API tools faq
paste
JTSEC1333

Anonymous JTSEC #OpAssange Full Recon #16

JTSEC1333
Apr 29th, 2019
762
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 38.77 KB | None | 0 0
raw download clone embed print report
  1. #######################################################################################################################################
  2. =======================================================================================================================================
  3. Hostname www.bce.fin.ec ISP Telconet S.A
  4. Continent South America Flag
  5. EC
  6. Country Ecuador Country Code EC
  7. Region Unknown Local time 26 Apr 2019 12:27 -05
  8. City Unknown Postal Code Unknown
  9. IP Address 186.5.42.15 Latitude -2
  10. Longitude -77.5
  11. =======================================================================================================================================
  12. #######################################################################################################################################
  13. > www.bce.fin.ec
  14. Server: 38.132.106.139
  15. Address: 38.132.106.139#53
  16.  
  17. Non-authoritative answer:
  18. Name: www.bce.fin.ec
  19. Address: 186.5.42.15
  20. >
  21. #######################################################################################################################################
  22. HostIP:190.152.47.135
  23. HostName:www.bce.fin.ec
  24.  
  25. Gathered Inet-whois information for 190.152.47.135
  26. ---------------------------------------------------------------------------------------------------------------------------------------
  27.  
  28.  
  29. inetnum: 189.0.0.0 - 192.5.27.255
  30. netname: NON-RIPE-NCC-MANAGED-ADDRESS-BLOCK
  31. descr: IPv4 address block not managed by the RIPE NCC
  32. remarks: ------------------------------------------------------
  33. remarks:
  34. remarks: For registration information,
  35. remarks: you can consult the following sources:
  36. remarks:
  37. remarks: IANA
  38. remarks: http://www.iana.org/assignments/ipv4-address-space
  39. remarks: http://www.iana.org/assignments/iana-ipv4-special-registry
  40. remarks: http://www.iana.org/assignments/ipv4-recovered-address-space
  41. remarks:
  42. remarks: AFRINIC (Africa)
  43. remarks: http://www.afrinic.net/ whois.afrinic.net
  44. remarks:
  45. remarks: APNIC (Asia Pacific)
  46. remarks: http://www.apnic.net/ whois.apnic.net
  47. remarks:
  48. remarks: ARIN (Northern America)
  49. remarks: http://www.arin.net/ whois.arin.net
  50. remarks:
  51. remarks: LACNIC (Latin America and the Carribean)
  52. remarks: http://www.lacnic.net/ whois.lacnic.net
  53. remarks:
  54. remarks: ------------------------------------------------------
  55. country: EU # Country is really world wide
  56. admin-c: IANA1-RIPE
  57. tech-c: IANA1-RIPE
  58. status: ALLOCATED UNSPECIFIED
  59. mnt-by: RIPE-NCC-HM-MNT
  60. created: 2019-01-07T10:49:25Z
  61. last-modified: 2019-01-07T10:49:25Z
  62. source: RIPE
  63.  
  64. role: Internet Assigned Numbers Authority
  65. address: see http://www.iana.org.
  66. admin-c: IANA1-RIPE
  67. tech-c: IANA1-RIPE
  68. nic-hdl: IANA1-RIPE
  69. remarks: For more information on IANA services
  70. remarks: go to IANA web site at http://www.iana.org.
  71. mnt-by: RIPE-NCC-MNT
  72. created: 1970-01-01T00:00:00Z
  73. last-modified: 2001-09-22T09:31:27Z
  74. source: RIPE # Filtered
  75.  
  76. % This query was served by the RIPE Database Query Service version 1.93.2 (HEREFORD)
  77.  
  78.  
  79.  
  80. Gathered Inic-whois information for bce.fin.ec
  81. ---------------------------------------------------------------------------------------------------------------------------------------
  82. Unable to connect: Socket Connect Error
  83. ERROR: Connection to InicWhois Server ec.whois-servers.net failed
  84.  
  85. Gathered Netcraft information for www.bce.fin.ec
  86. ---------------------------------------------------------------------------------------------------------------------------------------
  87.  
  88. Retrieving Netcraft.com information for www.bce.fin.ec
  89. Netcraft.com Information gathered
  90.  
  91. Gathered Subdomain information for bce.fin.ec
  92. ---------------------------------------------------------------------------------------------------------------------------------------
  93. Searching Google.com:80...
  94. HostName:www.bce.fin.ec
  95. HostIP:186.5.42.15
  96. HostName:publico.bce.fin.ec
  97. HostIP:186.5.42.17
  98. HostName:contenido.bce.fin.ec
  99. HostIP:190.152.47.193
  100. HostName:numismatico.bce.fin.ec
  101. HostIP:186.5.42.78
  102. HostName:facturacion.bce.fin.ec
  103. HostIP:190.152.47.185
  104. Searching Altavista.com:80...
  105. Found 5 possible subdomain(s) for host bce.fin.ec, Searched 0 pages containing 0 results
  106.  
  107. Gathered E-Mail information for bce.fin.ec
  108. ---------------------------------------------------------------------------------------------------------------------------------------
  109. Searching Google.com:80...
  110. Searching Altavista.com:80...
  111. Found 0 E-Mail(s) for host bce.fin.ec, Searched 0 pages containing 0 results
  112.  
  113. Gathered TCP Port information for 190.152.47.135
  114. ---------------------------------------------------------------------------------------------------------------------------------------
  115.  
  116. Port State
  117.  
  118. 1/tcp open
  119. 2/tcp open
  120. 3/tcp open
  121. 4/tcp open
  122. 5/tcp open
  123. 6/tcp open
  124. 7/tcp open
  125. 8/tcp open
  126. 9/tcp open
  127. 10/tcp open
  128. 11/tcp open
  129. 12/tcp open
  130. 13/tcp open
  131. 14/tcp open
  132. 15/tcp open
  133. 16/tcp open
  134. 17/tcp open
  135. 18/tcp open
  136. 19/tcp open
  137. 20/tcp open
  138. 21/tcp open
  139. 22/tcp open
  140. 24/tcp open
  141. 26/tcp open
  142. 27/tcp open
  143. 28/tcp open
  144. 29/tcp open
  145. 30/tcp open
  146. 31/tcp open
  147. 32/tcp open
  148. 33/tcp open
  149. 34/tcp open
  150. 35/tcp open
  151. 36/tcp open
  152. 37/tcp open
  153. 38/tcp open
  154. 39/tcp open
  155. 40/tcp open
  156. 41/tcp open
  157. 42/tcp open
  158. 43/tcp open
  159. 44/tcp open
  160. 45/tcp open
  161. 46/tcp open
  162. 47/tcp open
  163. 48/tcp open
  164. 49/tcp open
  165. 50/tcp open
  166. 51/tcp open
  167. 52/tcp open
  168. 53/tcp open
  169. 54/tcp open
  170. 55/tcp open
  171. 56/tcp open
  172. 57/tcp open
  173. 58/tcp open
  174. 59/tcp open
  175. 60/tcp open
  176. 61/tcp open
  177. 62/tcp open
  178. 63/tcp open
  179. 64/tcp open
  180. 65/tcp open
  181. 66/tcp open
  182. 67/tcp open
  183. 68/tcp open
  184. 69/tcp open
  185. 70/tcp open
  186. 71/tcp open
  187. 72/tcp open
  188. 73/tcp open
  189. 74/tcp open
  190. 75/tcp open
  191. 76/tcp open
  192. 77/tcp open
  193. 78/tcp open
  194. 79/tcp open
  195. 80/tcp open
  196. 81/tcp open
  197. 82/tcp open
  198. 83/tcp open
  199. 84/tcp open
  200. 85/tcp open
  201. 86/tcp open
  202. 87/tcp open
  203. 88/tcp open
  204. 89/tcp open
  205. 90/tcp open
  206. 91/tcp open
  207. 92/tcp open
  208. 93/tcp open
  209. 94/tcp open
  210. 95/tcp open
  211. 96/tcp open
  212. 97/tcp open
  213. 98/tcp open
  214. 99/tcp open
  215. 100/tcp open
  216. 101/tcp open
  217. 102/tcp open
  218. 103/tcp open
  219. 104/tcp open
  220. 105/tcp open
  221. 106/tcp open
  222. 107/tcp open
  223. 108/tcp open
  224. 109/tcp open
  225. 110/tcp open
  226. 111/tcp open
  227. 112/tcp open
  228. 113/tcp open
  229. 114/tcp open
  230. 115/tcp open
  231. 116/tcp open
  232. 117/tcp open
  233. 118/tcp open
  234. 119/tcp open
  235. 120/tcp open
  236. 121/tcp open
  237. 122/tcp open
  238. 123/tcp open
  239. 124/tcp open
  240. 125/tcp open
  241. 126/tcp open
  242. 127/tcp open
  243. 128/tcp open
  244. 129/tcp open
  245. 130/tcp open
  246. 131/tcp open
  247. 132/tcp open
  248. 133/tcp open
  249. 134/tcp open
  250. 135/tcp open
  251. 136/tcp open
  252. 137/tcp open
  253. 138/tcp open
  254. 140/tcp open
  255. 141/tcp open
  256. 142/tcp open
  257. 143/tcp open
  258. 144/tcp open
  259. 145/tcp open
  260. 146/tcp open
  261. 147/tcp open
  262. 148/tcp open
  263. 149/tcp open
  264.  
  265. Portscan Finished: Scanned 150 ports, 2 ports were in state closed
  266. #######################################################################################################################################
  267. [i] Scanning Site: https://www.bce.fin.ec
  268.  
  269.  
  270.  
  271. B A S I C I N F O
  272. =======================================================================================================================================
  273.  
  274.  
  275. [+] Site Title: Banco Central del Ecuador
  276. [+] IP address: 186.5.42.15
  277. [+] Web Server: Apache
  278. [+] CMS: Joomla
  279. [+] Cloudflare: Not Detected
  280. [+] Robots File: Could NOT Find robots.txt!
  281.  
  282.  
  283.  
  284.  
  285. H T T P H E A D E R S
  286. =======================================================================================================================================
  287.  
  288.  
  289. [i] HTTP/1.1 200 OK
  290. [i] Date: Fri, 26 Apr 2019 17:47:20 GMT
  291. [i] Server: Apache
  292. [i] X-Frame-Options: SAMEORIGIN
  293. [i] X-Powered-By: PHP/5.3.8
  294. [i] Set-Cookie: 260115c081151ace5df6366a84f1e0fa=45fafd0e13bd6ccfb09ecb0f90ede250; path=/; secure
  295. [i] P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
  296. [i] Cache-Control: no-cache
  297. [i] Pragma: no-cache
  298. [i] Connection: close
  299. [i] Content-Type: text/html; charset=utf-8
  300.  
  301.  
  302.  
  303.  
  304. D N S L O O K U P
  305. =======================================================================================================================================
  306.  
  307. bce.fin.ec. 0 IN SOA dns1.bce.fin.ec. hostmaster.bce.fin.ec. 2019030102 10800 3600 604800 60
  308. bce.fin.ec. 0 IN NS dns1.bce.fin.ec.
  309. bce.fin.ec. 0 IN NS dns2.bce.fin.ec.
  310. bce.fin.ec. 0 IN TXT "v=spf1 ip4:186.46.35.139 ip4:186.5.42.24 ip4:186.46.35.130 ip4:186.5.42.3 ip4:186.46.162.4 ip4:190.95.135.130 ip4:190.95.135.135 ip4:186.46.162.13 -all"
  311.  
  312.  
  313.  
  314. S U B - D O M A I N F I N D E R
  315. =======================================================================================================================================
  316.  
  317.  
  318. [i] Total Subdomains Found : 24
  319.  
  320. [+] Subdomain: dns2.bce.fin.ec
  321. [-] IP: 186.5.42.58
  322.  
  323. [+] Subdomain: www3.bce.fin.ec
  324. [-] IP: 186.5.42.73
  325.  
  326. [+] Subdomain: www4.bce.fin.ec
  327. [-] IP: 186.46.162.21
  328.  
  329. [+] Subdomain: gcc.bce.fin.ec
  330. [-] IP: 186.5.42.114
  331.  
  332. [+] Subdomain: cfc.bce.fin.ec
  333. [-] IP: 186.5.42.19
  334.  
  335. [+] Subdomain: adf.bce.fin.ec
  336. [-] IP: 186.5.42.103
  337.  
  338. [+] Subdomain: dcvg.bce.fin.ec
  339. [-] IP: 186.46.162.20
  340.  
  341. [+] Subdomain: wgi.bce.fin.ec
  342. [-] IP: 186.5.42.79
  343.  
  344. [+] Subdomain: www.portal.bce.fin.ec
  345. [-] IP: 186.46.162.9
  346.  
  347. [+] Subdomain: mail.bce.fin.ec
  348. [-] IP: 190.152.47.140
  349.  
  350. [+] Subdomain: bceqmtain.bce.fin.ec
  351. [-] IP: 186.5.42.24
  352.  
  353. [+] Subdomain: facturacion.bce.fin.ec
  354. [-] IP: 186.5.42.72
  355.  
  356. [+] Subdomain: scp-preproduccion.bce.fin.ec
  357. [-] IP: 190.152.47.237
  358.  
  359. [+] Subdomain: gco.bce.fin.ec
  360. [-] IP: 190.152.47.229
  361.  
  362. [+] Subdomain: publico.bce.fin.ec
  363. [-] IP: 186.5.42.17
  364.  
  365. [+] Subdomain: numismatico.bce.fin.ec
  366. [-] IP: 190.152.47.218
  367.  
  368. [+] Subdomain: contenido.bce.fin.ec
  369. [-] IP: 190.152.47.193
  370.  
  371. [+] Subdomain: pagorapido.bce.fin.ec
  372. [-] IP: 186.5.42.86
  373.  
  374. [+] Subdomain: srp.bce.fin.ec
  375. [-] IP: 186.5.42.49
  376.  
  377. [+] Subdomain: traveler.bce.fin.ec
  378. [-] IP: 190.152.47.159
  379.  
  380. [+] Subdomain: gcopruebas.bce.fin.ec
  381. [-] IP: 186.5.42.113
  382.  
  383. [+] Subdomain: sintesis.bce.fin.ec
  384. [-] IP: 186.5.42.110
  385.  
  386. [+] Subdomain: dcv.bce.fin.ec
  387. [-] IP: 190.152.47.146
  388.  
  389. [+] Subdomain: www.bce.fin.ec
  390. [-] IP: 186.5.42.15
  391. #######################################################################################################################################
  392. [?] Enter the target: example( http://domain.com )
  393. https://www.bce.fin.ec/
  394. [!] IP Address : 190.152.47.135
  395. [!] www.bce.fin.ec doesn't seem to use a CMS
  396. [+] Honeypot Probabilty: 0%
  397. ---------------------------------------------------------------------------------------------------------------------------------------
  398. [~] Trying to gather whois information for www.bce.fin.ec
  399. [+] Whois information found
  400. [-] Unable to build response, visit https://who.is/whois/www.bce.fin.ec
  401. ---------------------------------------------------------------------------------------------------------------------------------------
  402. PORT STATE SERVICE
  403. 21/tcp open ftp
  404. 22/tcp open ssh
  405. 23/tcp filtered telnet
  406. 80/tcp open http
  407. 110/tcp open pop3
  408. 143/tcp open imap
  409. 443/tcp open https
  410. 3389/tcp open ms-wbt-server
  411. Nmap done: 1 IP address (1 host up) scanned in 1.52 seconds
  412. ---------------------------------------------------------------------------------------------------------------------------------------
  413. There was an error getting results
  414.  
  415. [-] DNS Records
  416. [>] Initiating 3 intel modules
  417. [>] Loading Alpha module (1/3)
  418. [>] Beta module deployed (2/3)
  419. [>] Gamma module initiated (3/3)
  420.  
  421.  
  422. [+] Emails found:
  423. ---------------------------------------------------------------------------------------------------------------------------------------
  424. [email protected]
  425. No hosts found
  426. [+] Virtual hosts:
  427. ---------------------------------------------------------------------------------------------------------------------------------------
  428. #######################################################################################################################################
  429. =======================================================================================================================================
  430. | E-mails:
  431. | [+] E-mail Found: [email protected]
  432. | [+] E-mail Found: [email protected]
  433. | [+] E-mail Found: [email protected]
  434. | [+] E-mail Found: [email protected]
  435. =======================================================================================================================================
  436. | External hosts:
  437. | [+] External Host Found: https://numismatico.bce.fin.ec
  438. | [+] External Host Found: https://www.bce.ec
  439. | [+] External Host Found: http://iamceege.github.io
  440. | [+] External Host Found: http://www.cosede.gob.ec
  441. | [+] External Host Found: http://contenido.bce.fin.ec
  442. | [+] External Host Found: https://bit.ly
  443. | [+] External Host Found: http://172.28.2.61
  444. | [+] External Host Found: http://www.bce.ec
  445. | [+] External Host Found: https://www.youtube.com
  446. | [+] External Host Found: https://dcv.bce.fin.ec
  447. | [+] External Host Found: https://contenido.bce.fin.ec
  448. | [+] External Host Found: https://youtu.be
  449. | [+] External Host Found: https://www.google.com
  450. | [+] External Host Found: http://code.jquery.com
  451. | [+] External Host Found: https://www.eci.bce.ec
  452. | [+] External Host Found: https://ajax.googleapis.com
  453. | [+] External Host Found: http://www.winzip.com
  454. | [+] External Host Found: https://publico.bce.fin.ec
  455. | [+] External Host Found: https://www.pptart.net
  456. | [+] External Host Found: http://www.youtube.com
  457. | [+] External Host Found: https://www.juntamonetariafinanciera.gob.ec
  458. | [+] External Host Found: http://documents
  459. =======================================================================================================================================
  460. #######################################################################################################################################
  461. Enter Address Website = 186.5.42.15
  462.  
  463. Reversing IP With HackTarget '186.5.42.15'
  464. ---------------------------------------------------------------------------------------------------------------------------------------
  465.  
  466. [+] 186.5.42.15
  467. [+] www.bce.fin.ec
  468. #######################################################################################################################################
  469.  
  470. Reverse IP With YouGetSignal '186.5.42.15'
  471. ---------------------------------------------------------------------------------------------------------------------------------------
  472.  
  473. [*] IP: 186.5.42.15
  474. [*] Domain: 186.5.42.15
  475. [*] Total Domains: 2
  476.  
  477. [+] www.bce.ec
  478. [+] www.bce.fin.ec
  479. #######################################################################################################################################
  480.  
  481. Geo IP Lookup '186.5.42.15'
  482. ---------------------------------------------------------------------------------------------------------------------------------------
  483.  
  484. [+] IP Address: 186.5.42.15
  485. [+] Country: Ecuador
  486. [+] State:
  487. [+] City:
  488. [+] Latitude: -2.0
  489. [+] Longitude: -77.5
  490. #######################################################################################################################################
  491.  
  492. Whois '186.5.42.15'
  493. ---------------------------------------------------------------------------------------------------------------------------------------
  494.  
  495. [+] % Joint Whois - whois.lacnic.net
  496. [+] % This server accepts single ASN, IPv4 or IPv6 queries
  497. [+]
  498. [+] % LACNIC resource: whois.lacnic.net
  499. [+] % Copyright LACNIC lacnic.net
  500. [+] % The data below is provided for information purposes
  501. [+] % and to assist persons in obtaining information about or
  502. [+] % related to AS and IP numbers registrations
  503. [+] % By submitting a whois query, you agree to use this data
  504. [+] % only for lawful purposes.
  505. [+] % 2019-04-29 06:19:09 (-03 -03:00)
  506. [+] inetnum: 186.5.42.0/27
  507. [+] status: reallocated
  508. [+] owner: Clientes Quito
  509. [+] ownerid: EC-CLQU1-LACNIC
  510. [+] responsible: Tomislav Topic
  511. [+] address: Kennedy Norte Mz. 109 Solar 21, 5, Piso 2
  512. [+] address: 5934 - Guayaquil - GY
  513. [+] country: EC
  514. [+] phone: +593 4 2680555 [101]
  515. [+] owner-c: SEL
  516. [+] tech-c: SEL
  517. [+] abuse-c: SEL
  518. [+] created: 20110830
  519. [+] changed: 20110830
  520. [+] inetnum-up: 186.5.0/17
  521. [+] nic-hdl: SEL
  522. [+] person: Carlos Montero
  523. [+] e-mail: [email protected]
  524. [+] address: Kennedy Norte MZ, 109, Solar 21
  525. [+] address: 59342 - Guayaquil -
  526. [+] country: EC
  527. [+] phone: +593 42680555 [4601]
  528. [+] created: 20021004
  529. [+] changed: 20170323
  530. [+] % whois.lacnic.net accepts only direct match queries.
  531. [+] % Types of queries are: POCs, ownerid, CIDR blocks, IP
  532. [+] % and AS numbers.
  533. #######################################################################################################################################
  534.  
  535. Show HTTP Header '186.5.42.15'
  536. ---------------------------------------------------------------------------------------------------------------------------------------
  537.  
  538. [+] HTTP/1.0 302 Found
  539. [+] Location: https://186.5.42.15/
  540. [+] Server: BigIP
  541. [+] Connection: Keep-Alive
  542. [+] Content-Length: 0
  543. #######################################################################################################################################
  544.  
  545. Port Scan '186.5.42.15'
  546. ---------------------------------------------------------------------------------------------------------------------------------------
  547.  
  548. Starting Nmap 7.70 ( https://nmap.org ) at 2019-04-29 09:19 UTC
  549. Nmap scan report for 186.5.42.15
  550. Host is up (0.098s latency).
  551.  
  552. PORT STATE SERVICE
  553. 21/tcp open ftp
  554. 22/tcp open ssh
  555. 23/tcp open telnet
  556. 80/tcp open http
  557. 110/tcp open pop3
  558. 143/tcp open imap
  559. 443/tcp open https
  560. 3389/tcp open ms-wbt-server
  561.  
  562. Nmap done: 1 IP address (1 host up) scanned in 0.15 seconds
  563. #######################################################################################################################################
  564. ; <<>> DiG 9.11.5-P4-3-Debian <<>> bce.fin.ec
  565. ;; global options: +cmd
  566. ;; Got answer:
  567. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45765
  568. ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
  569.  
  570. ;; OPT PSEUDOSECTION:
  571. ; EDNS: version: 0, flags:; udp: 4096
  572. ;; QUESTION SECTION:
  573. ;bce.fin.ec. IN A
  574.  
  575. ;; AUTHORITY SECTION:
  576. bce.fin.ec. 0 IN SOA dns1.bce.fin.ec. hostmaster.bce.fin.ec. 2019030102 10800 3600 604800 60
  577.  
  578. ;; Query time: 234 msec
  579. ;; SERVER: 38.132.106.139#53(38.132.106.139)
  580. ;; WHEN: lun avr 29 05:22:19 EDT 2019
  581. ;; MSG SIZE rcvd: 91
  582. #######################################################################################################################################
  583. ; <<>> DiG 9.11.5-P4-3-Debian <<>> +trace bce.fin.ec
  584. ;; global options: +cmd
  585. . 80084 IN NS d.root-servers.net.
  586. . 80084 IN NS l.root-servers.net.
  587. . 80084 IN NS c.root-servers.net.
  588. . 80084 IN NS k.root-servers.net.
  589. . 80084 IN NS b.root-servers.net.
  590. . 80084 IN NS h.root-servers.net.
  591. . 80084 IN NS g.root-servers.net.
  592. . 80084 IN NS a.root-servers.net.
  593. . 80084 IN NS f.root-servers.net.
  594. . 80084 IN NS i.root-servers.net.
  595. . 80084 IN NS e.root-servers.net.
  596. . 80084 IN NS m.root-servers.net.
  597. . 80084 IN NS j.root-servers.net.
  598. . 80084 IN RRSIG NS 8 0 518400 20190512050000 20190429040000 25266 . bQWAaqwMGyuKJ43sy8YDogYmQbm0CPjSlIxhdSa5QhQXjWArYKeHpS/F oaoDGBoDxxTkNKDqhFp5NWZikNXGfzDr6VdYnWoRzhscK7gMC0UFdiLf HelwaJ8agLehlq9Hp6mX2AVUdTd0UfZcRioI3OS6azSMGEocNI96T4+9 AJ633UU62cSMEzxE/t+5U6p2Vc/JDwg4Ji9n9mPNJSN3oeBlyB4MXfLz 0/GpNbEagyWJOhWzpRyo4/DOTFxG8tyrnZWYLe88f8Brkdxm0AFg7xAh E55hO+57oGciCR0xffYvtJMX/oPll1Qa6tlGBBIZXtKwSsiktKA115Mw w6mLWQ==
  599. ;; Received 525 bytes from 38.132.106.139#53(38.132.106.139) in 33 ms
  600.  
  601. ec. 172800 IN NS sns-pb.isc.org.
  602. ec. 172800 IN NS a.lactld.org.
  603. ec. 172800 IN NS n3.dns.ec.
  604. ec. 172800 IN NS n2.nic.ec.
  605. ec. 86400 IN NSEC eco. NS RRSIG NSEC
  606. ec. 86400 IN RRSIG NSEC 8 1 86400 20190512050000 20190429040000 25266 . AAKUGZvhFeyG7SUGomscjoUOE5zx2Ho+5hKKtKKq3PGxYrBYYB6zh93H 7C1zZdGvz4sr4PDcUVw9XrGTYK/E5nAphwuwTZvQA46Q6XBObaRm8n7a uSucjLzbzdCEi1q2BQKi/cWej6gJ3dpQ8UGwFxbofckxXRm8uRAEUgG2 o2S5BMIMl2lUDpFua1aRw6h4cN2TlCs0kgxWwP+LKWqvsgEby35m/a/p sqJ6jq2Y3Krj+w7857+uKFm7p9yJ7M1Zif+U3SitFPpAB7zBLSP+YtwI PE4l11/1coj+pVQn/M1G1IK0vBZ6ItdAGr74iTx6s5bGHLWWz8Mi0Oo9 dwrNNQ==
  607. ;; Received 648 bytes from 199.9.14.201#53(b.root-servers.net) in 86 ms
  608.  
  609. bce.fin.ec. 129600 IN NS dns1.bce.fin.ec.
  610. bce.fin.ec. 129600 IN NS dns2.bce.fin.ec.
  611. bce.fin.ec. 129600 IN NS dns3.bce.fin.ec.
  612. bce.fin.ec. 129600 IN NS dns4.bce.fin.ec.
  613. couldn't get address for 'dns3.bce.fin.ec': not found
  614. ;; Received 179 bytes from 200.0.68.10#53(a.lactld.org) in 149 ms
  615.  
  616. bce.fin.ec. 0 IN SOA dns1.bce.fin.ec. hostmaster.bce.fin.ec. 2019030102 10800 3600 604800 60
  617. ;; Received 91 bytes from 186.5.42.58#53(dns2.bce.fin.ec) in 128 ms
  618. #######################################################################################################################################
  619. [*] Performing General Enumeration of Domain: bce.fin.ec
  620. [-] DNSSEC is not configured for bce.fin.ec
  621. [*] SOA dns1.bce.fin.ec 190.152.47.130
  622. [*] NS dns1.bce.fin.ec 190.152.47.130
  623. [*] Bind Version for 190.152.47.130 9.9.7-P3
  624. [*] NS dns2.bce.fin.ec 186.5.42.58
  625. [*] Bind Version for 186.5.42.58 9.9.7-P3
  626. [-] Could not Resolve MX Records for bce.fin.ec
  627. [*] TXT bce.fin.ec v=spf1 ip4:186.46.35.139 ip4:186.5.42.24 ip4:186.46.35.130 ip4:186.5.42.3 ip4:186.46.162.4 ip4:190.95.135.130 ip4:190.95.135.135 ip4:186.46.162.13 -all
  628. [*] Enumerating SRV Records
  629. [-] No SRV Records Found for bce.fin.ec
  630. [+] 0 Records Found
  631. #######################################################################################################################################
  632. [*] Processing domain bce.fin.ec
  633. [*] Using system resolvers ['38.132.106.139', '194.187.251.67', '185.93.180.131', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  634. [+] Getting nameservers
  635. 186.5.42.58 - dns2.bce.fin.ec
  636. 190.95.135.130 - dns4.bce.fin.ec
  637. 186.46.162.4 - dns3.bce.fin.ec
  638. 190.152.47.130 - dns1.bce.fin.ec
  639. [-] Zone transfer failed
  640.  
  641. [+] TXT records found
  642. "v=spf1 ip4:186.46.35.139 ip4:186.5.42.24 ip4:186.46.35.130 ip4:186.5.42.3 ip4:186.46.162.4 ip4:190.95.135.130 ip4:190.95.135.135 ip4:186.46.162.13 -all"
  643.  
  644. [*] Scanning bce.fin.ec for A records
  645. 190.152.47.130 - dns1.bce.fin.ec
  646. 186.5.42.58 - dns2.bce.fin.ec
  647. 186.46.162.4 - dns3.bce.fin.ec
  648. 190.95.135.130 - dns4.bce.fin.ec
  649. 186.5.42.16 - ftp.bce.fin.ec
  650. 127.0.0.1 - localhost.bce.fin.ec
  651. 190.95.135.141 - mail.bce.fin.ec
  652. 186.5.42.25 - mail.bce.fin.ec
  653. 186.46.162.8 - mail.bce.fin.ec
  654. 190.152.47.140 - mail.bce.fin.ec
  655. 186.5.42.15 - www.bce.fin.ec
  656. 190.95.135.139 - www3.bce.fin.ec
  657. 186.46.162.19 - www3.bce.fin.ec
  658. 190.152.47.211 - www3.bce.fin.ec
  659. 186.5.42.73 - www3.bce.fin.ec
  660. 190.95.135.146 - www4.bce.fin.ec
  661. 186.46.162.21 - www4.bce.fin.ec
  662. #######################################################################################################################################
  663. Ip Address Status Type Domain Name Server
  664. ---------- ------ ---- ----------- ------
  665. 190.152.47.241 500 host cloud.bce.fin.ec
  666. 186.5.42.116 500 host cloud.bce.fin.ec
  667. 190.152.47.130 host dns1.bce.fin.ec
  668. 186.5.42.58 host dns2.bce.fin.ec
  669. 186.46.162.4 404 host dns3.bce.fin.ec
  670. 186.5.42.16 host ftp.bce.fin.ec
  671. 127.0.0.1 host localhost.bce.fin.ec
  672. 186.5.42.25 500 host mail.bce.fin.ec
  673. 190.152.47.140 500 host mail.bce.fin.ec
  674. 190.95.135.141 500 host mail.bce.fin.ec
  675. 186.46.162.8 500 host mail.bce.fin.ec
  676. 186.5.42.15 302 host www.bce.fin.ec
  677. 190.152.47.211 503 host www3.bce.fin.ec
  678. 190.95.135.139 503 host www3.bce.fin.ec
  679. 186.5.42.73 503 host www3.bce.fin.ec
  680. 186.46.162.19 503 host www3.bce.fin.ec
  681. #######################################################################################################################################
  682. [+] Testing domain
  683. www.bce.fin.ec 186.5.42.15
  684. [+] Dns resolving
  685. No address associated with hostname bce.fin.ec
  686. [+] Testing wildcard
  687. Ok, no wildcard found.
  688.  
  689. [+] Scanning for subdomain on bce.fin.ec
  690. [!] Wordlist not specified. I scannig with my internal wordlist...
  691. Estimated time about 85.17 seconds
  692.  
  693. Subdomain Ip address Name server
  694.  
  695. dns1.bce.fin.ec 190.152.47.130 130.47.152.190.static.anycast.cnt-grms.ec
  696. dns2.bce.fin.ec 186.5.42.58 dns2.bce.fin.ec
  697. dns3.bce.fin.ec 186.46.162.4 4.162.46.186.static.anycast.cnt-grms.ec
  698. ftp.bce.fin.ec 190.152.47.136 136.47.152.190.static.anycast.cnt-grms.ec
  699. localhost.bce.fin.ec 127.0.0.1 localhost
  700. www.bce.fin.ec 190.152.47.135 135.47.152.190.static.anycast.cnt-grms.ec
  701. #######################################################################################################################################
  702.  
  703. Processing https://www.bce.fin.ec/ ...
  704.  
  705.  
  706.  
  707. [+] FireWall Detector
  708. [++] Firewall not detected
  709.  
  710. [+] Detecting Joomla Version
  711. [++] Joomla 2.5.8
  712.  
  713. [+] Core Joomla Vulnerability
  714. [++] Joomla! Core Remote Privilege Escalation Vulnerability
  715. CVE : CVE-2016-9838
  716. EDB : https://www.exploit-db.com/exploits/41157/
  717.  
  718. Joomla! Component Akeeba Kickstart - Unserialize Remote Code Execution
  719. CVE : CVE-2014-7228
  720. EDB : https://www.exploit-db.com/exploits/35033/
  721.  
  722. Joomla! Highlighter Plugin Unspecified Cross-Site Scripting Vulnerability
  723. CVE : CVE-2013-3267
  724. https://developer.joomla.org/security/86-20130407-core-xss-vulnerability.html
  725.  
  726. Joomla! Unspecified Cross-Site Scripting Vulnerability
  727. CVE : CVE-2013-3058
  728. http://www.securityfocus.com/bid/59483
  729. http://developer.joomla.org/security/81-20130403-core-xss-vulnerability.html
  730.  
  731. Joomla! Unspecified Cross-Site Scripting Vulnerability
  732. CVE : CVE-2013-3059
  733. https://developer.joomla.org/security/80-20130405-core-xss-vulnerability.html
  734.  
  735. Joomla! Core Authentication Bypass Vulnerability
  736. CVE :CVE-2014-6632
  737. http://developer.joomla.org/security/594-20140902-core-unauthorised-logins.html
  738.  
  739. Joomla! Core Remote Denial of Service Vulnerability
  740. CVE : CVE-2014-7229
  741. https://developer.joomla.org/security/596-20140904-core-denial-of-service.html
  742.  
  743. PHPMailer Remote Code Execution Vulnerability
  744. CVE : CVE-2016-10033
  745. https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
  746. https://github.com/opsxcq/exploit-CVE-2016-10033
  747. EDB : https://www.exploit-db.com/exploits/40969/
  748.  
  749. PPHPMailer Incomplete Fix Remote Code Execution Vulnerability
  750. CVE : CVE-2016-10045
  751. https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection
  752. EDB : https://www.exploit-db.com/exploits/40969/
  753.  
  754.  
  755.  
  756. [+] Checking apache info/status files
  757. [++] Readable info/status files are not found
  758.  
  759. [+] admin finder
  760. [++] Admin page : https://www.bce.fin.ec/administrator/
  761.  
  762. [+] Checking robots.txt existing
  763. [++] robots.txt is not found
  764.  
  765. [+] Finding common backup files name
  766. [++] Backup files are not found
  767.  
  768. [+] Finding common log files name
  769. [++] error log is not found
  770.  
  771. [+] Checking sensitive config.php.x file
  772. [++] Readable config files are not found
  773. #######################################################################################################################################
  774. [-] Date & Time: 26/04/2019 13:31:10
  775. [I] Threads: 5
  776. [-] Target: https://www.bce.fin.ec (190.152.47.135)
  777. [I] Server: Apache
  778. [I] X-Powered-By: PHP/5.3.8
  779. [L] X-Frame-Options: Not Enforced
  780. [I] Strict-Transport-Security: Not Enforced
  781. [I] X-Content-Security-Policy: Not Enforced
  782. [I] X-Content-Type-Options: Not Enforced
  783. [L] No Robots.txt Found
  784. [I] CMS Detection: Joomla
  785. [I] Joomla Version: 2.5.8
  786. [M] EDB-ID: 46200 "Joomla! Core 3.9.1 - Persistent Cross-Site Scripting in Global Configuration Textfilter Settings"
  787. [M] EDB-ID: 42033 "Joomla! 3.7.0 - 'com_fields' SQL Injection"
  788. [M] EDB-ID: 40637 "Joomla! 3.4.4 < 3.6.4 - Account Creation / Privilege Escalation"
  789. [M] EDB-ID: 41157 "Joomla! < 3.6.4 - Admin Takeover"
  790. [M] EDB-ID: 38977 "Joomla! 1.5 < 3.4.5 - Object Injection Remote Command Execution"
  791. [M] EDB-ID: 39033 "Joomla! 1.5 < 3.4.5 - Object Injection 'x-forwarded-for' Header Remote Code Execution"
  792. [M] EDB-ID: 38534 "Joomla! 3.2.x < 3.4.4 - SQL Injection"
  793. [M] EDB-ID: 31459 "Joomla! 3.2.1 - SQL Injection"
  794. [M] EDB-ID: 25087 "Joomla! 3.0.3 - 'remember.php' PHP Object Injection"
  795. [M] EDB-ID: 24551 "Joomla! 3.0.2 - 'highlight.php' PHP Object Injection"
  796. [M] EDB-ID: 44227 "Joomla! 3.7 - SQL Injection"
  797. [I] Joomla Website Template: theme937
  798. [-] Joomla Default Files:
  799. [-] Joomla is likely to have a large number of default files
  800. [-] Would you like to list them all?
  801. [y/N]: y
  802. [I] https://www.bce.fin.ec/LICENSE.txt
  803. [I] https://www.bce.fin.ec/README.txt
  804. [I] https://www.bce.fin.ec/administrator/cache/index.html
  805. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-06.sql
  806. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-16.sql
  807. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-19.sql
  808. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-20.sql
  809. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-21-1.sql
  810. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-21-2.sql
  811. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-22.sql
  812. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-23.sql
  813. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2011-12-24.sql
  814. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2012-01-10.sql
  815. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.0-2012-01-14.sql
  816. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.1-2012-01-26.sql
  817. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.2-2012-03-05.sql
  818. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.3-2012-03-13.sql
  819. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-18.sql
  820. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.4-2012-03-19.sql
  821. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.5.sql
  822. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.6.sql
  823. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/mysql/2.5.7.sql
  824. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/sqlazure/2.5.2-2012-03-05.sql
  825. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/sqlazure/2.5.3-2012-03-13.sql
  826. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/sqlazure/2.5.4-2012-03-18.sql
  827. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/sqlazure/2.5.4-2012-03-19.sql
  828. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/sqlazure/2.5.5.sql
  829. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/sqlazure/2.5.6.sql
  830. [I] https://www.bce.fin.ec/administrator/components/com_admin/sql/updates/sqlazure/2.5.7.sql
  831. [I] https://www.bce.fin.ec/administrator/components/com_banners/sql/install.mysql.utf8.sql
  832. [I] https://www.bce.fin.ec/administrator/components/com_banners/sql/uninstall.mysql.utf8.sql
  833. [I] https://www.bce.fin.ec/administrator/components/com_contact/sql/install.mysql.utf8.sql
  834. [I] https://www.bce.fin.ec/administrator/components/com_contact/sql/uninstall.mysql.utf8.sql
  835. [I] https://www.bce.fin.ec/administrator/components/com_finder/sql/install.mysql.sql
  836. [I] https://www.bce.fin.ec/administrator/components/com_finder/sql/install.postgresql.sql
  837. [I] https://www.bce.fin.ec/administrator/components/com_finder/sql/uninstall.mysql.sql
  838. [I] https://www.bce.fin.ec/administrator/components/com_finder/sql/uninstall.postgresql.sql
  839. [I] https://www.bce.fin.ec/administrator/components/com_newsfeeds/sql/install.mysql.utf8.sql
  840. [I] https://www.bce.fin.ec/administrator/components/com_newsfeeds/sql/uninstall.mysql.utf8.sql
  841. [I] https://www.bce.fin.ec/administrator/language/overrides/index.html
  842. [I] https://www.bce.fin.ec/administrator/manifests/packages/index.html
  843. [I] https://www.bce.fin.ec/administrator/templates/hathor/LICENSE.txt
  844. [I] https://www.bce.fin.ec/cache/index.html
  845. [I] https://www.bce.fin.ec/cli/index.html
  846. [I] https://www.bce.fin.ec/components/index.html
  847. [I] https://www.bce.fin.ec/images/index.html
  848. [I] https://www.bce.fin.ec/includes/index.html
  849. [I] https://www.bce.fin.ec/language/index.html
  850. [I] https://www.bce.fin.ec/language/overrides/index.html
  851. [I] https://www.bce.fin.ec/libraries/fof/LICENSE.txt
  852. [I] https://www.bce.fin.ec/libraries/fof/version.txt
  853. [I] https://www.bce.fin.ec/libraries/index.html
  854. [I] https://www.bce.fin.ec/media/editors/tinymce/templates/layout1.html
  855. [I] https://www.bce.fin.ec/media/editors/tinymce/templates/snippet1.html
  856. [I] https://www.bce.fin.ec/media/index.html
  857. [I] https://www.bce.fin.ec/modules/index.html
  858. [I] https://www.bce.fin.ec/plugins/index.html
  859. [I] https://www.bce.fin.ec/templates/index.html
  860. [I] https://www.bce.fin.ec/tmp/index.html
  861. [I] https://www.bce.fin.ec/web.config.txt
  862. [-] Searching Joomla Components ...
  863. [I] mod_roknavmenu
  864. [I] mod_universal_ajaxlivesearch
  865. [I] Checking for Directory Listing Enabled ...
  866. [-] Date & Time: 26/04/2019 13:40:44
  867. [-] Completed in: 0:09:33
  868. #######################################################################################################################################
  869. ---------------------------------------------------------------------------------------------------------------------------------------
  870. + Target IP: 186.5.42.15
  871. + Target Hostname: 186.5.42.15
  872. + Target Port: 80
  873. + Start Time: 2019-04-26 14:30:58 (GMT-4)
  874. ---------------------------------------------------------------------------------------------------------------------------------------
  875. + Server: BigIP
  876. + The anti-clickjacking X-Frame-Options header is not present.
  877. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
  878. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
  879. + Root page / redirects to: https://186.5.42.15/
  880. + No CGI Directories found (use '-C all' to force check all possible dirs)
  881. + 7915 requests: 0 error(s) and 3 item(s) reported on remote host
  882. + End Time: 2019-04-26 14:48:04 (GMT-4) (1026 seconds)
  883. ---------------------------------------------------------------------------------------------------------------------------------------
  884. #######################################################################################################################################
  885. ---------------------------------------------------------------------------------------------------------------------------------------
  886. + Target IP: 190.152.47.135
  887. + Target Hostname: www.bce.fin.ec
  888. + Target Port: 443
  889. ---------------------------------------------------------------------------------------------------------------------------------------
  890. + SSL Info: Subject: /C=EC/ST=Pichincha/L=Quito/jurisdictionC=EC/O=Banco Central del Ecuador/businessCategory=Private Organization/serialNumber=1760002600001/CN=www.bce.fin.ec
  891. Ciphers: ECDHE-RSA-AES128-GCM-SHA256
  892. Issuer: /C=US/O=Entrust, Inc./OU=See www.entrust.net/legal-terms/OU=(c) 2014 Entrust, Inc. - for authorized use only/CN=Entrust Certification Authority - L1M
  893. + Start Time: 2019-04-26 13:57:19 (GMT-4)
  894. ---------------------------------------------------------------------------------------------------------------------------------------
  895. + Server: Apache
  896. + Retrieved x-powered-by header: PHP/5.3.8
  897. + The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
  898. + The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
  899. + The site uses SSL and Expect-CT header is not present.
  900. + The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
  901. + Cookie 260115c081151ace5df6366a84f1e0fa created without the httponly flag
  902. + Uncommon header 'x-content-encoded-by' found, with contents: Joomla! 2.5
  903. + The Content-Encoding header is set to "deflate" this may mean that the server is vulnerable to the BREACH attack.
  904. + Server may leak inodes via ETags, header found with file /favicon.ico, inode: 103023, size: 1150, mtime: Thu Aug 31 17:09:05 2017
  905. + Web Server returns a valid response with junk HTTP methods, this may cause false positives.
  906. + OSVDB-12184: /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
  907. + OSVDB-12184: /?=PHPE9568F36-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
  908. + OSVDB-12184: /?=PHPE9568F34-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
  909. + OSVDB-12184: /?=PHPE9568F35-D428-11d2-A769-00AA001ACF42: PHP reveals potentially sensitive information via certain HTTP requests that contain specific QUERY strings.
  910. + Cookie 9d1a5770cdce87d84c0b6f07a9139c9e created without the httponly flag
  911. + OSVDB-3092: /includes/: This might be interesting...
  912. + OSVDB-3092: /logs/: This might be interesting...
  913. + OSVDB-3092: /tmp/: This might be interesting...
  914. + OSVDB-3093: /.profile: User home dir with a shell profile was found. May reveal directory information and system configuration.
  915. + OSVDB-3233: /cgi-bin/test-cgi: Apache 2.0 default script is executable and reveals system information. All default scripts should be removed.
  916. + OSVDB-3268: /icons/: Directory indexing found.
  917. + OSVDB-3092: /LICENSE.txt: License file found may identify site software.
  918. + OSVDB-3233: /icons/README: Apache default file found.
  919. + 26583 requests: 4 error(s) and 23 item(s) reported on remote host
  920. + End Time: 2019-04-26 20:17:56 (GMT-4) (22837 seconds)
  921. ---------------------------------------------------------------------------------------------------------------------------------------
  922. #######################################################################################################################################
  923. Anonymous JTSEC #OpAssange Full Recon #16
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!