API tools faq
paste
marys

www.royal.gov.

marys
Jan 5th, 2015
321
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.63 KB | None | 0 0
raw download clone embed print report
  1. Exploitation test by Anon-Ninja-Cat <3 see Cone-Ninja-Cat for Clearance - who will see Infosec-Ninja-Cat to Access the Cyber-Hive / Beware of Ghost-Ninja-Cat Tracking the Connections :)
  2.  
  3. #OpDeathEaters
  4. #OpChemtrails
  5.  
  6. We Are Anonymous
  7. We Are Legion
  8. We Are Ghosts of The Cyber-Hive
  9. We Own The Matrix...
  10. May Your Hacking Be Legendary Anon Family <3
  11.  
  12. http://www.royal.gov.uk/
  13.  
  14. IP Address 69.172.200.184
  15.  
  16. Server Type nginx/1.7.6
  17.  
  18. 69.172.200.184
  19.  
  20. Server:nginx/1.7.6
  21. IP Address:69.172.200.184
  22. Port:443
  23. Hostname:www.royal.gov.uk
  24.  
  25. scan report for 69.172.200.184
  26. Host is up (0.039s latency).
  27. PORT STATE SERVICE
  28. 80/tcp open http
  29. 443/tcp open https
  30.  
  31. HTTP/1.1 200 OK
  32. Server: nginx/1.7.6
  33. Date: Mon, 05 Jan 2015 07:37:52 GMT
  34. Content-Type: text/html
  35. Connection: close
  36. P3P: CP="NON DSP COR ADMa OUR IND UNI COM NAV INT"
  37. Cache-Control: no-cache
  38.  
  39. IP Address Location IP Address Owner Last seen on this IP
  40. 69.172.200.184 Richmond - Canada Peer 1 Network (USA) Inc. 2015-01-02
  41.  
  42. 0 site(s) hosted on ip 69.172.200.184
  43. Location: New York,United States
  44.  
  45. ----- www.royal.gov.uk -----
  46.  
  47.  
  48. Host's addresses:
  49. __________________
  50.  
  51. www.royal.gov.uk 5 IN A 69.172.200.184
  52.  
  53. royal.gov.uk 69.172.200.184 US,UNITED STATES mail.royal.gov.uk gov.uk
  54.  
  55. The URL "http://www.royal.gov.uk/" has the following allowed methods: *, GET, HEAD.
  56.  
  57. The mail account: "[email protected]" was found in: "http://www.google.com/[email protected]&start=10&sa=N&hl=en".
  58.  
  59. The remote web server seems to have a reverse proxy installed
  60.  
  61. The remote web server sent the HTTP header: "P3P" with value: "CP="NON DSP COR ADMa OUR IND UNI COM NAV INT"".
  62.  
  63. The target site *has* a DNS wildcard configuration
  64.  
  65. The remote network has an active filter.
  66.  
  67.  
  68. ==================================================================================================================================
  69. Testing SSL server www.royal.gov.uk on port 443
  70.  
  71. Supported Server Cipher(s):
  72.  
  73. Accepted TLSv1 256 bits AES256-SHA
  74. Accepted TLSv1 128 bits AES128-SHA
  75. Accepted TLSv1 168 bits DES-CBC3-SHA
  76. Accepted TLSv1 128 bits RC4-SHA
  77.  
  78. Prefered Server Cipher(s):
  79. TLSv1 128 bits RC4-SHA
  80.  
  81. SSL Certificate:
  82. Version: 2
  83. Serial Number: 1277064306
  84. Signature Algorithm: sha1WithRSAEncryption
  85. Issuer: /C=US/O=Entrust, Inc./OU=www.entrust.net/rpa is incorporated by reference/OU=(c) 2009 Entrust, Inc./CN=Entrust Certification Authority - L1C
  86. Not valid before: Dec 3 17:24:17 2012 GMT
  87. Not valid after: Dec 12 03:22:29 2016 GMT
  88. Subject: /C=GB/L=London/O=The Royal Household/OU=Information Systems Management/CN=www.royal.gov.uk
  89. Public Key Algorithm: rsaEncryption
  90. RSA Public Key: (2048 bit)
  91. Modulus (2048 bit):
  92. 00:ed:82:86:db:0f:7b:9a:0c:a3:1a:3c:e5:91:4b:
  93. e8:ad:66:6b:85:35:7d:96:c1:5c:32:34:3f:b0:27:
  94. 75:86:60:f0:f1:c3:f3:99:cf:db:f7:5a:a2:9b:fc:
  95. d2:3e:c3:d8:4f:ec:58:45:fc:f6:f5:2c:5f:a8:44:
  96. 9b:25:b3:34:90:57:f6:b6:a4:66:9d:0e:21:4d:cb:
  97. 53:5e:27:05:d5:c1:d5:f5:82:60:03:72:36:31:73:
  98. fd:f3:5e:71:70:d3:9b:9e:20:02:4f:1c:ad:ee:95:
  99. 80:f3:b7:06:fb:04:87:42:f2:50:71:38:f0:e5:4c:
  100. d0:52:87:be:d3:e9:f8:69:ba:ff:75:74:1b:c6:c6:
  101. 41:4c:70:21:65:0c:9f:10:d9:ec:7f:ef:56:4c:11:
  102. 64:42:d0:dd:2e:ba:b6:2a:99:8e:f3:d7:4c:e6:e6:
  103. 8c:f4:c0:ee:37:bd:2a:c2:a0:f0:a0:81:d5:64:b5:
  104. 1a:62:a2:b9:da:43:a3:f6:70:e0:dd:c0:18:59:00:
  105. a7:c7:a3:40:c9:ba:8d:2f:02:5d:ea:1b:a2:84:f4:
  106. f4:0d:33:be:53:ad:d4:3e:2d:d1:b8:a3:49:5a:e1:
  107. 97:de:e7:cf:44:5e:49:93:13:34:bd:fe:ec:07:32:
  108. cb:bd:ae:71:f9:11:60:8e:43:ae:39:f3:a4:ea:33:
  109. 57:3d
  110. Exponent: 65537 (0x10001)
  111. X509v3 Extensions:
  112. X509v3 Key Usage:
  113. Digital Signature, Key Encipherment
  114. X509v3 Extended Key Usage:
  115. TLS Web Server Authentication
  116. X509v3 CRL Distribution Points:
  117. URI:http://crl.entrust.net/level1c.crl
  118.  
  119. Authority Information Access:
  120. OCSP - URI:http://ocsp.entrust.net
  121. CA Issuers - URI:http://aia.entrust.net/2048-l1c.cer
  122.  
  123. X509v3 Certificate Policies:
  124. Policy: 1.2.840.113533.7.75.2
  125. CPS: http://www.entrust.net/rpa
  126. Policy: 2.23.140.1.2.2
  127.  
  128. X509v3 Subject Alternative Name:
  129. DNS:www.royal.gov.uk
  130. X509v3 Authority Key Identifier:
  131. keyid:1E:F1:AB:89:06:F8:49:0F:01:33:77:EE:14:7A:EE:19:7C:93:28:4D
  132.  
  133. X509v3 Subject Key Identifier:
  134. 71:62:B5:4C:E1:E8:91:0B:F7:E4:22:EA:03:D7:F2:42:F6:33:36:DD
  135. X509v3 Basic Constraints:
  136.  
  137.  
  138.  
  139. EXPLOITS:
  140.  
  141. The whole target has no protection (X-Frame-Options header) against ClickJacking attack
  142.  
  143. A web backdoor was found at: "http://www.royal.gov.uk/ListServlet"; this could indicate that the server was hacked. ( i think so )(lulz)
  144. GET http://www.royal.gov.uk/ListServlet HTTP/1.1
  145. Host: www.royal.gov.uk
  146.  
  147. The URL: "http://www.royal.gov.uk/ListServlet" sent the cookie: "ASP.NET_SessionId=erj2g245yzjyjbqz2y0uh055; path=/; HttpOnly"
  148. GET http://www.royal.gov.uk/ListServlet HTTP/1.1
  149. Host: www.royal.gov.uk
  150.  
  151. A cookie matching the cookie fingerprint DB has been found when requesting "http://www.royal.gov.uk/ListServlet" . The remote platform is: "ASP.NET"
  152.  
  153. The URI: "http://www.royal.gov.uk/ListServlet" sent a META tag with attribute value "version" which looks interesting.
  154.  
  155. Server does not have session resumption enabled
  156. Users may experience slower performance
  157.  
  158. Server has not enabled HTTP Strict-Transport-Security
  159. Users may be exposed to man-in-the-middle attacks
  160.  
  161. Server doesn’t prefer ciphers that enable forward secrecy.
  162. Encrypted communications captured today are at risk of being decrypted by an attacker in the future
  163.  
  164. Server uses RC4 cipher with modern browsers
  165. More secure ciphers are available for TLS 1.1 and newer
  166.  
  167. Server is using RC4-based ciphersuites which have known vulnerabilities
  168. Evaluate your client compatibility requirements to determine if you can disable RC4-based ciphersuites
  169.  
  170. SSL 2.0 Disabled:Pass
  171. SSL 3.0 Disabled:Pass
  172. TLS 1.0 Enabled:Pass
  173. TLS 1.1 Enabled:Pass
  174. TLS 1.2 Enabled:Pass
  175. Weak ciphersuites disabled:Pass
  176. Certificates configured correctly:Pass
  177. Secure renegotiation configured:Pass
  178. Session resumption configured:Fail
  179. BEAST Vulnerability:Pass
  180. OCSP Stapling:Fail
  181. PCI Compliant:Pass
  182. FIPS Compliant:Fail
  183. Forward Secrecy Supported:Fail
  184. Heartbleed Vulnerability:Pass
  185.  
  186. Strict Transport Security:Fail
  187. Mixed Content (HTTP and HTTPS):Pass
  188. Domain name resolves to IPv4 address:Pass
  189. Domain name resolves to IPv6 address:Fail
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!