154.24.54.41)
  2030. 5 85.47 ms te0-9-1-9.ccr31.yyz02.atlas.cogentco.com (154.54.43.161)
  2031. 6 85.50 ms be2993.ccr21.cle04.atlas.cogentco.com (154.54.31.225)
  2032. 7 85.53 ms be2717.ccr41.ord01.atlas.cogentco.com (154.54.6.221)
  2033. 8 85.57 ms be2765.ccr41.ord03.atlas.cogentco.com (154.54.45.18)
  2034. 9 85.60 ms 38.32.96.98
  2035. 10 56.09 ms lw-dc3-core2.rtr.liquidweb.com (209.59.157.50)
  2036. 11 81.66 ms lw-dc3-storm2.rtr.liquidweb.com (69.167.128.145)
  2037. 12 138.00 ms srv01.imserver.com.br (67.225.228.134)
  2038.  
  2039. NSE: Script Post-scanning.
  2040. Initiating NSE at 11:05
  2041. Completed NSE at 11:05, 0.00s elapsed
  2042. Initiating NSE at 11:05
  2043. Completed NSE at 11:05, 0.00s elapsed
  2044. #######################################################################################################################################
  2045. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-09 11:08 EDT
  2046. NSE: Loaded 164 scripts for scanning.
  2047. NSE: Script Pre-scanning.
  2048. Initiating NSE at 11:08
  2049. Completed NSE at 11:08, 0.00s elapsed
  2050. Initiating NSE at 11:08
  2051. Completed NSE at 11:08, 0.00s elapsed
  2052. Initiating Parallel DNS resolution of 1 host. at 11:08
  2053. Completed Parallel DNS resolution of 1 host. at 11:08, 0.02s elapsed
  2054. Initiating SYN Stealth Scan at 11:08
  2055. Scanning srv01.imserver.com.br (67.225.228.134) [1 port]
  2056. Completed SYN Stealth Scan at 11:08, 0.55s elapsed (1 total ports)
  2057. Initiating Service scan at 11:08
  2058. Initiating OS detection (try #1) against srv01.imserver.com.br (67.225.228.134)
  2059. Retrying OS detection (try #2) against srv01.imserver.com.br (67.225.228.134)
  2060. Initiating Traceroute at 11:08
  2061. Completed Traceroute at 11:08, 6.11s elapsed
  2062. Initiating Parallel DNS resolution of 11 hosts. at 11:08
  2063. Completed Parallel DNS resolution of 11 hosts. at 11:08, 0.27s elapsed
  2064. NSE: Script scanning 67.225.228.134.
  2065. Initiating NSE at 11:08
  2066. Completed NSE at 11:08, 0.01s elapsed
  2067. Initiating NSE at 11:08
  2068. Completed NSE at 11:08, 0.00s elapsed
  2069. Nmap scan report for srv01.imserver.com.br (67.225.228.134)
  2070. Host is up.
  2071.  
  2072. PORT STATE SERVICE VERSION
  2073. 443/tcp filtered https
  2074. Too many fingerprints match this host to give specific OS details
  2075.  
  2076. TRACEROUTE (using proto 1/icmp)
  2077. HOP RTT ADDRESS
  2078. 1 89.05 ms 10.250.204.1
  2079. 2 89.09 ms 104.245.145.161
  2080. 3 89.13 ms te0-0-2-1.225.nr11.b010988-1.yyz02.atlas.cogentco.com (38.104.156.9)
  2081. 4 89.15 ms te0-0-0-1.agr14.yyz02.atlas.cogentco.com (154.24.54.41)
  2082. 5 89.12 ms te0-9-1-9.ccr31.yyz02.atlas.cogentco.com (154.54.43.161)
  2083. 6 89.18 ms be2993.ccr21.cle04.atlas.cogentco.com (154.54.31.225)
  2084. 7 89.21 ms be2717.ccr41.ord01.atlas.cogentco.com (154.54.6.221)
  2085. 8 89.25 ms be2765.ccr41.ord03.atlas.cogentco.com (154.54.45.18)
  2086. 9 89.23 ms 38.32.96.98
  2087. 10 55.84 ms lw-dc3-core1-eth2-19.rtr.liquidweb.com (209.59.157.244)
  2088. 11 83.08 ms lw-dc3-storm2.rtr.liquidweb.com (69.167.128.137)
  2089. 12 ... 30
  2090.  
  2091. NSE: Script Post-scanning.
  2092. Initiating NSE at 11:08
  2093. Completed NSE at 11:08, 0.00s elapsed
  2094. Initiating NSE at 11:08
  2095. Completed NSE at 11:08, 0.00s elapsed
  2096. #######################################################################################################################################
  2097. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-09 11:13 EDT
  2098. NSE: Loaded 47 scripts for scanning.
  2099. NSE: Script Pre-scanning.
  2100. Initiating NSE at 11:13
  2101. Completed NSE at 11:13, 0.00s elapsed
  2102. Initiating NSE at 11:13
  2103. Completed NSE at 11:13, 0.00s elapsed
  2104. Initiating Parallel DNS resolution of 1 host. at 11:13
  2105. Completed Parallel DNS resolution of 1 host. at 11:13, 0.02s elapsed
  2106. Initiating UDP Scan at 11:13
  2107. Scanning srv01.imserver.com.br (67.225.228.134) [15 ports]
  2108. Completed UDP Scan at 11:13, 3.50s elapsed (15 total ports)
  2109. Initiating Service scan at 11:13
  2110. Scanning 12 services on srv01.imserver.com.br (67.225.228.134)
  2111. Service scan Timing: About 8.33% done; ETC: 11:29 (0:14:18 remaining)
  2112. Completed Service scan at 11:15, 102.60s elapsed (12 services on 1 host)
  2113. Initiating OS detection (try #1) against srv01.imserver.com.br (67.225.228.134)
  2114. Retrying OS detection (try #2) against srv01.imserver.com.br (67.225.228.134)
  2115. Initiating Traceroute at 11:15
  2116. Completed Traceroute at 11:15, 7.08s elapsed
  2117. Initiating Parallel DNS resolution of 1 host. at 11:15
  2118. Completed Parallel DNS resolution of 1 host. at 11:15, 0.00s elapsed
  2119. NSE: Script scanning 67.225.228.134.
  2120. Initiating NSE at 11:15
  2121. Completed NSE at 11:15, 7.12s elapsed
  2122. Initiating NSE at 11:15
  2123. Completed NSE at 11:15, 1.01s elapsed
  2124. Nmap scan report for srv01.imserver.com.br (67.225.228.134)
  2125. Host is up (0.050s latency).
  2126.  
  2127. PORT STATE SERVICE VERSION
  2128. 53/udp open|filtered domain
  2129. 67/udp open|filtered dhcps
  2130. 68/udp open|filtered dhcpc
  2131. 69/udp open|filtered tftp
  2132. 88/udp open|filtered kerberos-sec
  2133. 123/udp open|filtered ntp
  2134. 137/udp filtered netbios-ns
  2135. 138/udp filtered netbios-dgm
  2136. 139/udp open|filtered netbios-ssn
  2137. 161/udp open|filtered snmp
  2138. 162/udp filtered snmptrap
  2139. 389/udp open|filtered ldap
  2140. 500/udp open|filtered isakmp
  2141. |_ike-version: ERROR: Script execution failed (use -d to debug)
  2142. 520/udp open|filtered route
  2143. 2049/udp open|filtered nfs
  2144. Too many fingerprints match this host to give specific OS details
  2145.  
  2146. TRACEROUTE (using port 137/udp)
  2147. HOP RTT ADDRESS
  2148. 1 54.83 ms 10.250.204.1
  2149. 2 ... 3
  2150. 4 32.08 ms 10.250.204.1
  2151. 5 97.64 ms 10.250.204.1
  2152. 6 97.63 ms 10.250.204.1
  2153. 7 97.63 ms 10.250.204.1
  2154. 8 97.60 ms 10.250.204.1
  2155. 9 64.32 ms 10.250.204.1
  2156. 10 31.86 ms 10.250.204.1
  2157. 11 ... 18
  2158. 19 59.23 ms 10.250.204.1
  2159. 20 33.07 ms 10.250.204.1
  2160. 21 ... 27
  2161. 28 33.54 ms 10.250.204.1
  2162. 29 ...
  2163. 30 33.89 ms 10.250.204.1
  2164.  
  2165. NSE: Script Post-scanning.
  2166. Initiating NSE at 11:15
  2167. Completed NSE at 11:15, 0.00s elapsed
  2168. Initiating NSE at 11:15
  2169. Completed NSE at 11:15, 0.00s elapsed
  2170. #######################################################################################################################################
  2171. Hosts
  2172. =====
  2173.  
  2174. address mac name os_name os_flavor os_sp purpose info comments
  2175. ------- --- ---- ------- --------- ----- ------- ---- --------
  2176. 67.225.228.134 srv01.imserver.com.br Unknown device
  2177.  
  2178. Services
  2179. ========
  2180.  
  2181. host port proto name state info
  2182. ---- ---- ----- ---- ----- ----
  2183. 67.225.228.134 53 udp domain unknown
  2184. 67.225.228.134 67 udp dhcps unknown
  2185. 67.225.228.134 68 udp dhcpc unknown
  2186. 67.225.228.134 69 udp tftp unknown
  2187. 67.225.228.134 88 udp kerberos-sec unknown
  2188. 67.225.228.134 123 udp ntp unknown
  2189. 67.225.228.134 137 udp netbios-ns filtered
  2190. 67.225.228.134 138 udp netbios-dgm filtered
  2191. 67.225.228.134 139 udp netbios-ssn unknown
  2192. 67.225.228.134 161 udp snmp unknown
  2193. 67.225.228.134 162 udp snmptrap filtered
  2194. 67.225.228.134 389 udp ldap unknown
  2195. 67.225.228.134 500 udp isakmp unknown
  2196. 67.225.228.134 520 udp route unknown
  2197. 67.225.228.134 2049 udp nfs unknown
  2198. #######################################################################################################################################
  2199. Anonymous JTSEC #OpAmazonia Full Recon #24
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!