API tools faq
paste
JTSEC1333

Anonymous JTSEC #OpDomesticTerrorism Full Recon #3

JTSEC1333
Sep 28th, 2019
1,476
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 106.63 KB | None | 0 0
raw download clone embed print report
  1. #######################################################################################################################################
  2. =======================================================================================================================================
  3. Hostname fuhrernet.com ISP Comcast Cable Communications, LLC
  4. Continent North America Flag
  5. US
  6. Country United States Country Code US
  7. Region Pennsylvania Local time 28 Sep 2019 04:16 EDT
  8. City Levittown Postal Code 19056
  9. IP Address 68.81.58.227 Latitude 40.152
  10. Longitude -74.883
  11. =======================================================================================================================================
  12. #######################################################################################################################################
  13. > fuhrernet.com
  14. Server: 185.93.180.131
  15. Address: 185.93.180.131#53
  16.  
  17. Non-authoritative answer:
  18. Name: fuhrernet.com
  19. Address: 68.81.58.227
  20. >
  21. #######################################################################################################################################
  22. Domain Name: FUHRERNET.COM
  23. Registry Domain ID: 2183865559_DOMAIN_COM-VRSN
  24. Registrar WHOIS Server: whois.godaddy.com
  25. Registrar URL: http://www.godaddy.com
  26. Updated Date: 2019-09-17T14:54:51Z
  27. Creation Date: 2017-11-06T18:02:49Z
  28. Registry Expiry Date: 2020-11-06T18:02:49Z
  29. Registrar: GoDaddy.com, LLC
  30. Registrar IANA ID: 146
  31. Registrar Abuse Contact Email: [email protected]
  32. Registrar Abuse Contact Phone: 480-624-2505
  33. Domain Status: ok https://icann.org/epp#ok
  34. Name Server: NS47.DOMAINCONTROL.COM
  35. Name Server: NS48.DOMAINCONTROL.COM
  36. DNSSEC: unsigned
  37. #######################################################################################################################################
  38. Domain Name: fuhrernet.com
  39. Registry Domain ID: 2183865559_DOMAIN_COM-VRSN
  40. Registrar WHOIS Server: whois.godaddy.com
  41. Registrar URL: http://www.godaddy.com
  42. Updated Date: 2017-11-06T18:02:49Z
  43. Creation Date: 2017-11-06T18:02:49Z
  44. Registrar Registration Expiration Date: 2020-11-06T18:02:49Z
  45. Registrar: GoDaddy.com, LLC
  46. Registrar IANA ID: 146
  47. Registrar Abuse Contact Email: [email protected]
  48. Registrar Abuse Contact Phone: +1.4806242505
  49. Domain Status: ok http://www.icann.org/epp#ok
  50. Registrant Organization: Fuhrernet
  51. Registrant State/Province: Pennsylvania
  52. Registrant Country: US
  53. Registrant Email: Select Contact Domain Holder link at https://www.godaddy.com/whois/results.aspx?domain=fuhrernet.com
  54. Admin Email: Select Contact Domain Holder link at https://www.godaddy.com/whois/results.aspx?domain=fuhrernet.com
  55. Tech Email: Select Contact Domain Holder link at https://www.godaddy.com/whois/results.aspx?domain=fuhrernet.com
  56. Name Server: NS47.DOMAINCONTROL.COM
  57. Name Server: NS48.DOMAINCONTROL.COM
  58. DNSSEC: unsigned
  59. #######################################################################################################################################
  60. [+] Target : fuhrernet.com
  61.  
  62. [+] IP Address : 68.81.58.227
  63.  
  64. [+] Headers :
  65.  
  66. [+] Date : Sat, 28 Sep 2019 08:23:29 GMT
  67. [+] Server : Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  68. [+] X-Powered-By : PHP/7.1.1
  69. [+] Content-Length : 2626
  70. [+] Keep-Alive : timeout=5, max=100
  71. [+] Connection : Keep-Alive
  72. [+] Content-Type : text/html; charset=UTF-8
  73.  
  74. [+] SSL Certificate Information :
  75.  
  76. [+] commonName : localhost
  77. [+] commonName : localhost
  78. [+] Version : 1
  79. [+] Serial Number : B5C752C98781B503
  80. [+] Not Before : Nov 10 23:48:47 2009 GMT
  81. [+] Not After : Nov 8 23:48:47 2019 GMT
  82.  
  83. [+] Whois Lookup :
  84.  
  85. [+] NIR : None
  86. [+] ASN Registry : arin
  87. [+] ASN : 7922
  88. [+] ASN CIDR : 68.80.0.0/13
  89. [+] ASN Country Code : US
  90. [+] ASN Date : 2002-01-28
  91. [+] ASN Description : COMCAST-7922 - Comcast Cable Communications, LLC, US
  92. [+] cidr : 68.80.0.0/13
  93. [+] name : JUMPSTART-2
  94. [+] handle : NET-68-80-0-0-1
  95. [+] range : 68.80.0.0 - 68.87.255.255
  96. [+] description : Comcast Cable Communications, LLC
  97. [+] country : US
  98. [+] state : NJ
  99. [+] city : Mt Laurel
  100. [+] address : 1800 Bishops Gate Blvd
  101. [+] postal_code : 08054
  102. [+] emails : ['[email protected]', '[email protected]']
  103. [+] created : 2002-01-28
  104. [+] updated : 2016-08-31
  105.  
  106. [+] Crawling Target...
  107.  
  108. [+] Looking for robots.txt........[ Not Found ]
  109. [+] Looking for sitemap.xml.......[ Found ]
  110. [+] Extracting sitemap Links......[ 13 ]
  111. [+] Extracting CSS Links..........[ 9 ]
  112. [+] Extracting Javascript Links...[ 0 ]
  113. [+] Extracting Internal Links.....[ 0 ]
  114. [+] Extracting External Links.....[ 0 ]
  115. [+] Extracting Images.............[ 0 ]
  116.  
  117. [+] Total Links Extracted : 22
  118.  
  119. [+] Dumping Links in /opt/FinalRecon/dumps/fuhrernet.com.dump
  120. [+] Completed!
  121. #######################################################################################################################################
  122. [i] Scanning Site: http://fuhrernet.com
  123.  
  124.  
  125.  
  126. B A S I C I N F O
  127. ====================
  128.  
  129.  
  130. [+] Site Title: Newsfeed
  131. [+] IP address: 68.81.58.227
  132. [+] Web Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  133. [+] CMS: Could Not Detect
  134. [+] Cloudflare: Not Detected
  135. [+] Robots File: Could NOT Find robots.txt!
  136.  
  137.  
  138.  
  139.  
  140. W H O I S L O O K U P
  141. ========================
  142.  
  143. Domain Name: FUHRERNET.COM
  144. Registry Domain ID: 2183865559_DOMAIN_COM-VRSN
  145. Registrar WHOIS Server: whois.godaddy.com
  146. Registrar URL: http://www.godaddy.com
  147. Updated Date: 2019-09-17T14:54:51Z
  148. Creation Date: 2017-11-06T18:02:49Z
  149. Registry Expiry Date: 2020-11-06T18:02:49Z
  150. Registrar: GoDaddy.com, LLC
  151. Registrar IANA ID: 146
  152. Registrar Abuse Contact Email: [email protected]
  153. Registrar Abuse Contact Phone: 480-624-2505
  154. Domain Status: ok https://icann.org/epp#ok
  155. Name Server: NS47.DOMAINCONTROL.COM
  156. Name Server: NS48.DOMAINCONTROL.COM
  157. DNSSEC: unsigned
  158. URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
  159. >>> Last update of whois database: 2019-09-28T08:23:34Z <<<
  160.  
  161. For more information on Whois status codes, please visit https://icann.org/epp
  162.  
  163.  
  164.  
  165. The Registry database contains ONLY .COM, .NET, .EDU domains and
  166. Registrars.
  167.  
  168.  
  169.  
  170.  
  171. G E O I P L O O K U P
  172. =========================
  173.  
  174. [i] IP Address: 68.81.58.227
  175. [i] Country: United States
  176. [i] State: Pennsylvania
  177. [i] City: Levittown
  178. [i] Latitude: 40.1519
  179. [i] Longitude: -74.8826
  180.  
  181.  
  182.  
  183.  
  184. H T T P H E A D E R S
  185. =======================
  186.  
  187.  
  188. [i] HTTP/1.1 200 OK
  189. [i] Date: Sat, 28 Sep 2019 08:23:50 GMT
  190. [i] Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  191. [i] X-Powered-By: PHP/7.1.1
  192. [i] Content-Length: 2626
  193. [i] Connection: close
  194. [i] Content-Type: text/html; charset=UTF-8
  195.  
  196.  
  197.  
  198.  
  199. D N S L O O K U P
  200. ===================
  201.  
  202. fuhrernet.com. 599 IN A 68.81.58.227
  203. fuhrernet.com. 3599 IN NS ns47.domaincontrol.com.
  204. fuhrernet.com. 3599 IN NS ns48.domaincontrol.com.
  205. fuhrernet.com. 3599 IN SOA ns47.domaincontrol.com. dns.jomax.net. 2019091902 28800 7200 604800 600
  206. fuhrernet.com. 1799 IN MX 10 mx.yandex.net.
  207. fuhrernet.com. 3599 IN TXT "yandex-verification: d7cd81786b5817a7"
  208. fuhrernet.com. 3599 IN TXT "v=spf1 ip4: ip4: include:_spf.yandex.net ~all"
  209.  
  210.  
  211.  
  212.  
  213. S U B N E T C A L C U L A T I O N
  214. ====================================
  215.  
  216. Address = 68.81.58.227
  217. Network = 68.81.58.227 / 32
  218. Netmask = 255.255.255.255
  219. Broadcast = not needed on Point-to-Point links
  220. Wildcard Mask = 0.0.0.0
  221. Hosts Bits = 0
  222. Max. Hosts = 1 (2^0 - 0)
  223. Host Range = { 68.81.58.227 - 68.81.58.227 }
  224.  
  225.  
  226.  
  227. N M A P P O R T S C A N
  228. ============================
  229.  
  230. Starting Nmap 7.70 ( https://nmap.org ) at 2019-09-28 08:23 UTC
  231. Nmap scan report for fuhrernet.com (68.81.58.227)
  232. Host is up (0.030s latency).
  233. rDNS record for 68.81.58.227: c-68-81-58-227.hsd1.pa.comcast.net
  234.  
  235. PORT STATE SERVICE
  236. 21/tcp open ftp
  237. 22/tcp filtered ssh
  238. 23/tcp filtered telnet
  239. 80/tcp open http
  240. 110/tcp closed pop3
  241. 143/tcp closed imap
  242. 443/tcp open https
  243. 3389/tcp filtered ms-wbt-server
  244.  
  245. Nmap done: 1 IP address (1 host up) scanned in 1.35 seconds
  246. #######################################################################################################################################
  247. [INFO] ------TARGET info------
  248. [*] TARGET: http://fuhrernet.com/login.php
  249. [*] TARGET IP: 68.81.58.227
  250. [INFO] NO load balancer detected for fuhrernet.com...
  251. [*] DNS servers: ns47.domaincontrol.com.
  252. [*] TARGET server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  253. [*] CC: US
  254. [*] Country: United States
  255. [*] RegionCode: PA
  256. [*] RegionName: Pennsylvania
  257. [*] City: Levittown
  258. [*] ASN: AS7922
  259. [*] BGP_PREFIX: 68.80.0.0/13
  260. [*] ISP: COMCAST-7922 - Comcast Cable Communications, LLC, US
  261. [INFO] DNS enumeration:
  262. [INFO] Possible abuse mails are:
  263. [*] [email protected]
  264. [*] [email protected]
  265. [INFO] NO PAC (Proxy Auto Configuration) file FOUND
  266. [INFO] Starting FUZZing in http://fuhrernet.com/FUzZzZzZzZz...
  267. [INFO] Status code Folders
  268. [*] 200 http://fuhrernet.com/12
  269. [ALERT] Look in the source code. It may contain passwords
  270. [INFO] SAME content in http://fuhrernet.com/ AND http://68.81.58.227/
  271. [INFO] Links found from http://fuhrernet.com/login.php:
  272. [*] http://fuhrernet.com/create-account.php
  273. [*] http://fuhrernet.com/forgot-password.html
  274. [*] http://fuhrernet.com/forgot-username.html
  275. [INFO] Shodan detected the following opened ports on 68.81.58.227:
  276. [*] 1
  277. [*] 143
  278. [*] 2019
  279. [*] 21
  280. [*] 32
  281. [*] 3306
  282. [*] 4
  283. [*] 443
  284. [*] 62
  285. [*] 7
  286. [*] 80
  287. [*] 9000
  288. [*] 9001
  289. [*] 9675
  290. [INFO] ------VirusTotal SECTION------
  291. [INFO] VirusTotal passive DNS only stores address records. The following domains resolved to the given IP address:
  292. [INFO] Latest URLs hosted in this IP address detected by at least one URL scanner or malicious URL dataset:
  293. [INFO] Latest files that are not detected by any antivirus solution and were downloaded by VirusTotal from the IP address provided:
  294. [INFO] ------Alexa Rank SECTION------
  295. [INFO] Percent of Visitors Rank in Country:
  296. [INFO] Percent of Search Traffic:
  297. [INFO] Percent of Unique Visits:
  298. [INFO] Total Sites Linking In:
  299. [INFO] Useful links related to fuhrernet.com - 68.81.58.227:
  300. [*] https://www.virustotal.com/pt/ip-address/68.81.58.227/information/
  301. [*] https://www.hybrid-analysis.com/search?host=68.81.58.227
  302. [*] https://www.shodan.io/host/68.81.58.227
  303. [*] https://www.senderbase.org/lookup/?search_string=68.81.58.227
  304. [*] https://www.alienvault.com/open-threat-exchange/ip/68.81.58.227
  305. [*] http://pastebin.com/search?q=68.81.58.227
  306. [*] http://urlquery.net/search.php?q=68.81.58.227
  307. [*] http://www.alexa.com/siteinfo/fuhrernet.com
  308. [*] http://www.google.com/safebrowsing/diagnostic?site=fuhrernet.com
  309. [*] https://censys.io/ipv4/68.81.58.227
  310. [*] https://www.abuseipdb.com/check/68.81.58.227
  311. [*] https://urlscan.io/search/#68.81.58.227
  312. [*] https://github.com/search?q=68.81.58.227&type=Code
  313. [INFO] Useful links related to AS7922 - 68.80.0.0/13:
  314. [*] http://www.google.com/safebrowsing/diagnostic?site=AS:7922
  315. [*] https://www.senderbase.org/lookup/?search_string=68.80.0.0/13
  316. [*] http://bgp.he.net/AS7922
  317. [*] https://stat.ripe.net/AS7922
  318. [INFO] Date: 28/09/19 | Time: 04:28:11
  319. [INFO] Total time: 4 minute(s) and 17 second(s)
  320. #######################################################################################################################################
  321. [*] Load target domain: fuhrernet.com
  322. - starting scanning @ 2019-09-28 04:32:03
  323.  
  324. [+] Running & Checking source to be used
  325. ---------------------------------------------
  326.  
  327. ⍥ Shodan [ ✕ ]
  328. ⍥ Webarchive [ ✔ ]
  329. ⍥ Dnsdumpster [ ✔ ]
  330. ⍥ Certsh [ ✔ ]
  331. ⍥ Certspotter [ ✔ ]
  332. ⍥ Securitytrails [ ✕ ]
  333. ⍥ Threatminer [ ✔ ]
  334. ⍥ Riddler [ ✔ ]
  335. ⍥ Entrust [ ✔ ]
  336. ⍥ Bufferover [ ✔ ]
  337. ⍥ Censys [ ✕ ]
  338. ⍥ Threatcrowd [ ✔ ]
  339. ⍥ Hackertarget [ ✔ ]
  340. ⍥ Binaryedge [ ✕ ]
  341. ⍥ Virustotal [ ✕ ]
  342. ⍥ Findsubdomain [ ✔ ]
  343.  
  344. [+] Get & Count subdomain total From source
  345. ---------------------------------------------
  346.  
  347. ⍥ Hackertarget: Total Subdomain (1)
  348. ⍥ Findsubdomain: Total Subdomain (0)
  349. ⍥ Certspotter: Total Subdomain (0)
  350. ⍥ Threatminer: Total Subdomain (0)
  351. ⍥ Certsh: Total Subdomain (0)
  352. ⍥ BufferOver: Total Subdomain (0)
  353. ⍥ Entrust: Total Subdomain (0)
  354. ⍥ Threatcrowd: Total Subdomain (0)
  355. ⍥ Dnsdumpster: Total Subdomain (4)
  356. ⍥ Riddler: Total Subdomain (0)
  357. ⍥ Webarchive: Total Subdomain (1)
  358.  
  359. [+] Parsing & Sorting list Domain
  360. ---------------------------------------------
  361.  
  362. ⍥ Total [1]
  363.  
  364. - fuhrernet.com
  365.  
  366. ⍥ Total [1]
  367.  
  368. [+] Probe subdomain for working on http/https
  369. ---------------------------------------------
  370.  
  371. - http://fuhrernet.com
  372. - https://fuhrernet.com
  373.  
  374. ⍥ Total [2]
  375.  
  376.  
  377. [+] Check Live Host: Ping Sweep - ICMP PING
  378. ---------------------------------------------
  379.  
  380. ⍥ [LIVE] fuhrernet.com
  381.  
  382. [+] Check Resolving: Subdomains & Domains
  383. ---------------------------------------------
  384.  
  385. ⍥ Resolving domains to: 68.81.58.227
  386.  
  387. [+] Subdomain TakeOver - Check Possible Vulns
  388. ---------------------------------------------
  389.  
  390. ⍥ [FAILS] En: Unknown http://fuhrernet.com
  391. ⍥ [FAILS] En: Unknown https://fuhrernet.com
  392.  
  393. [+] Checks status code on port 80 and 443
  394. ---------------------------------------------
  395.  
  396. ⍥ [200] http://fuhrernet.com
  397. ⍥ [000] https://fuhrernet.com
  398.  
  399. [+] Web Screenshots: from domain list
  400. ---------------------------------------------
  401.  
  402. [+] 2 URLs to be screenshot
  403.  
  404. [+] 2 actual URLs screenshot
  405. [+] 0 error(s)
  406.  
  407. [+] Sud⍥my has been sucessfully completed
  408. ---------------------------------------------
  409.  
  410. ⍥ Location output:
  411. - output/09-28-2019/fuhrernet.com
  412. - output/09-28-2019/fuhrernet.com/report
  413. - output/09-28-2019/fuhrernet.com/screenshots
  414. #######################################################################################################################################
  415. [+] Starting At 2019-09-28 04:37:08.881372
  416. [+] Collecting Information On: http://fuhrernet.com/login.php
  417. [#] Status: 200
  418. --------------------------------------------------
  419. [#] Web Server Detected: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  420. [#] X-Powered-By: PHP/7.1.1
  421. [!] X-Frame-Options Headers not detect! target might be vulnerable Click Jacking
  422. - Date: Sat, 28 Sep 2019 08:37:05 GMT
  423. - Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  424. - X-Powered-By: PHP/7.1.1
  425. - Content-Length: 6039
  426. - Keep-Alive: timeout=5, max=100
  427. - Connection: Keep-Alive
  428. - Content-Type: text/html; charset=UTF-8
  429. --------------------------------------------------
  430. [#] Finding Location..!
  431. [#] as: AS7922 Comcast Cable Communications, LLC
  432. [#] city: Levittown
  433. [#] country: United States
  434. [#] countryCode: US
  435. [#] isp: Comcast Cable Communications, LLC
  436. [#] lat: 40.1519
  437. [#] lon: -74.8826
  438. [#] org: Comcast Cable Communications, Inc.
  439. [#] query: 68.81.58.227
  440. [#] region: PA
  441. [#] regionName: Pennsylvania
  442. [#] status: success
  443. [#] timezone: America/New_York
  444. [#] zip: 19056
  445. --------------------------------------------------
  446. [x] Didn't Detect WAF Presence on: http://fuhrernet.com/login.php
  447. --------------------------------------------------
  448. [#] Starting Reverse DNS
  449. [!] Found 1 any Domain
  450. - fuhrernet.com
  451. --------------------------------------------------
  452. [!] Scanning Open Port
  453. [#] 21/tcp open ftp
  454. [#] 80/tcp open http
  455. [#] 85/tcp open mit-ml-dev
  456. [#] 443/tcp open https
  457. [#] 3306/tcp open mysql
  458. [#] 9001/tcp open tor-orport
  459. --------------------------------------------------
  460. [+] Collecting Information Disclosure!
  461. [#] Detecting sitemap.xml file
  462. [-] sitemap.xml file not Found!?
  463. [#] Detecting robots.txt file
  464. [-] robots.txt file not Found!?
  465. [#] Detecting GNU Mailman
  466. [-] GNU Mailman App Not Detected!?
  467. --------------------------------------------------
  468. [+] Crawling Url Parameter On: http://fuhrernet.com/login.php
  469. --------------------------------------------------
  470. [#] Searching Html Form !
  471. [+] Html Form Discovered
  472. [#] action: None
  473. [#] class: None
  474. [#] id: None
  475. [#] method: post
  476. --------------------------------------------------
  477. [-] No DOM Paramter Found!?
  478. --------------------------------------------------
  479. [-] No internal Dynamic Parameter Found!?
  480. --------------------------------------------------
  481. [-] No external Dynamic Paramter Found!?
  482. --------------------------------------------------
  483. [!] 13 Internal links Discovered
  484. [+] http://fuhrernet.com/login.php/assets/bootstrap/css/bootstrap.min.css
  485. [+] http://fuhrernet.com/login.php/assets/fonts/ionicons.min.css
  486. [+] http://fuhrernet.com/login.php/assets/css/Login-Form-Clean.css
  487. [+] http://fuhrernet.com/login.php/assets/css/styles.css
  488. [+] http://fuhrernet.com/login.php/assets/css/Profile-Card.css
  489. [+] http://fuhrernet.com/login.php/assets/css/untitled.css
  490. [+] http://fuhrernet.com/login.php/./apple-touch-icon.png
  491. [+] http://fuhrernet.com/login.php/./favicon-32x32.png
  492. [+] http://fuhrernet.com/login.php/./favicon-16x16.png
  493. [+] http://fuhrernet.com/login.php/./site.webmanifest
  494. [+] http://fuhrernet.com/login.php/./create-account.php
  495. [+] http://fuhrernet.com/login.php/./forgot-username.html
  496. [+] http://fuhrernet.com/login.php/./forgot-password.html
  497. --------------------------------------------------
  498. [!] 1 External links Discovered
  499. [#] https://cdnjs.cloudflare.com/ajax/libs/animate.css/3.5.2/animate.min.css
  500. --------------------------------------------------
  501. [#] Mapping Subdomain..
  502. [!] Found 1 Subdomain
  503. - fuhrernet.com
  504. --------------------------------------------------
  505. [!] Done At 2019-09-28 04:40:24.559313
  506. #######################################################################################################################################
  507.  
  508. Enter Address Website = fuhrernet.com
  509.  
  510.  
  511.  
  512. Reversing IP With HackTarget 'fuhrernet.com'
  513. -----------------------------------------------
  514.  
  515. [+] c-68-81-58-227.hsd1.pa.comcast.net
  516.  
  517.  
  518.  
  519. Reverse IP With YouGetSignal 'fuhrernet.com'
  520. -----------------------------------------------
  521.  
  522. [*] IP: 68.81.58.227
  523. [*] Domain: fuhrernet.com
  524. [*] Total Domains: 1
  525.  
  526. [+] fuhrernet.com
  527.  
  528.  
  529.  
  530. Geo IP Lookup 'fuhrernet.com'
  531. --------------------------------
  532.  
  533. [+] IP Address: 68.81.58.227
  534. [+] Country: United States
  535. [+] State: Pennsylvania
  536. [+] City: Levittown
  537. [+] Latitude: 40.1519
  538. [+] Longitude: -74.8826
  539.  
  540.  
  541.  
  542. Whois 'fuhrernet.com'
  543. ------------------------
  544.  
  545. [+] Domain Name: FUHRERNET.COM
  546. [+] Registry Domain ID: 2183865559_DOMAIN_COM-VRSN
  547. [+] Registrar WHOIS Server: whois.godaddy.com
  548. [+] Registrar URL: http://www.godaddy.com
  549. [+] Updated Date: 2019-09-17T14:54:51Z
  550. [+] Creation Date: 2017-11-06T18:02:49Z
  551. [+] Registry Expiry Date: 2020-11-06T18:02:49Z
  552. [+] Registrar: GoDaddy.com, LLC
  553. [+] Registrar IANA ID: 146
  554. [+] Registrar Abuse Contact Email: [email protected]
  555. [+] Registrar Abuse Contact Phone: 480-624-2505
  556. [+] Domain Status: ok https://icann.org/epp#ok
  557. [+] Name Server: NS47.DOMAINCONTROL.COM
  558. [+] Name Server: NS48.DOMAINCONTROL.COM
  559. [+] DNSSEC: unsigned
  560. [+] URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
  561. [+] >>> Last update of whois database: 2019-09-28T08:36:22Z <<<
  562. [+] For more information on Whois status codes, please visit https://icann.org/epp
  563. [+] The Registry database contains ONLY .COM, .NET, .EDU domains and
  564. [+] Registrars.
  565.  
  566.  
  567.  
  568. Bypass Cloudflare 'fuhrernet.com'
  569. ------------------------------------
  570. [!] CloudFlare Bypass 68.81.58.227 | www.fuhrernet.com
  571.  
  572.  
  573. DNS Lookup 'fuhrernet.com'
  574. -----------------------------
  575.  
  576. [+] fuhrernet.com. 599 IN A 68.81.58.227
  577. [+] fuhrernet.com. 3599 IN NS ns47.domaincontrol.com.
  578. [+] fuhrernet.com. 3599 IN NS ns48.domaincontrol.com.
  579. [+] fuhrernet.com. 3599 IN SOA ns47.domaincontrol.com. dns.jomax.net. 2019091902 28800 7200 604800 600
  580. [+] fuhrernet.com. 1799 IN MX 10 mx.yandex.net.
  581. [+] fuhrernet.com. 3599 IN TXT "yandex-verification: d7cd81786b5817a7"
  582. [+] fuhrernet.com. 3599 IN TXT "v=spf1 ip4: ip4: include:_spf.yandex.net ~all"
  583.  
  584.  
  585.  
  586.  
  587. Show HTTP Header 'fuhrernet.com'
  588. -----------------------------------
  589.  
  590. [+] HTTP/1.1 200 OK
  591. [+] Date: Sat, 28 Sep 2019 08:36:54 GMT
  592. [+] Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  593. [+] X-Powered-By: PHP/7.1.1
  594. [+] Content-Type: text/html; charset=UTF-8
  595. [+]
  596.  
  597.  
  598.  
  599. Port Scan 'fuhrernet.com'
  600. ----------------------------
  601.  
  602. Starting Nmap 7.70 ( https://nmap.org ) at 2019-09-28 08:36 UTC
  603. Nmap scan report for fuhrernet.com (68.81.58.227)
  604. Host is up (0.024s latency).
  605. rDNS record for 68.81.58.227: c-68-81-58-227.hsd1.pa.comcast.net
  606.  
  607. PORT STATE SERVICE
  608. 21/tcp open ftp
  609. 22/tcp filtered ssh
  610. 23/tcp filtered telnet
  611. 80/tcp open http
  612. 110/tcp closed pop3
  613. 143/tcp closed imap
  614. 443/tcp open https
  615. 3389/tcp filtered ms-wbt-server
  616.  
  617. Nmap done: 1 IP address (1 host up) scanned in 1.25 seconds
  618.  
  619.  
  620.  
  621.  
  622.  
  623. Traceroute 'fuhrernet.com'
  624. -----------------------------
  625.  
  626. Start: 2019-09-28T08:37:01+0000
  627. HOST: web01 Loss% Snt Last Avg Best Wrst StDev
  628. 1.|-- 45.79.12.201 0.0% 3 0.6 0.7 0.6 0.8 0.1
  629. 2.|-- 45.79.12.4 0.0% 3 20.9 7.4 0.6 20.9 11.7
  630. 3.|-- dls-b22-link.telia.net 0.0% 3 0.9 2.0 0.8 4.3 2.0
  631. 4.|-- dls-b21-link.telia.net 0.0% 3 1.5 3.1 1.5 5.6 2.2
  632. 5.|-- comcast-ic-318909-dls-b21.c.telia.net 0.0% 3 1.9 1.8 1.5 2.0 0.3
  633. 6.|-- be-12441-cr02.dallas.tx.ibone.comcast.net 0.0% 3 1.9 2.8 1.9 3.4 0.8
  634. 7.|-- be-12324-cr01.houston.tx.ibone.comcast.net 0.0% 3 8.1 8.3 8.1 8.4 0.2
  635. 8.|-- be-11423-cr02.56marietta.ga.ibone.comcast.net 0.0% 3 20.1 20.2 19.4 21.1 0.9
  636. 9.|-- be-1402-cs04.56marietta.ga.ibone.comcast.net 0.0% 3 19.4 19.8 19.4 20.0 0.3
  637. 10.|-- be-1411-cr11.56marietta.ga.ibone.comcast.net 0.0% 3 19.3 19.7 19.3 20.0 0.4
  638. 11.|-- be-301-cr11.ashburn.va.ibone.comcast.net 0.0% 3 35.5 35.5 35.5 35.6 0.1
  639. 12.|-- be-1411-cs04.ashburn.va.ibone.comcast.net 0.0% 3 35.5 35.6 35.5 35.7 0.1
  640. 13.|-- be-1402-cr02.ashburn.va.ibone.comcast.net 0.0% 3 30.2 30.7 30.2 31.1 0.4
  641. 14.|-- be-7922-ar03.newcastle.de.panjde.comcast.net 0.0% 3 34.6 33.7 33.2 34.6 0.7
  642. 15.|-- be-900-ar03.norristown.pa.panjde.comcast.net 0.0% 3 35.5 35.3 35.2 35.5 0.1
  643. 16.|-- 162.151.182.178 0.0% 3 39.2 39.1 39.1 39.2 0.1
  644. 17.|-- lag2-acr22.levittown.pa.panjde.comcast.net 0.0% 3 41.0 41.0 41.0 41.0 0.0
  645. 18.|-- c-68-81-58-227.hsd1.pa.comcast.net 0.0% 3 53.8 54.1 51.3 57.1 2.9
  646. #######################################################################################################################################
  647. Trying "fuhrernet.com"
  648. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5382
  649. ;; flags: qr rd ra; QUERY: 1, ANSWER: 7, AUTHORITY: 2, ADDITIONAL: 4
  650.  
  651. ;; QUESTION SECTION:
  652. ;fuhrernet.com. IN ANY
  653.  
  654. ;; ANSWER SECTION:
  655. fuhrernet.com. 3600 IN TXT "v=spf1 ip4:<IP-1> ip4:<IP-2> include:_spf.yandex.net ~all"
  656. fuhrernet.com. 3600 IN TXT "yandex-verification: d7cd81786b5817a7"
  657. fuhrernet.com. 1800 IN MX 10 mx.yandex.net.
  658. fuhrernet.com. 3600 IN SOA ns47.domaincontrol.com. dns.jomax.net. 2019091902 28800 7200 604800 600
  659. fuhrernet.com. 600 IN A 68.81.58.227
  660. fuhrernet.com. 3600 IN NS ns47.domaincontrol.com.
  661. fuhrernet.com. 3600 IN NS ns48.domaincontrol.com.
  662.  
  663. ;; AUTHORITY SECTION:
  664. fuhrernet.com. 3600 IN NS ns47.domaincontrol.com.
  665. fuhrernet.com. 3600 IN NS ns48.domaincontrol.com.
  666.  
  667. ;; ADDITIONAL SECTION:
  668. ns47.domaincontrol.com. 3039 IN A 97.74.103.24
  669. ns47.domaincontrol.com. 23226 IN AAAA 2603:5:2172::18
  670. ns48.domaincontrol.com. 21374 IN A 173.201.71.24
  671. ns48.domaincontrol.com. 10967 IN AAAA 2603:5:2272::18
  672.  
  673. Received 410 bytes from 2001:18c0:121:6900:724f:b8ff:fefd:5b6a#53 in 136 ms
  674. #######################################################################################################################################
  675. ; <<>> DiG 9.11.5-P4-5.1+b1-Debian <<>> +trace fuhrernet.com
  676. ;; global options: +cmd
  677. . 79757 IN NS k.root-servers.net.
  678. . 79757 IN NS b.root-servers.net.
  679. . 79757 IN NS h.root-servers.net.
  680. . 79757 IN NS g.root-servers.net.
  681. . 79757 IN NS j.root-servers.net.
  682. . 79757 IN NS e.root-servers.net.
  683. . 79757 IN NS f.root-servers.net.
  684. . 79757 IN NS m.root-servers.net.
  685. . 79757 IN NS d.root-servers.net.
  686. . 79757 IN NS l.root-servers.net.
  687. . 79757 IN NS c.root-servers.net.
  688. . 79757 IN NS i.root-servers.net.
  689. . 79757 IN NS a.root-servers.net.
  690. . 79757 IN RRSIG NS 8 0 518400 20191011050000 20190928040000 59944 . M2/pztQA5M3yKsxBHFunkxHu99aDaPjvo/OdBj24SIpGnsF32zMxTCD0 GaK2OztD+2eaqf3eENHJCQuwb2cFtsiLCbyx0d6kSmmIiJPw3mEZ+W1t tplJwghGtAmj0Fqtb2f7DtlcVUraowz2s6vfPuDlrLla0Nabij9WikwL TQGtdJ83LtV30Sl/cxglkKX892KyiVRIL463prTUdcP5VFk1836iPLYW HnPimmCcGxsEYkP+5+VCvZzKyCqkADZVrpBAirud20z7gdcL6MXZqzEX 4Kkv6sUi7jomDYbgHwlV+CFVLzDdTzsWbQBRVYrd0klVJC5gRtV6jf6M TQnMOQ==
  691. ;; Received 525 bytes from 38.132.106.139#53(38.132.106.139) in 29 ms
  692.  
  693. com. 172800 IN NS i.gtld-servers.net.
  694. com. 172800 IN NS j.gtld-servers.net.
  695. com. 172800 IN NS e.gtld-servers.net.
  696. com. 172800 IN NS l.gtld-servers.net.
  697. com. 172800 IN NS m.gtld-servers.net.
  698. com. 172800 IN NS f.gtld-servers.net.
  699. com. 172800 IN NS h.gtld-servers.net.
  700. com. 172800 IN NS b.gtld-servers.net.
  701. com. 172800 IN NS d.gtld-servers.net.
  702. com. 172800 IN NS g.gtld-servers.net.
  703. com. 172800 IN NS c.gtld-servers.net.
  704. com. 172800 IN NS a.gtld-servers.net.
  705. com. 172800 IN NS k.gtld-servers.net.
  706. com. 86400 IN DS 30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
  707. com. 86400 IN RRSIG DS 8 1 86400 20191011050000 20190928040000 59944 . h6+G+ESPE9Aa2qAQwbM53M14XGUz/j2SCYydXlhRZ+SHobuK9DqayXpY FFWWWKv0+qRzo1TduRVgqbtj0pYMX2jFfgoSNdpELPfVti+k704LO+D1 UTyhNh066JIFXd3bZPgZ7mlMI2PEWPAVl3l4XlxgMDzyGSEVQQGWuFwm IubH9k3Ud8jQPMZlMIkb9ET87BW0u6NR/HJKTyCnlBuMF9sr5mHkzFN4 jkESPG7//c84lv5JJNeyIUe7hY5z0sHUof6UeR7iDSQZdB4hjqyG2qN0 NumZbMgXCR9DJrVH7PvUrR7MEn29Rt7HLY5lxL48axCNAZWEUJvUgJ3M c49fDw==
  708. ;; Received 1173 bytes from 193.0.14.129#53(k.root-servers.net) in 81 ms
  709.  
  710. fuhrernet.com. 172800 IN NS ns47.domaincontrol.com.
  711. fuhrernet.com. 172800 IN NS ns48.domaincontrol.com.
  712. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A NS SOA RRSIG DNSKEY NSEC3PARAM
  713. CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20191002044638 20190925033638 17708 com. W1EdwlejJtzVVubIBRcoCicfmwD78yZE5RGrjWJc1enFUVYFadLsyHDm SdGwV9H5Izrr+dDFUqRrzw6AtZZD0agyG7oqP2066DddrgnwryHNTtkl 7TLBFPm/io9cRPiEANIyDLKqn7WbKDx+5BZ0Lys/HBUkXGkcVevSksfD /rk=
  714. 6RG8GQ3EJ5GEU55CNMDPQF4EN9E7SCFP.com. 86400 IN NSEC3 1 1 0 - 6RG8MMU5E2D4SMANA51JLH13O3PMDFVD NS DS RRSIG
  715. 6RG8GQ3EJ5GEU55CNMDPQF4EN9E7SCFP.com. 86400 IN RRSIG NSEC3 8 2 86400 20191002054536 20190925043536 17708 com. GI9DvwhtHQmOF+PC7BUPicV/1zc/W48kPFsFOjmKxRTv/EzXe16YZhcL kPKVxteUFNV40iWLpVYK7c8KhtG7hp5E1L+ntjsq/aujj/IEsXLssg/D fghuvhM8HamuUyW6zt8RevX19KjD9wCEbYG/AMlAilzLaGaxRYRgMePj rvM=
  716. ;; Received 667 bytes from 192.52.178.30#53(k.gtld-servers.net) in 59 ms
  717.  
  718. fuhrernet.com. 600 IN A 68.81.58.227
  719. fuhrernet.com. 3600 IN NS ns47.domaincontrol.com.
  720. fuhrernet.com. 3600 IN NS ns48.domaincontrol.com.
  721. ;; Received 110 bytes from 2603:5:2172::18#53(ns47.domaincontrol.com) in 33 ms
  722. #######################################################################################################################################
  723. [*] Performing General Enumeration of Domain: fuhrernet.com
  724. [-] DNSSEC is not configured for fuhrernet.com
  725. [*] SOA ns47.domaincontrol.com 97.74.103.24
  726. [*] NS ns48.domaincontrol.com 173.201.71.24
  727. [*] NS ns48.domaincontrol.com 2603:5:2272::18
  728. [*] NS ns47.domaincontrol.com 97.74.103.24
  729. [*] NS ns47.domaincontrol.com 2603:5:2172::18
  730. [*] MX mx.yandex.net 77.88.21.89
  731. [*] MX mx.yandex.net 213.180.193.89
  732. [*] MX mx.yandex.net 213.180.204.89
  733. [*] MX mx.yandex.net 93.158.134.89
  734. [*] MX mx.yandex.net 87.250.250.89
  735. [*] MX mx.yandex.net 2a02:6b8::89
  736. [*] A fuhrernet.com 68.81.58.227
  737. [*] TXT fuhrernet.com v=spf1 ip4:<IP-1> ip4:<IP-2> include:_spf.yandex.net ~all
  738. [*] TXT fuhrernet.com yandex-verification: d7cd81786b5817a7
  739. [*] Enumerating SRV Records
  740. [-] No SRV Records Found for fuhrernet.com
  741. [+] 0 Records Found
  742. #######################################################################################################################################
  743. rocessing domain fuhrernet.com
  744. [*] Using system resolvers ['38.132.106.139', '194.187.251.67', '185.93.180.131', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  745. [+] Getting nameservers
  746. 173.201.71.24 - ns48.domaincontrol.com
  747. 97.74.103.24 - ns47.domaincontrol.com
  748. [-] Zone transfer failed
  749.  
  750. [+] TXT records found
  751. "v=spf1 ip4:<IP-1> ip4:<IP-2> include:_spf.yandex.net ~all"
  752. "yandex-verification: d7cd81786b5817a7"
  753.  
  754. [+] MX records found, added to target list
  755. 10 mx.yandex.net.
  756.  
  757. [*] Scanning fuhrernet.com for A records
  758. 68.81.58.227 - fuhrernet.com
  759. 68.81.58.227 - www.fuhrernet.com
  760. #######################################################################################################################################
  761.  
  762. AVAILABLE PLUGINS
  763. -----------------
  764.  
  765. SessionRenegotiationPlugin
  766. OpenSslCcsInjectionPlugin
  767. SessionResumptionPlugin
  768. HttpHeadersPlugin
  769. EarlyDataPlugin
  770. CertificateInfoPlugin
  771. CompressionPlugin
  772. RobotPlugin
  773. OpenSslCipherSuitesPlugin
  774. HeartbleedPlugin
  775. FallbackScsvPlugin
  776.  
  777.  
  778.  
  779. CHECKING HOST(S) AVAILABILITY
  780. -----------------------------
  781.  
  782. 68.81.58.227:443 => 68.81.58.227
  783.  
  784.  
  785.  
  786.  
  787. SCAN RESULTS FOR 68.81.58.227:443 - 68.81.58.227
  788. ------------------------------------------------
  789.  
  790. * Downgrade Attacks:
  791. TLS_FALLBACK_SCSV: OK - Supported
  792.  
  793. * TLS 1.2 Session Resumption Support:
  794. With Session IDs: OK - Supported (5 successful, 0 failed, 0 errors, 5 total attempts).
  795. With TLS Tickets: OK - Supported
  796.  
  797. * Certificate Information:
  798. Content
  799. SHA1 Fingerprint: b0238c547a905bfa119c4e8baccaeacf36491ff6
  800. Common Name: localhost
  801. Issuer: localhost
  802. Serial Number: 13098529066745705731
  803. Not Before: 2009-11-10 23:48:47
  804. Not After: 2019-11-08 23:48:47
  805. Signature Algorithm: sha1
  806. Public Key Algorithm: RSA
  807. Key Size: 1024
  808. Exponent: 65537 (0x10001)
  809. DNS Subject Alternative Names: []
  810.  
  811. Trust
  812. Hostname Validation: FAILED - Certificate does NOT match 68.81.58.227
  813. Android CA Store (9.0.0_r9): FAILED - Certificate is NOT Trusted: self signed certificate
  814. Apple CA Store (iOS 12, macOS 10.14, watchOS 5, and tvOS 12):FAILED - Certificate is NOT Trusted: self signed certificate
  815. Java CA Store (jdk-12.0.1): FAILED - Certificate is NOT Trusted: self signed certificate
  816. Mozilla CA Store (2019-03-14): FAILED - Certificate is NOT Trusted: self signed certificate
  817. Windows CA Store (2019-05-27): FAILED - Certificate is NOT Trusted: self signed certificate
  818. Symantec 2018 Deprecation: OK - Not a Symantec-issued certificate
  819. Received Chain: localhost
  820. Verified Chain: ERROR - Could not build verified chain (certificate untrusted?)
  821. Received Chain Contains Anchor: ERROR - Could not build verified chain (certificate untrusted?)
  822. Received Chain Order: OK - Order is valid
  823. Verified Chain contains SHA1: ERROR - Could not build verified chain (certificate untrusted?)
  824.  
  825. Extensions
  826. OCSP Must-Staple: NOT SUPPORTED - Extension not found
  827. Certificate Transparency: NOT SUPPORTED - Extension not found
  828.  
  829. OCSP Stapling
  830. NOT SUPPORTED - Server did not send back an OCSP response
  831.  
  832. * SSLV3 Cipher Suites:
  833. Server rejected all cipher suites.
  834.  
  835. * OpenSSL CCS Injection:
  836. OK - Not vulnerable to OpenSSL CCS injection
  837.  
  838. * SSLV2 Cipher Suites:
  839. Server rejected all cipher suites.
  840.  
  841. * Session Renegotiation:
  842. Client-initiated Renegotiation: OK - Rejected
  843. Secure Renegotiation: OK - Supported
  844.  
  845. * TLSV1_3 Cipher Suites:
  846. Server rejected all cipher suites.
  847.  
  848. * Deflate Compression:
  849. OK - Compression disabled
  850.  
  851. * TLSV1 Cipher Suites:
  852. Forward Secrecy OK - Supported
  853. RC4 OK - Not Supported
  854.  
  855. Preferred:
  856. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  857. Accepted:
  858. TLS_RSA_WITH_SEED_CBC_SHA 128 bits HTTP 200 OK
  859. TLS_RSA_WITH_IDEA_CBC_SHA 128 bits HTTP 200 OK
  860. TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  861. TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  862. TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  863. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  864. TLS_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  865. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  866. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  867. TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  868. TLS_DHE_RSA_WITH_SEED_CBC_SHA 128 bits HTTP 200 OK
  869. TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  870. TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  871. TLS_DHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  872. TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  873. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  874.  
  875. * TLSV1_1 Cipher Suites:
  876. Forward Secrecy OK - Supported
  877. RC4 OK - Not Supported
  878.  
  879. Preferred:
  880. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  881. Accepted:
  882. TLS_RSA_WITH_SEED_CBC_SHA 128 bits HTTP 200 OK
  883. TLS_RSA_WITH_IDEA_CBC_SHA 128 bits HTTP 200 OK
  884. TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  885. TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  886. TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  887. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  888. TLS_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  889. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  890. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  891. TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  892. TLS_DHE_RSA_WITH_SEED_CBC_SHA 128 bits HTTP 200 OK
  893. TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  894. TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  895. TLS_DHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  896. TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  897. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  898.  
  899. * TLSV1_2 Cipher Suites:
  900. Forward Secrecy OK - Supported
  901. RC4 OK - Not Supported
  902.  
  903. Preferred:
  904. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 200 OK
  905. Accepted:
  906. TLS_RSA_WITH_SEED_CBC_SHA 128 bits HTTP 200 OK
  907. TLS_RSA_WITH_IDEA_CBC_SHA 128 bits HTTP 200 OK
  908. TLS_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  909. TLS_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  910. TLS_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 200 OK
  911. TLS_RSA_WITH_AES_256_CBC_SHA256 256 bits HTTP 200 OK
  912. TLS_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  913. TLS_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 200 OK
  914. TLS_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 200 OK
  915. TLS_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  916. TLS_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  917. TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 200 OK
  918. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 256 bits HTTP 200 OK
  919. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  920. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 200 OK
  921. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 200 OK
  922. TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  923. TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  924. TLS_DHE_RSA_WITH_SEED_CBC_SHA 128 bits HTTP 200 OK
  925. TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA 256 bits HTTP 200 OK
  926. TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA 128 bits HTTP 200 OK
  927. TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 256 bits HTTP 200 OK
  928. TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 256 bits HTTP 200 OK
  929. TLS_DHE_RSA_WITH_AES_256_CBC_SHA 256 bits HTTP 200 OK
  930. TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 128 bits HTTP 200 OK
  931. TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 128 bits HTTP 200 OK
  932. TLS_DHE_RSA_WITH_AES_128_CBC_SHA 128 bits HTTP 200 OK
  933. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  934. TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA 112 bits HTTP 200 OK
  935.  
  936. * OpenSSL Heartbleed:
  937. OK - Not vulnerable to Heartbleed
  938.  
  939. * ROBOT Attack:
  940. OK - Not vulnerable
  941.  
  942.  
  943. SCAN COMPLETED IN 24.24 S
  944. -------------------------
  945. #######################################################################################################################################
  946.  
  947. Domains still to check: 1
  948. Checking if the hostname fuhrernet.com. given is in fact a domain...
  949.  
  950. Analyzing domain: fuhrernet.com.
  951. Checking NameServers using system default resolver...
  952. IP: 173.201.71.24 (United States)
  953. HostName: ns48.domaincontrol.com Type: NS
  954. HostName: ns48.domaincontrol.com Type: PTR
  955. IP: 97.74.103.24 (United States)
  956. HostName: ns47.domaincontrol.com Type: NS
  957. HostName: ns47.domaincontrol.com Type: PTR
  958.  
  959. Checking MailServers using system default resolver...
  960. IP: 87.250.250.89 (Russian Federation)
  961. HostName: mx.yandex.net Type: MX
  962. HostName: mx.yandex.ru Type: PTR
  963. IP: 213.180.204.89 (Russian Federation)
  964. HostName: mx.yandex.net Type: MX
  965. HostName: mx.yandex.ru Type: PTR
  966. IP: 77.88.21.89 (Russian Federation)
  967. HostName: mx.yandex.net Type: MX
  968. HostName: mx.yandex.ru Type: PTR
  969. IP: 213.180.193.89 (Russian Federation)
  970. HostName: mx.yandex.net Type: MX
  971. HostName: mx.yandex.ru Type: PTR
  972. IP: 93.158.134.89 (Russian Federation)
  973. HostName: mx.yandex.net Type: MX
  974. HostName: mx.yandex.ru Type: PTR
  975.  
  976. Checking the zone transfer for each NS... (if this takes more than 10 seconds, just hit CTRL-C and it will continue. Bug in the libs)
  977. No zone transfer found on nameserver 97.74.103.24
  978. No zone transfer found on nameserver 173.201.71.24
  979.  
  980. Checking SPF record...
  981. New IP found: <IP-1>
  982. New IP found: <IP-2>
  983.  
  984. Checking SPF record...
  985.  
  986. Checking 192 most common hostnames using system default resolver...
  987. IP: 68.81.58.227 (United States)
  988. HostName: www.fuhrernet.com. Type: A
  989.  
  990. Checking with nmap the reverse DNS hostnames of every <ip>/24 netblock using system default resolver...
  991. Checking netblock 68.81.58.0
  992. Checking netblock 97.74.103.0
  993. Checking netblock 93.158.134.0
  994. Checking netblock 213.180.193.0
  995. Checking netblock 173.201.71.0
  996. Checking netblock 77.88.21.0
  997. Checking netblock 87.250.250.0
  998. Checking netblock 0
  999. Checking netblock 213.180.204.0
  1000.  
  1001. Searching for fuhrernet.com. emails in Google
  1002.  
  1003. Checking 10 active hosts using nmap... (nmap -sn -n -v -PP -PM -PS80,25 -PA -PY -PU53,40125 -PE --reason <ip> -oA <output_directory>/nmap/<ip>.sn)
  1004. Host 68.81.58.227 is up (echo-reply ttl 49)
  1005. Host 97.74.103.24 is up (reset ttl 64)
  1006. Host 93.158.134.89 is up (reset ttl 64)
  1007. Host 213.180.193.89 is up (reset ttl 64)
  1008. Host 173.201.71.24 is up (echo-reply ttl 56)
  1009. Host 77.88.21.89 is up (reset ttl 64)
  1010. Host 87.250.250.89 is up (reset ttl 64)
  1011. Failed to resolve "<IP-2>".
  1012. WARNING: No targets were specified, so 0 hosts scanned.
  1013. Host <IP-2> is down
  1014. Failed to resolve "<IP-1>".
  1015. WARNING: No targets were specified, so 0 hosts scanned.
  1016. Host <IP-1> is down
  1017. Host 213.180.204.89 is up (reset ttl 64)
  1018.  
  1019. Checking ports on every active host using nmap... (nmap -O --reason --webxml --traceroute -sS -sV -sC -Pn -n -v -F <ip> -oA <output_directory>/nmap/<ip>)
  1020. Scanning ip 68.81.58.227 (www.fuhrernet.com.):
  1021. adjust_timeouts2: packet supposedly had rtt of -57270 microseconds. Ignoring time.
  1022. adjust_timeouts2: packet supposedly had rtt of -57270 microseconds. Ignoring time.
  1023. adjust_timeouts2: packet supposedly had rtt of -91548 microseconds. Ignoring time.
  1024. adjust_timeouts2: packet supposedly had rtt of -91548 microseconds. Ignoring time.
  1025. 21/tcp open tcpwrapped syn-ack ttl 112
  1026. | ftp-syst:
  1027. |_ SYST: UNIX emulated by FileZilla
  1028. 80/tcp open tcpwrapped syn-ack ttl 112
  1029. |_http-favicon: Unknown favicon MD5: DB329B3B28D2D0EFB3462491F591D883
  1030. | http-methods:
  1031. |_ Supported Methods: GET HEAD POST OPTIONS
  1032. |_http-server-header: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1033. |_http-title: Newsfeed
  1034. 443/tcp open tcpwrapped syn-ack ttl 112
  1035. | http-methods:
  1036. |_ Supported Methods: GET HEAD POST OPTIONS
  1037. |_http-server-header: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1038. |_http-title: Bad request!
  1039. | ssl-cert: Subject: commonName=localhost
  1040. | Issuer: commonName=localhost
  1041. | Public Key type: rsa
  1042. | Public Key bits: 1024
  1043. | Signature Algorithm: sha1WithRSAEncryption
  1044. | Not valid before: 2009-11-10T23:48:47
  1045. | Not valid after: 2019-11-08T23:48:47
  1046. | MD5: a0a4 4cc9 9e84 b26f 9e63 9f9e d229 dee0
  1047. |_SHA-1: b023 8c54 7a90 5bfa 119c 4e8b acca eacf 3649 1ff6
  1048. |_ssl-date: TLS randomness does not represent time
  1049. | tls-alpn:
  1050. |_ http/1.1
  1051. 3306/tcp open tcpwrapped syn-ack ttl 112
  1052. Device type: general purpose|WAP
  1053. Scanning ip 97.74.103.24 (ns47.domaincontrol.com (PTR)):
  1054. 53/tcp open tcpwrapped syn-ack ttl 52
  1055. Scanning ip 93.158.134.89 (mx.yandex.ru (PTR)):
  1056. Scanning ip 213.180.193.89 (mx.yandex.ru (PTR)):
  1057. Scanning ip 173.201.71.24 (ns48.domaincontrol.com (PTR)):
  1058. 53/tcp open tcpwrapped syn-ack ttl 56
  1059. Scanning ip 77.88.21.89 (mx.yandex.ru (PTR)):
  1060. Scanning ip 87.250.250.89 (mx.yandex.ru (PTR)):
  1061. Scanning ip 213.180.204.89 (mx.yandex.ru (PTR)):
  1062. WebCrawling domain's web servers... up to 50 max links.
  1063. --Finished--
  1064. Summary information for domain fuhrernet.com.
  1065. -----------------------------------------
  1066.  
  1067. Domain Ips Information:
  1068. IP: 68.81.58.227
  1069. HostName: www.fuhrernet.com. Type: A
  1070. Country: United States
  1071. Is Active: True (echo-reply ttl 49)
  1072. Port: 21/tcp open tcpwrapped syn-ack ttl 112
  1073. Script Info: | ftp-syst:
  1074. Script Info: |_ SYST: UNIX emulated by FileZilla
  1075. Port: 80/tcp open tcpwrapped syn-ack ttl 112
  1076. Script Info: |_http-favicon: Unknown favicon MD5: DB329B3B28D2D0EFB3462491F591D883
  1077. Script Info: | http-methods:
  1078. Script Info: |_ Supported Methods: GET HEAD POST OPTIONS
  1079. Script Info: |_http-server-header: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1080. Script Info: |_http-title: Newsfeed
  1081. Port: 443/tcp open tcpwrapped syn-ack ttl 112
  1082. Script Info: | http-methods:
  1083. Script Info: |_ Supported Methods: GET HEAD POST OPTIONS
  1084. Script Info: |_http-server-header: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1085. Script Info: |_http-title: Bad request!
  1086. Script Info: | ssl-cert: Subject: commonName=localhost
  1087. Script Info: | Issuer: commonName=localhost
  1088. Script Info: | Public Key type: rsa
  1089. Script Info: | Public Key bits: 1024
  1090. Script Info: | Signature Algorithm: sha1WithRSAEncryption
  1091. Script Info: | Not valid before: 2009-11-10T23:48:47
  1092. Script Info: | Not valid after: 2019-11-08T23:48:47
  1093. Script Info: | MD5: a0a4 4cc9 9e84 b26f 9e63 9f9e d229 dee0
  1094. Script Info: |_SHA-1: b023 8c54 7a90 5bfa 119c 4e8b acca eacf 3649 1ff6
  1095. Script Info: |_ssl-date: TLS randomness does not represent time
  1096. Script Info: | tls-alpn:
  1097. Script Info: |_ http/1.1
  1098. Port: 3306/tcp open tcpwrapped syn-ack ttl 112
  1099. Script Info: Device type: general purpose|WAP
  1100. IP: 97.74.103.24
  1101. HostName: ns47.domaincontrol.com Type: NS
  1102. HostName: ns47.domaincontrol.com Type: PTR
  1103. Country: United States
  1104. Is Active: True (reset ttl 64)
  1105. Port: 53/tcp open tcpwrapped syn-ack ttl 52
  1106. IP: 93.158.134.89
  1107. HostName: mx.yandex.net Type: MX
  1108. HostName: mx.yandex.ru Type: PTR
  1109. Country: Russian Federation
  1110. Is Active: True (reset ttl 64)
  1111. IP: 213.180.193.89
  1112. HostName: mx.yandex.net Type: MX
  1113. HostName: mx.yandex.ru Type: PTR
  1114. Country: Russian Federation
  1115. Is Active: True (reset ttl 64)
  1116. IP: 173.201.71.24
  1117. HostName: ns48.domaincontrol.com Type: NS
  1118. HostName: ns48.domaincontrol.com Type: PTR
  1119. Country: United States
  1120. Is Active: True (echo-reply ttl 56)
  1121. Port: 53/tcp open tcpwrapped syn-ack ttl 56
  1122. IP: 77.88.21.89
  1123. HostName: mx.yandex.net Type: MX
  1124. HostName: mx.yandex.ru Type: PTR
  1125. Country: Russian Federation
  1126. Is Active: True (reset ttl 64)
  1127. IP: 87.250.250.89
  1128. HostName: mx.yandex.net Type: MX
  1129. HostName: mx.yandex.ru Type: PTR
  1130. Country: Russian Federation
  1131. Is Active: True (reset ttl 64)
  1132. IP: <IP-2>
  1133. Type: SPF
  1134. Is Active: False
  1135. IP: <IP-1>
  1136. Type: SPF
  1137. Is Active: False
  1138. IP: 213.180.204.89
  1139. HostName: mx.yandex.net Type: MX
  1140. HostName: mx.yandex.ru Type: PTR
  1141. Country: Russian Federation
  1142. Is Active: True (reset ttl 64)
  1143. #######################################################################################################################################
  1144. dnsenum VERSION:1.2.4
  1145.  
  1146. ----- fuhrernet.com -----
  1147.  
  1148.  
  1149. Host's addresses:
  1150. __________________
  1151.  
  1152. fuhrernet.com. 340 IN A 68.81.58.227
  1153.  
  1154.  
  1155. Name Servers:
  1156. ______________
  1157.  
  1158. ns47.domaincontrol.com. 86004 IN A 97.74.103.24
  1159. ns48.domaincontrol.com. 86028 IN A 173.201.71.24
  1160.  
  1161.  
  1162. Mail (MX) Servers:
  1163. ___________________
  1164.  
  1165. mx.yandex.net. 554 IN A 87.250.250.89
  1166. mx.yandex.net. 554 IN A 213.180.204.89
  1167. mx.yandex.net. 554 IN A 77.88.21.89
  1168. mx.yandex.net. 554 IN A 213.180.193.89
  1169. mx.yandex.net. 554 IN A 93.158.134.89
  1170.  
  1171.  
  1172. Trying Zone Transfers and getting Bind Versions:
  1173. _________________________________________________
  1174.  
  1175.  
  1176. Trying Zone Transfer for fuhrernet.com on ns47.domaincontrol.com ...
  1177.  
  1178. Trying Zone Transfer for fuhrernet.com on ns48.domaincontrol.com ...
  1179.  
  1180. brute force file not specified, bay.
  1181. #######################################################################################################################################
  1182. Domain Name: FUHRERNET.COM
  1183. Registry Domain ID: 2183865559_DOMAIN_COM-VRSN
  1184. Registrar WHOIS Server: whois.godaddy.com
  1185. Registrar URL: http://www.godaddy.com
  1186. Updated Date: 2019-09-17T14:54:51Z
  1187. Creation Date: 2017-11-06T18:02:49Z
  1188. Registry Expiry Date: 2020-11-06T18:02:49Z
  1189. Registrar: GoDaddy.com, LLC
  1190. Registrar IANA ID: 146
  1191. Registrar Abuse Contact Email: [email protected]
  1192. Registrar Abuse Contact Phone: 480-624-2505
  1193. Domain Status: ok https://icann.org/epp#ok
  1194. Name Server: NS47.DOMAINCONTROL.COM
  1195. Name Server: NS48.DOMAINCONTROL.COM
  1196. DNSSEC: unsigned
  1197. #######################################################################################################################################
  1198. Domain Name: fuhrernet.com
  1199. Registry Domain ID: 2183865559_DOMAIN_COM-VRSN
  1200. Registrar WHOIS Server: whois.godaddy.com
  1201. Registrar URL: http://www.godaddy.com
  1202. Updated Date: 2017-11-06T18:02:49Z
  1203. Creation Date: 2017-11-06T18:02:49Z
  1204. Registrar Registration Expiration Date: 2020-11-06T18:02:49Z
  1205. Registrar: GoDaddy.com, LLC
  1206. Registrar IANA ID: 146
  1207. Registrar Abuse Contact Email: [email protected]
  1208. Registrar Abuse Contact Phone: +1.4806242505
  1209. Domain Status: ok http://www.icann.org/epp#ok
  1210. Registrant Organization: Fuhrernet
  1211. Registrant State/Province: Pennsylvania
  1212. Registrant Country: US
  1213. Registrant Email: Select Contact Domain Holder link at https://www.godaddy.com/whois/results.aspx?domain=fuhrernet.com
  1214. Admin Email: Select Contact Domain Holder link at https://www.godaddy.com/whois/results.aspx?domain=fuhrernet.com
  1215. Tech Email: Select Contact Domain Holder link at https://www.godaddy.com/whois/results.aspx?domain=fuhrernet.com
  1216. Name Server: NS47.DOMAINCONTROL.COM
  1217. Name Server: NS48.DOMAINCONTROL.COM
  1218. DNSSEC: unsigned
  1219. #######################################################################################################################################
  1220. [*] Processing domain fuhrernet.com
  1221. [*] Using system resolvers ['38.132.106.139', '194.187.251.67', '185.93.180.131', '192.168.0.1', '2001:18c0:121:6900:724f:b8ff:fefd:5b6a']
  1222. [+] Getting nameservers
  1223. 173.201.71.24 - ns48.domaincontrol.com
  1224. 97.74.103.24 - ns47.domaincontrol.com
  1225. [-] Zone transfer failed
  1226.  
  1227. [+] TXT records found
  1228. "v=spf1 ip4:<IP-1> ip4:<IP-2> include:_spf.yandex.net ~all"
  1229. "yandex-verification: d7cd81786b5817a7"
  1230.  
  1231. [+] MX records found, added to target list
  1232. 10 mx.yandex.net.
  1233.  
  1234. [*] Scanning fuhrernet.com for A records
  1235. 68.81.58.227 - fuhrernet.com
  1236. 68.81.58.227 - www.fuhrernet.com
  1237. #######################################################################################################################################
  1238. [*] Found SPF record:
  1239. [*] v=spf1 ip4:<IP-1> ip4:<IP-2> include:_spf.yandex.net ~all
  1240. [*] SPF record contains an All item: ~all
  1241. [*] No DMARC record found. Looking for organizational record
  1242. [+] No organizational DMARC record
  1243. [+] Spoofing possible for fuhrernet.com!
  1244. ######################################################################################################################################
  1245. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 04:54 EDT
  1246. Nmap scan report for fuhrernet.com (68.81.58.227)
  1247. Host is up (0.086s latency).
  1248. rDNS record for 68.81.58.227: c-68-81-58-227.hsd1.pa.comcast.net
  1249. Not shown: 473 filtered ports, 6 closed ports
  1250. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  1251. PORT STATE SERVICE
  1252. 21/tcp open ftp
  1253. 80/tcp open http
  1254. 443/tcp open https
  1255. 3306/tcp open mysql
  1256.  
  1257. Nmap done: 1 IP address (1 host up) scanned in 94.47 seconds
  1258. #######################################################################################################################################
  1259. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 04:55 EDT
  1260. Nmap scan report for fuhrernet.com (68.81.58.227)
  1261. Host is up (0.075s latency).
  1262. rDNS record for 68.81.58.227: c-68-81-58-227.hsd1.pa.comcast.net
  1263. Not shown: 2 filtered ports
  1264. PORT STATE SERVICE
  1265. 53/udp open|filtered domain
  1266. 67/udp open|filtered dhcps
  1267. 68/udp open|filtered dhcpc
  1268. 69/udp open|filtered tftp
  1269. 88/udp open|filtered kerberos-sec
  1270. 123/udp open|filtered ntp
  1271. 139/udp open|filtered netbios-ssn
  1272. 161/udp open|filtered snmp
  1273. 162/udp open|filtered snmptrap
  1274. 389/udp open|filtered ldap
  1275. 500/udp open|filtered isakmp
  1276. 520/udp open|filtered route
  1277. 2049/udp open|filtered nfs
  1278.  
  1279. Nmap done: 1 IP address (1 host up) scanned in 2.60 seconds
  1280. ######################################################################################################################################
  1281. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 04:56 EDT
  1282. NSE: [ftp-brute] usernames: Time limit 3m00s exceeded.
  1283. NSE: [ftp-brute] usernames: Time limit 3m00s exceeded.
  1284. NSE: [ftp-brute] passwords: Time limit 3m00s exceeded.
  1285. Nmap scan report for fuhrernet.com (68.81.58.227)
  1286. Host is up (0.079s latency).
  1287. rDNS record for 68.81.58.227: c-68-81-58-227.hsd1.pa.comcast.net
  1288.  
  1289. PORT STATE SERVICE VERSION
  1290. 21/tcp open ftp FileZilla ftpd 0.9.41 beta
  1291. | ftp-brute:
  1292. | Accounts: No valid accounts found
  1293. |_ Statistics: Performed 2331 guesses in 266 seconds, average tps: 7.9
  1294. | ftp-syst:
  1295. |_ SYST: UNIX emulated by FileZilla
  1296. |_vulscan: ERROR: Script execution failed (use -d to debug)
  1297. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  1298. Device type: specialized|general purpose
  1299. Running (JUST GUESSING): AVtech embedded (87%), FreeBSD 6.X (87%)
  1300. OS CPE: cpe:/o:freebsd:freebsd:6.2
  1301. Aggressive OS guesses: AVtech Room Alert 26W environmental monitor (87%), FreeBSD 6.2-RELEASE (87%)
  1302. No exact OS matches for host (test conditions non-ideal).
  1303. Network Distance: 20 hops
  1304. Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
  1305.  
  1306. TRACEROUTE (using port 21/tcp)
  1307. HOP RTT ADDRESS
  1308. 1 99.30 ms 10.244.204.1
  1309. 2 99.36 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  1310. 3 99.34 ms irb-0.agg1.qc1.ca.m247.com (37.120.128.168)
  1311. 4 99.34 ms te-1-5-2-0.bb1.fra2.de.m247.com (82.102.29.44)
  1312. 5 99.34 ms ix-xe-11-1-1-0.tcore1.w6c-montreal.as6453.net (66.198.96.98)
  1313. 6 99.36 ms if-ae-12-2.tcore1.mtt-montreal.as6453.net (64.86.31.26)
  1314. 7 99.36 ms if-ae-0-2.tcore2.mtt-montreal.as6453.net (216.6.115.90)
  1315. 8 99.38 ms if-ae-5-2.tcore2.n0v-new-york.as6453.net (64.86.226.58)
  1316. 9 99.39 ms if-ae-2-2.tcore1.n0v-new-york.as6453.net (216.6.90.21)
  1317. 10 28.53 ms if-ae-7-5.tcore1.nto-new-york.as6453.net (63.243.128.141)
  1318. 11 89.59 ms if-ae-9-2.tcore1.n75-new-york.as6453.net (63.243.128.122)
  1319. 12 39.20 ms 66.110.96.130
  1320. 13 39.21 ms be-10390-cr02.newyork.ny.ibone.comcast.net (68.86.83.89)
  1321. 14 39.20 ms be-10203-cr01.newark.nj.ibone.comcast.net (68.86.85.185)
  1322. 15 39.21 ms be-7922-ar03.ivyland.pa.panjde.comcast.net (68.86.93.174)
  1323. 16 39.20 ms 68.86.211.122
  1324. 17 39.19 ms 162.151.182.174
  1325. 18 39.21 ms lag1-acr22.levittown.pa.panjde.comcast.net (68.85.78.58)
  1326. 19 ...
  1327. 20 59.05 ms c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1328. #######################################################################################################################################
  1329. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 05:01 EDT
  1330. NSE: Loaded 164 scripts for scanning.
  1331. NSE: Script Pre-scanning.
  1332. Initiating NSE at 05:01
  1333. Completed NSE at 05:01, 0.00s elapsed
  1334. Initiating NSE at 05:01
  1335. Completed NSE at 05:01, 0.00s elapsed
  1336. Initiating Parallel DNS resolution of 1 host. at 05:01
  1337. Completed Parallel DNS resolution of 1 host. at 05:01, 0.02s elapsed
  1338. Initiating SYN Stealth Scan at 05:01
  1339. Scanning fuhrernet.com (68.81.58.227) [1 port]
  1340. Discovered open port 80/tcp on 68.81.58.227
  1341. Completed SYN Stealth Scan at 05:01, 0.12s elapsed (1 total ports)
  1342. Initiating Service scan at 05:01
  1343. Scanning 1 service on fuhrernet.com (68.81.58.227)
  1344. Completed Service scan at 05:01, 6.11s elapsed (1 service on 1 host)
  1345. Initiating OS detection (try #1) against fuhrernet.com (68.81.58.227)
  1346. Retrying OS detection (try #2) against fuhrernet.com (68.81.58.227)
  1347. Initiating Traceroute at 05:02
  1348. Completed Traceroute at 05:02, 3.06s elapsed
  1349. Initiating Parallel DNS resolution of 19 hosts. at 05:02
  1350. Completed Parallel DNS resolution of 19 hosts. at 05:02, 0.28s elapsed
  1351. NSE: Script scanning 68.81.58.227.
  1352. Initiating NSE at 05:02
  1353. Completed NSE at 05:02, 46.72s elapsed
  1354. Initiating NSE at 05:02
  1355. Completed NSE at 05:02, 0.99s elapsed
  1356. Nmap scan report for fuhrernet.com (68.81.58.227)
  1357. Host is up (0.12s latency).
  1358. rDNS record for 68.81.58.227: c-68-81-58-227.hsd1.pa.comcast.net
  1359.  
  1360. PORT STATE SERVICE VERSION
  1361. 80/tcp open http Apache httpd 2.4.25 ((Win32) OpenSSL/1.0.2j PHP/7.1.1)
  1362. | http-brute:
  1363. |_ Path "/" does not require authentication
  1364. |_http-chrono: Request times for /; avg: 631.71ms; min: 466.84ms; max: 786.86ms
  1365. |_http-csrf: Couldn't find any CSRF vulnerabilities.
  1366. |_http-date: Sat, 28 Sep 2019 09:02:07 GMT; -5s from local time.
  1367. |_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.
  1368. |_http-dombased-xss: Couldn't find any DOM based XSS.
  1369. |_http-drupal-enum: Nothing found amongst the top 100 resources,use --script-args number=<number|all> for deeper analysis)
  1370. |_http-errors: Couldn't find any error pages.
  1371. |_http-feed: Couldn't find any feeds.
  1372. |_http-fetch: Please enter the complete path of the directory to save data in.
  1373. | http-headers:
  1374. | Date: Sat, 28 Sep 2019 09:02:03 GMT
  1375. | Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1376. | X-Powered-By: PHP/7.1.1
  1377. | Connection: close
  1378. | Content-Type: text/html; charset=UTF-8
  1379. |
  1380. |_ (Request type: HEAD)
  1381. |_http-jsonp-detection: Couldn't find any JSONP endpoints.
  1382. |_http-litespeed-sourcecode-download: Request with null byte did not work. This web server might not be vulnerable
  1383. | http-methods:
  1384. |_ Supported Methods: GET HEAD POST OPTIONS
  1385. |_http-mobileversion-checker: No mobile version detected.
  1386. | http-php-version: Logo query returned unknown hash 493264b1ea71e8083a6356206999ff80
  1387. | Credits query returned unknown hash 493264b1ea71e8083a6356206999ff80
  1388. |_Version from header x-powered-by: PHP/7.1.1
  1389. |_http-security-headers:
  1390. |_http-server-header: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1391. | http-sitemap-generator:
  1392. | Directory structure:
  1393. | /
  1394. | Other: 1; png: 3; webmanifest: 1
  1395. | /assets/bootstrap/css/
  1396. | css: 1
  1397. | /assets/css/
  1398. | css: 6
  1399. | /assets/fonts/
  1400. | css: 1
  1401. | Longest directory structure:
  1402. | Depth: 3
  1403. | Dir: /assets/bootstrap/css/
  1404. | Total files found (by extension):
  1405. |_ Other: 1; css: 8; png: 3; webmanifest: 1
  1406. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
  1407. |_http-title: Newsfeed
  1408. | http-trace: TRACE is enabled
  1409. | Headers:
  1410. | Date: Sat, 28 Sep 2019 09:02:02 GMT
  1411. | Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1412. | Connection: close
  1413. | Transfer-Encoding: chunked
  1414. |_Content-Type: message/http
  1415. | http-vhosts:
  1416. |_127 names had status 200
  1417. | http-vuln-cve2010-0738:
  1418. |_ /jmx-console/: Authentication was not required
  1419. |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
  1420. |_http-wordpress-enum: Nothing found amongst the top 100 resources,use --script-args search-limit=<number|all> for deeper analysis)
  1421. |_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php
  1422. |_http-xssed: No previously reported XSS vuln.
  1423. | vulners:
  1424. | cpe:/a:apache:http_server:2.4.25:
  1425. | CVE-2017-7679 7.5 https://vulners.com/cve/CVE-2017-7679
  1426. | CVE-2017-7668 7.5 https://vulners.com/cve/CVE-2017-7668
  1427. | CVE-2017-3169 7.5 https://vulners.com/cve/CVE-2017-3169
  1428. | CVE-2017-3167 7.5 https://vulners.com/cve/CVE-2017-3167
  1429. | CVE-2019-0211 7.2 https://vulners.com/cve/CVE-2019-0211
  1430. | CVE-2018-1312 6.8 https://vulners.com/cve/CVE-2018-1312
  1431. | CVE-2017-15715 6.8 https://vulners.com/cve/CVE-2017-15715
  1432. | CVE-2019-10082 6.4 https://vulners.com/cve/CVE-2019-10082
  1433. | CVE-2017-9788 6.4 https://vulners.com/cve/CVE-2017-9788
  1434. | CVE-2019-10098 5.8 https://vulners.com/cve/CVE-2019-10098
  1435. | CVE-2019-10081 5.0 https://vulners.com/cve/CVE-2019-10081
  1436. | CVE-2019-0220 5.0 https://vulners.com/cve/CVE-2019-0220
  1437. | CVE-2019-0196 5.0 https://vulners.com/cve/CVE-2019-0196
  1438. | CVE-2018-17199 5.0 https://vulners.com/cve/CVE-2018-17199
  1439. | CVE-2018-1333 5.0 https://vulners.com/cve/CVE-2018-1333
  1440. | CVE-2017-9798 5.0 https://vulners.com/cve/CVE-2017-9798
  1441. | CVE-2017-7659 5.0 https://vulners.com/cve/CVE-2017-7659
  1442. | CVE-2017-15710 5.0 https://vulners.com/cve/CVE-2017-15710
  1443. | CVE-2019-0197 4.9 https://vulners.com/cve/CVE-2019-0197
  1444. | CVE-2019-10092 4.3 https://vulners.com/cve/CVE-2019-10092
  1445. | CVE-2018-11763 4.3 https://vulners.com/cve/CVE-2018-11763
  1446. |_ CVE-2018-1283 3.5 https://vulners.com/cve/CVE-2018-1283
  1447. |_vulscan: ERROR: Script execution failed (use -d to debug)
  1448. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  1449. Device type: general purpose|specialized
  1450. Running (JUST GUESSING): FreeBSD 6.X (87%), AVtech embedded (85%)
  1451. OS CPE: cpe:/o:freebsd:freebsd:6.2
  1452. Aggressive OS guesses: FreeBSD 6.2-RELEASE (87%), AVtech Room Alert 26W environmental monitor (85%)
  1453. No exact OS matches for host (test conditions non-ideal).
  1454. Network Distance: 20 hops
  1455. TCP Sequence Prediction: Difficulty=261 (Good luck!)
  1456. IP ID Sequence Generation: Incremental
  1457.  
  1458. TRACEROUTE (using port 80/tcp)
  1459. HOP RTT ADDRESS
  1460. 1 49.76 ms 10.244.204.1
  1461. 2 49.85 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  1462. 3 49.89 ms irb-0.agg1.qc1.ca.m247.com (37.120.128.168)
  1463. 4 49.85 ms te-1-5-2-0.bb1.fra2.de.m247.com (82.102.29.44)
  1464. 5 49.87 ms ix-xe-11-1-1-0.tcore1.w6c-montreal.as6453.net (66.198.96.98)
  1465. 6 50.00 ms if-ae-12-2.tcore1.mtt-montreal.as6453.net (64.86.31.26)
  1466. 7 49.94 ms if-ae-0-2.tcore2.mtt-montreal.as6453.net (216.6.115.90)
  1467. 8 49.99 ms if-ae-5-2.tcore2.n0v-new-york.as6453.net (64.86.226.58)
  1468. 9 49.98 ms if-ae-2-2.tcore1.n0v-new-york.as6453.net (216.6.90.21)
  1469. 10 30.01 ms if-ae-7-5.tcore1.nto-new-york.as6453.net (63.243.128.141)
  1470. 11 47.74 ms if-ae-9-2.tcore1.n75-new-york.as6453.net (63.243.128.122)
  1471. 12 58.68 ms 66.110.96.138
  1472. 13 79.05 ms be-10390-cr02.newyork.ny.ibone.comcast.net (68.86.83.89)
  1473. 14 78.96 ms be-10203-cr01.newark.nj.ibone.comcast.net (68.86.85.185)
  1474. 15 79.07 ms be-7922-ar03.ivyland.pa.panjde.comcast.net (68.86.93.174)
  1475. 16 79.03 ms 68.86.211.122
  1476. 17 78.98 ms 162.151.182.174
  1477. 18 79.07 ms lag1-acr22.levittown.pa.panjde.comcast.net (68.85.78.58)
  1478. 19 ...
  1479. 20 105.13 ms c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1480.  
  1481. NSE: Script Post-scanning.
  1482. Initiating NSE at 05:02
  1483. Completed NSE at 05:02, 0.00s elapsed
  1484. Initiating NSE at 05:02
  1485. Completed NSE at 05:02, 0.00s elapsed
  1486. #######################################################################################################################################
  1487. http://fuhrernet.com [200 OK] Apache[2.4.25], Country[UNITED STATES][US], HTML5, HTTPServer[Windows (32 bit)][Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1], IP[68.81.58.227], Meta-Refresh-Redirect[./login.php], Open-Graph-Protocol[website], OpenSSL[1.0.2j], PHP[7.1.1], Script, Title[Newsfeed], X-Powered-By[PHP/7.1.1]
  1488. http://fuhrernet.com/login.php [200 OK] Apache[2.4.25], Country[UNITED STATES][US], HTML5, HTTPServer[Windows (32 bit)][Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1], IP[68.81.58.227], JQuery, Open-Graph-Protocol[website], OpenSSL[1.0.2j], PHP[7.1.1], PasswordField[password], Script[text/javascript], Title[Login to Führernet], X-Powered-By[PHP/7.1.1]
  1489. #######################################################################################################################################
  1490.  
  1491. wig - WebApp Information Gatherer
  1492.  
  1493.  
  1494. Scanning http://fuhrernet.com...
  1495. ____________________ SITE INFO ____________________
  1496. IP Title
  1497. 68.81.58.227 Newsfeed
  1498.  
  1499. _____________________ VERSION _____________________
  1500. Name Versions Type
  1501. Apache 2.4.25 Platform
  1502. PHP 7.1.1 Platform
  1503. openssl 1.0.2j Platform
  1504. FreeBSD 10 | 11 OS
  1505. openSUSE tumbleweed OS
  1506.  
  1507. ___________________ INTERESTING ___________________
  1508. URL Note Type
  1509. /test.html Test file Interesting
  1510. /login.php Login Page Interesting
  1511. /phpinfo.php PHP info file Interesting
  1512. /test/ Test directory Interesting
  1513.  
  1514. ___________________________________________________
  1515. Time: 60.2 sec Urls: 846 Fingerprints: 40401
  1516. #######################################################################################################################################
  1517. HTTP/1.1 200 OK
  1518. Date: Sat, 28 Sep 2019 09:04:00 GMT
  1519. Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1520. X-Powered-By: PHP/7.1.1
  1521. Content-Type: text/html; charset=UTF-8
  1522.  
  1523. HTTP/1.1 200 OK
  1524. Date: Sat, 28 Sep 2019 09:04:00 GMT
  1525. Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1526. X-Powered-By: PHP/7.1.1
  1527. Content-Type: text/html; charset=UTF-8
  1528. ######################################################################################################################################
  1529. ------------------------------------------------------------------------------------------------------------------------
  1530.  
  1531. [ ! ] Starting SCANNER INURLBR 2.1 at [28-09-2019 05:04:26]
  1532. [ ! ] legal disclaimer: Usage of INURLBR for attacking targets without prior mutual consent is illegal.
  1533. It is the end user's responsibility to obey all applicable local, state and federal laws.
  1534. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  1535.  
  1536. [ INFO ][ OUTPUT FILE ]:: [ /usr/share/sniper/loot/workspace/fuhrernet.com/output/inurlbr-fuhrernet.com ]
  1537. [ INFO ][ DORK ]::[ site:fuhrernet.com ]
  1538. [ INFO ][ SEARCHING ]:: {
  1539. [ INFO ][ ENGINE ]::[ GOOGLE - www.google.nu ]
  1540.  
  1541. [ INFO ][ SEARCHING ]::
  1542. -[:::]
  1543. [ INFO ][ ENGINE ]::[ GOOGLE API ]
  1544.  
  1545. [ INFO ][ SEARCHING ]::
  1546. -[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]
  1547. [ INFO ][ ENGINE ]::[ GOOGLE_GENERIC_RANDOM - www.google.mv ID: 012873187529719969291:yexdhbzntue ]
  1548.  
  1549. [ INFO ][ SEARCHING ]::
  1550. -[:::]-[:::]-[:::]-[:::]-[:::]-[:::]
  1551.  
  1552. [ INFO ][ TOTAL FOUND VALUES ]:: [ 4 ]
  1553.  
  1554.  
  1555. _[ - ]::--------------------------------------------------------------------------------------------------------------
  1556. |_[ + ] [ 0 / 4 ]-[05:04:41] [ - ]
  1557. |_[ + ] Target:: [ http://fuhrernet.com/ ]
  1558. |_[ + ] Exploit::
  1559. |_[ + ] Information Server:: HTTP/1.1 200 OK, Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1 X-Powered-By: PHP/7.1.1, IP:68.81.58.227:80
  1560. |_[ + ] More details:: / - / , ISP:
  1561. |_[ + ] Found:: UNIDENTIFIED
  1562.  
  1563. _[ - ]::--------------------------------------------------------------------------------------------------------------
  1564. |_[ + ] [ 1 / 4 ]-[05:04:42] [ - ]
  1565. |_[ + ] Target:: [ http://fuhrernet.com/forgot-username.html ]
  1566. |_[ + ] Exploit::
  1567. |_[ + ] Information Server:: HTTP/1.1 200 OK, Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1 , IP:68.81.58.227:80
  1568. |_[ + ] More details:: / - / , ISP:
  1569. |_[ + ] Found:: UNIDENTIFIED
  1570.  
  1571. _[ - ]::--------------------------------------------------------------------------------------------------------------
  1572. |_[ + ] [ 2 / 4 ]-[05:04:43] [ - ]
  1573. |_[ + ] Target:: [ http://www.fuhrernet.com/forgot-password.html ]
  1574. |_[ + ] Exploit::
  1575. |_[ + ] Information Server:: HTTP/1.1 200 OK, Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1 , IP:68.81.58.227:80
  1576. |_[ + ] More details:: / - / , ISP:
  1577. |_[ + ] Found:: UNIDENTIFIED
  1578.  
  1579. _[ - ]::--------------------------------------------------------------------------------------------------------------
  1580. |_[ + ] [ 3 / 4 ]-[05:04:44] [ - ]
  1581. |_[ + ] Target:: [ http://www.fuhrernet.com/create-account.php ]
  1582. |_[ + ] Exploit::
  1583. |_[ + ] Information Server:: HTTP/1.1 200 OK, Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1 X-Powered-By: PHP/7.1.1, IP:68.81.58.227:80
  1584. |_[ + ] More details:: / - / , ISP:
  1585. |_[ + ] Found:: UNIDENTIFIED
  1586.  
  1587. [ INFO ] [ Shutting down ]
  1588. [ INFO ] [ End of process INURLBR at [28-09-2019 05:04:44]
  1589. [ INFO ] [ TOTAL FILTERED VALUES ]:: [ 0 ]
  1590. [ INFO ] [ OUTPUT FILE ]:: [ /usr/share/sniper/loot/workspace/fuhrernet.com/output/inurlbr-fuhrernet.com ]
  1591. |_________________________________________________________________________________________
  1592.  
  1593. \_________________________________________________________________________________________/
  1594. #######################################################################################################################################
  1595. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 05:04 EDT
  1596. NSE: Loaded 164 scripts for scanning.
  1597. NSE: Script Pre-scanning.
  1598. Initiating NSE at 05:04
  1599. Completed NSE at 05:04, 0.00s elapsed
  1600. Initiating NSE at 05:04
  1601. Completed NSE at 05:04, 0.00s elapsed
  1602. Initiating Parallel DNS resolution of 1 host. at 05:04
  1603. Completed Parallel DNS resolution of 1 host. at 05:04, 0.02s elapsed
  1604. Initiating SYN Stealth Scan at 05:04
  1605. Scanning fuhrernet.com (68.81.58.227) [1 port]
  1606. Completed SYN Stealth Scan at 05:04, 0.54s elapsed (1 total ports)
  1607. Initiating Service scan at 05:04
  1608. Initiating OS detection (try #1) against fuhrernet.com (68.81.58.227)
  1609. Retrying OS detection (try #2) against fuhrernet.com (68.81.58.227)
  1610. Initiating Traceroute at 05:04
  1611. Completed Traceroute at 05:04, 0.13s elapsed
  1612. Initiating Parallel DNS resolution of 19 hosts. at 05:04
  1613. Completed Parallel DNS resolution of 19 hosts. at 05:04, 0.15s elapsed
  1614. NSE: Script scanning 68.81.58.227.
  1615. Initiating NSE at 05:04
  1616. Completed NSE at 05:04, 0.22s elapsed
  1617. Initiating NSE at 05:04
  1618. Completed NSE at 05:04, 0.00s elapsed
  1619. Nmap scan report for fuhrernet.com (68.81.58.227)
  1620. Host is up (0.048s latency).
  1621. rDNS record for 68.81.58.227: c-68-81-58-227.hsd1.pa.comcast.net
  1622.  
  1623. PORT STATE SERVICE VERSION
  1624. 443/tcp filtered https
  1625. Too many fingerprints match this host to give specific OS details
  1626. Network Distance: 19 hops
  1627.  
  1628. TRACEROUTE (using proto 1/icmp)
  1629. HOP RTT ADDRESS
  1630. 1 49.76 ms 10.244.204.1
  1631. 2 49.81 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  1632. 3 69.35 ms irb-0.agg1.qc1.ca.m247.com (37.120.128.168)
  1633. 4 49.83 ms te-1-5-2-0.bb1.fra2.de.m247.com (82.102.29.44)
  1634. 5 49.85 ms ix-xe-11-1-1-0.tcore1.w6c-montreal.as6453.net (66.198.96.98)
  1635. 6 49.87 ms if-ae-12-2.tcore1.mtt-montreal.as6453.net (64.86.31.26)
  1636. 7 49.88 ms if-ae-0-2.tcore2.mtt-montreal.as6453.net (216.6.115.90)
  1637. 8 49.90 ms if-ae-5-2.tcore2.n0v-new-york.as6453.net (64.86.226.58)
  1638. 9 49.91 ms if-ae-2-2.tcore1.n0v-new-york.as6453.net (216.6.90.21)
  1639. 10 28.97 ms if-ae-7-2.tcore1.nto-new-york.as6453.net (63.243.128.25)
  1640. 11 59.56 ms if-ae-9-2.tcore1.n75-new-york.as6453.net (63.243.128.122)
  1641. 12 59.29 ms 66.110.96.146
  1642. 13 59.33 ms be-10390-cr02.newyork.ny.ibone.comcast.net (68.86.83.89)
  1643. 14 59.29 ms be-10203-cr01.newark.nj.ibone.comcast.net (68.86.85.185)
  1644. 15 59.32 ms be-7922-ar03.ivyland.pa.panjde.comcast.net (68.86.93.174)
  1645. 16 59.34 ms 68.86.211.122
  1646. 17 59.29 ms 162.151.182.174
  1647. 18 59.32 ms lag1-acr22.levittown.pa.panjde.comcast.net (68.85.78.58)
  1648. 19 78.99 ms c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1649.  
  1650. NSE: Script Post-scanning.
  1651. Initiating NSE at 05:04
  1652. Completed NSE at 05:04, 0.00s elapsed
  1653. Initiating NSE at 05:04
  1654. Completed NSE at 05:04, 0.00s elapsed
  1655. #######################################################################################################################################
  1656. Version: 1.11.13-static
  1657. OpenSSL 1.0.2-chacha (1.0.2g-dev)
  1658.  
  1659. Connected to 68.81.58.227
  1660.  
  1661. Testing SSL server fuhrernet.com on port 443 using SNI name fuhrernet.com
  1662.  
  1663. TLS Fallback SCSV:
  1664. Server supports TLS Fallback SCSV
  1665.  
  1666. TLS renegotiation:
  1667. Secure session renegotiation supported
  1668.  
  1669. TLS Compression:
  1670. Compression disabled
  1671.  
  1672. Heartbleed:
  1673. TLS 1.2 not vulnerable to heartbleed
  1674. TLS 1.1 not vulnerable to heartbleed
  1675. TLS 1.0 not vulnerable to heartbleed
  1676.  
  1677. Supported Server Cipher(s):
  1678. Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
  1679. Preferred TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1680. Accepted TLSv1.1 256 bits DHE-RSA-AES256-SHA DHE 1024 bits
  1681. Accepted TLSv1.1 256 bits DHE-RSA-CAMELLIA256-SHA DHE 1024 bits
  1682. Accepted TLSv1.1 256 bits AES256-SHA
  1683. Accepted TLSv1.1 256 bits CAMELLIA256-SHA
  1684. Accepted TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1685. Accepted TLSv1.1 128 bits DHE-RSA-AES128-SHA DHE 1024 bits
  1686. Preferred TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  1687. Accepted TLSv1.0 256 bits DHE-RSA-AES256-SHA DHE 1024 bits
  1688. Accepted TLSv1.0 256 bits DHE-RSA-CAMELLIA256-SHA DHE 1024 bits
  1689. Accepted TLSv1.0 256 bits AES256-SHA
  1690. Accepted TLSv1.0 256 bits CAMELLIA256-SHA
  1691. Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  1692. Accepted TLSv1.0 128 bits DHE-RSA-AES128-SHA DHE 1024 bits
  1693. Accepted TLSv1.0 128 bits DHE-RSA-CAMELLIA128-SHA DHE 1024 bits
  1694. Accepted TLSv1.0 128 bits AES128-SHA
  1695. Accepted TLSv1.0 128 bits CAMELLIA128-SHA
  1696. Accepted TLSv1.0 128 bits DHE-RSA-SEED-SHA DHE 1024 bits
  1697. Accepted TLSv1.0 128 bits SEED-SHA
  1698. Accepted TLSv1.0 128 bits IDEA-CBC-SHA
  1699. Accepted TLSv1.0 112 bits ECDHE-RSA-DES-CBC3-SHA Curve P-256 DHE 256
  1700. Accepted TLSv1.0 112 bits EDH-RSA-DES-CBC3-SHA DHE 1024 bits
  1701. Accepted TLSv1.0 112 bits DES-CBC3-SHA
  1702.  
  1703. SSL Certificate:
  1704. Signature Algorithm: sha1WithRSAEncryption
  1705. RSA Key Strength: 1024
  1706.  
  1707. Subject: localhost
  1708. Issuer: localhost
  1709.  
  1710. Not valid before: Nov 10 23:48:47 2009 GMT
  1711. Not valid after: Nov 8 23:48:47 2019 GMT
  1712. ######################################################################################################################################
  1713. ------------------------------------------------------------------------------------------------------------------------
  1714.  
  1715. [ ! ] Starting SCANNER INURLBR 2.1 at [28-09-2019 05:09:05]
  1716. [ ! ] legal disclaimer: Usage of INURLBR for attacking targets without prior mutual consent is illegal.
  1717. It is the end user's responsibility to obey all applicable local, state and federal laws.
  1718. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  1719.  
  1720. [ INFO ][ OUTPUT FILE ]:: [ /usr/share/sniper/loot/workspace/fuhrernet.com/output/inurlbr-fuhrernet.com ]
  1721. [ INFO ][ DORK ]::[ site:fuhrernet.com ]
  1722. [ INFO ][ SEARCHING ]:: {
  1723. [ INFO ][ ENGINE ]::[ GOOGLE - www.google.cv ]
  1724.  
  1725. [ INFO ][ SEARCHING ]::
  1726. -[:::]
  1727. [ INFO ][ ENGINE ]::[ GOOGLE API ]
  1728.  
  1729. [ INFO ][ SEARCHING ]::
  1730. -[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]-[:::]
  1731. [ INFO ][ ENGINE ]::[ GOOGLE_GENERIC_RANDOM - www.google.ro ID: 010479943387663786936:wjwf2xkhfmq ]
  1732.  
  1733. [ INFO ][ SEARCHING ]::
  1734. -[:::]-[:::]-[:::]-[:::]-[:::]-[:::]
  1735.  
  1736. [ INFO ][ TOTAL FOUND VALUES ]:: [ 4 ]
  1737.  
  1738.  
  1739. _[ - ]::--------------------------------------------------------------------------------------------------------------
  1740. |_[ + ] [ 0 / 4 ]-[05:09:18] [ - ]
  1741. |_[ + ] Target:: [ http://fuhrernet.com/ ]
  1742. |_[ + ] Exploit::
  1743. |_[ + ] Information Server:: HTTP/1.1 200 OK, Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1 X-Powered-By: PHP/7.1.1, IP:68.81.58.227:80
  1744. |_[ + ] More details:: / - / , ISP:
  1745. |_[ + ] Found:: UNIDENTIFIED
  1746.  
  1747. _[ - ]::--------------------------------------------------------------------------------------------------------------
  1748. |_[ + ] [ 1 / 4 ]-[05:09:18] [ - ]
  1749. |_[ + ] Target:: [ http://fuhrernet.com/forgot-username.html ]
  1750. |_[ + ] Exploit::
  1751. |_[ + ] Information Server:: HTTP/1.1 200 OK, Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1 , IP:68.81.58.227:80
  1752. |_[ + ] More details:: / - / , ISP:
  1753. |_[ + ] Found:: UNIDENTIFIED
  1754.  
  1755. _[ - ]::--------------------------------------------------------------------------------------------------------------
  1756. |_[ + ] [ 2 / 4 ]-[05:09:19] [ - ]
  1757. |_[ + ] Target:: [ http://www.fuhrernet.com/forgot-password.html ]
  1758. |_[ + ] Exploit::
  1759. |_[ + ] Information Server:: HTTP/1.1 200 OK, Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1 , IP:68.81.58.227:80
  1760. |_[ + ] More details:: / - / , ISP:
  1761. |_[ + ] Found:: UNIDENTIFIED
  1762.  
  1763. _[ - ]::--------------------------------------------------------------------------------------------------------------
  1764. |_[ + ] [ 3 / 4 ]-[05:09:20] [ - ]
  1765. |_[ + ] Target:: [ http://www.fuhrernet.com/create-account.php ]
  1766. |_[ + ] Exploit::
  1767. |_[ + ] Information Server:: HTTP/1.1 200 OK, Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1 X-Powered-By: PHP/7.1.1, IP:68.81.58.227:80
  1768. |_[ + ] More details:: / - / , ISP:
  1769. |_[ + ] Found:: UNIDENTIFIED
  1770.  
  1771. [ INFO ] [ Shutting down ]
  1772. [ INFO ] [ End of process INURLBR at [28-09-2019 05:09:20]
  1773. [ INFO ] [ TOTAL FILTERED VALUES ]:: [ 0 ]
  1774. [ INFO ] [ OUTPUT FILE ]:: [ /usr/share/sniper/loot/workspace/fuhrernet.com/output/inurlbr-fuhrernet.com ]
  1775. |_________________________________________________________________________________________
  1776.  
  1777. \_________________________________________________________________________________________/
  1778. #######################################################################################################################################
  1779. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 05:09 EDT
  1780. Nmap scan report for fuhrernet.com (68.81.58.227)
  1781. Host is up (0.16s latency).
  1782. rDNS record for 68.81.58.227: c-68-81-58-227.hsd1.pa.comcast.net
  1783.  
  1784. PORT STATE SERVICE VERSION
  1785. 3306/tcp open mysql MariaDB (unauthorized)
  1786. | mysql-brute:
  1787. | Accounts: No valid accounts found
  1788. |_ Statistics: Performed 42 guesses in 112 seconds, average tps: 0.4
  1789. |_mysql-empty-password: Host '176.113.74.60' is not allowed to connect to this MariaDB server
  1790. | mysql-enum:
  1791. | Accounts: No valid accounts found
  1792. |_ Statistics: Performed 5 guesses in 9 seconds, average tps: 0.6
  1793. |_mysql-vuln-cve2012-2122: ERROR: Script execution failed (use -d to debug)
  1794. |_vulscan: ERROR: Script execution failed (use -d to debug)
  1795. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  1796. Device type: specialized|general purpose
  1797. Running (JUST GUESSING): AVtech embedded (87%), FreeBSD 6.X (85%)
  1798. OS CPE: cpe:/o:freebsd:freebsd:6.2
  1799. Aggressive OS guesses: AVtech Room Alert 26W environmental monitor (87%), FreeBSD 6.2-RELEASE (85%)
  1800. No exact OS matches for host (test conditions non-ideal).
  1801. Network Distance: 20 hops
  1802.  
  1803. TRACEROUTE (using port 3306/tcp)
  1804. HOP RTT ADDRESS
  1805. 1 39.72 ms 10.244.204.1
  1806. 2 39.81 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  1807. 3 39.87 ms irb-0.agg1.qc1.ca.m247.com (37.120.128.168)
  1808. 4 39.86 ms te-1-5-2-0.bb1.fra2.de.m247.com (82.102.29.44)
  1809. 5 39.83 ms ix-xe-11-1-1-0.tcore1.w6c-montreal.as6453.net (66.198.96.98)
  1810. 6 40.05 ms if-ae-12-2.tcore1.mtt-montreal.as6453.net (64.86.31.26)
  1811. 7 39.96 ms if-ae-0-2.tcore2.mtt-montreal.as6453.net (216.6.115.90)
  1812. 8 40.00 ms if-ae-5-2.tcore2.n0v-new-york.as6453.net (64.86.226.58)
  1813. 9 40.08 ms if-ae-2-2.tcore1.n0v-new-york.as6453.net (216.6.90.21)
  1814. 10 40.10 ms if-ae-7-2.tcore1.nto-new-york.as6453.net (63.243.128.25)
  1815. 11 89.63 ms if-ae-9-2.tcore1.n75-new-york.as6453.net (63.243.128.122)
  1816. 12 150.76 ms 66.110.96.138
  1817. 13 150.83 ms be-10390-cr02.newyork.ny.ibone.comcast.net (68.86.83.89)
  1818. 14 150.78 ms be-10203-cr01.newark.nj.ibone.comcast.net (68.86.85.185)
  1819. 15 150.81 ms be-7922-ar03.ivyland.pa.panjde.comcast.net (68.86.93.174)
  1820. 16 150.77 ms 68.86.211.122
  1821. 17 150.72 ms 162.151.182.174
  1822. 18 150.78 ms lag1-acr22.levittown.pa.panjde.comcast.net (68.85.78.58)
  1823. 19 ...
  1824. 20 150.77 ms c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1825.  
  1826. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
  1827. Nmap done: 1 IP address (1 host up) scanned in 122.77 seconds
  1828. #######################################################################################################################################
  1829. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 04:44 EDT
  1830. Nmap scan report for c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1831. Host is up (0.059s latency).
  1832. Not shown: 473 filtered ports, 6 closed ports
  1833. Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
  1834. PORT STATE SERVICE
  1835. 21/tcp open ftp
  1836. 80/tcp open http
  1837. 443/tcp open https
  1838. 3306/tcp open mysql
  1839.  
  1840. Nmap done: 1 IP address (1 host up) scanned in 61.34 seconds
  1841. #######################################################################################################################################
  1842. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 04:45 EDT
  1843. Nmap scan report for c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1844. Host is up (0.036s latency).
  1845. Not shown: 2 filtered ports
  1846. PORT STATE SERVICE
  1847. 53/udp open|filtered domain
  1848. 67/udp open|filtered dhcps
  1849. 68/udp open|filtered dhcpc
  1850. 69/udp open|filtered tftp
  1851. 88/udp open|filtered kerberos-sec
  1852. 123/udp open|filtered ntp
  1853. 139/udp open|filtered netbios-ssn
  1854. 161/udp open|filtered snmp
  1855. 162/udp open|filtered snmptrap
  1856. 389/udp open|filtered ldap
  1857. 500/udp open|filtered isakmp
  1858. 520/udp open|filtered route
  1859. 2049/udp open|filtered nfs
  1860.  
  1861. Nmap done: 1 IP address (1 host up) scanned in 1.78 seconds
  1862. #######################################################################################################################################
  1863. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 04:45 EDT
  1864. NSE: [ftp-brute] usernames: Time limit 3m00s exceeded.
  1865. NSE: [ftp-brute] usernames: Time limit 3m00s exceeded.
  1866. NSE: [ftp-brute] passwords: Time limit 3m00s exceeded.
  1867. Nmap scan report for c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1868. Host is up (0.085s latency).
  1869.  
  1870. PORT STATE SERVICE VERSION
  1871. 21/tcp open ftp FileZilla ftpd 0.9.41 beta
  1872. | ftp-brute:
  1873. | Accounts: No valid accounts found
  1874. |_ Statistics: Performed 247 guesses in 181 seconds, average tps: 1.6
  1875. | ftp-syst:
  1876. |_ SYST: UNIX emulated by FileZilla
  1877. |_vulscan: ERROR: Script execution failed (use -d to debug)
  1878. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  1879. Device type: specialized|general purpose
  1880. Running (JUST GUESSING): AVtech embedded (87%), FreeBSD 6.X (87%)
  1881. OS CPE: cpe:/o:freebsd:freebsd:6.2
  1882. Aggressive OS guesses: AVtech Room Alert 26W environmental monitor (87%), FreeBSD 6.2-RELEASE (87%)
  1883. No exact OS matches for host (test conditions non-ideal).
  1884. Network Distance: 20 hops
  1885. Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
  1886.  
  1887. TRACEROUTE (using port 21/tcp)
  1888. HOP RTT ADDRESS
  1889. 1 31.52 ms 10.244.204.1
  1890. 2 61.24 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  1891. 3 61.37 ms irb-0.agg1.qc1.ca.m247.com (37.120.128.168)
  1892. 4 61.22 ms te-1-5-2-0.bb1.fra2.de.m247.com (82.102.29.44)
  1893. 5 61.29 ms ix-xe-11-1-1-0.tcore1.w6c-montreal.as6453.net (66.198.96.98)
  1894. 6 61.39 ms if-ae-12-2.tcore1.mtt-montreal.as6453.net (64.86.31.26)
  1895. 7 61.35 ms if-ae-0-2.tcore2.mtt-montreal.as6453.net (216.6.115.90)
  1896. 8 61.45 ms if-ae-5-2.tcore2.n0v-new-york.as6453.net (64.86.226.58)
  1897. 9 61.37 ms if-ae-2-2.tcore1.n0v-new-york.as6453.net (216.6.90.21)
  1898. 10 61.47 ms if-ae-7-2.tcore1.nto-new-york.as6453.net (63.243.128.25)
  1899. 11 50.11 ms if-ae-9-2.tcore1.n75-new-york.as6453.net (63.243.128.122)
  1900. 12 40.11 ms 66.110.96.150
  1901. 13 59.79 ms be-10390-cr02.newyork.ny.ibone.comcast.net (68.86.83.89)
  1902. 14 59.81 ms be-10203-cr01.newark.nj.ibone.comcast.net (68.86.85.185)
  1903. 15 59.82 ms be-7922-ar03.ivyland.pa.panjde.comcast.net (68.86.93.174)
  1904. 16 59.81 ms 68.86.211.122
  1905. 17 59.80 ms 162.151.182.174
  1906. 18 59.81 ms lag1-acr22.levittown.pa.panjde.comcast.net (68.85.78.58)
  1907. 19 ...
  1908. 20 79.65 ms c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1909. #######################################################################################################################################
  1910. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 04:49 EDT
  1911. NSE: Loaded 164 scripts for scanning.
  1912. NSE: Script Pre-scanning.
  1913. Initiating NSE at 04:49
  1914. Completed NSE at 04:49, 0.00s elapsed
  1915. Initiating NSE at 04:49
  1916. Completed NSE at 04:49, 0.00s elapsed
  1917. Initiating Parallel DNS resolution of 1 host. at 04:49
  1918. Completed Parallel DNS resolution of 1 host. at 04:49, 0.03s elapsed
  1919. Initiating SYN Stealth Scan at 04:49
  1920. Scanning c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227) [1 port]
  1921. Discovered open port 80/tcp on 68.81.58.227
  1922. Completed SYN Stealth Scan at 04:49, 0.10s elapsed (1 total ports)
  1923. Initiating Service scan at 04:49
  1924. Scanning 1 service on c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1925. Completed Service scan at 04:49, 6.11s elapsed (1 service on 1 host)
  1926. Initiating OS detection (try #1) against c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1927. Retrying OS detection (try #2) against c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1928. Initiating Traceroute at 04:49
  1929. Completed Traceroute at 04:49, 3.09s elapsed
  1930. Initiating Parallel DNS resolution of 19 hosts. at 04:49
  1931. Completed Parallel DNS resolution of 19 hosts. at 04:49, 0.27s elapsed
  1932. NSE: Script scanning 68.81.58.227.
  1933. Initiating NSE at 04:49
  1934. Completed NSE at 04:49, 26.57s elapsed
  1935. Initiating NSE at 04:49
  1936. Completed NSE at 04:49, 0.39s elapsed
  1937. Nmap scan report for c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  1938. Host is up (0.091s latency).
  1939.  
  1940. PORT STATE SERVICE VERSION
  1941. 80/tcp open http Apache httpd 2.4.25 ((Win32) OpenSSL/1.0.2j PHP/7.1.1)
  1942. | http-brute:
  1943. |_ Path "/" does not require authentication
  1944. |_http-chrono: Request times for /; avg: 432.70ms; min: 312.10ms; max: 583.81ms
  1945. |_http-csrf: Couldn't find any CSRF vulnerabilities.
  1946. |_http-date: Sat, 28 Sep 2019 08:49:28 GMT; -5s from local time.
  1947. |_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.
  1948. |_http-dombased-xss: Couldn't find any DOM based XSS.
  1949. |_http-drupal-enum: Nothing found amongst the top 100 resources,use --script-args number=<number|all> for deeper analysis)
  1950. |_http-errors: Couldn't find any error pages.
  1951. |_http-feed: Couldn't find any feeds.
  1952. |_http-fetch: Please enter the complete path of the directory to save data in.
  1953. | http-headers:
  1954. | Date: Sat, 28 Sep 2019 08:49:26 GMT
  1955. | Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1956. | X-Powered-By: PHP/7.1.1
  1957. | Connection: close
  1958. | Content-Type: text/html; charset=UTF-8
  1959. |
  1960. |_ (Request type: HEAD)
  1961. |_http-jsonp-detection: Couldn't find any JSONP endpoints.
  1962. |_http-litespeed-sourcecode-download: Request with null byte did not work. This web server might not be vulnerable
  1963. | http-methods:
  1964. |_ Supported Methods: GET HEAD POST OPTIONS
  1965. |_http-mobileversion-checker: No mobile version detected.
  1966. | http-php-version: Logo query returned unknown hash 493264b1ea71e8083a6356206999ff80
  1967. | Credits query returned unknown hash 493264b1ea71e8083a6356206999ff80
  1968. |_Version from header x-powered-by: PHP/7.1.1
  1969. |_http-security-headers:
  1970. |_http-server-header: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1971. | http-sitemap-generator:
  1972. | Directory structure:
  1973. | /
  1974. | Other: 1; png: 3; webmanifest: 1
  1975. | /assets/bootstrap/css/
  1976. | css: 1
  1977. | /assets/css/
  1978. | css: 6
  1979. | /assets/fonts/
  1980. | css: 1
  1981. | Longest directory structure:
  1982. | Depth: 3
  1983. | Dir: /assets/bootstrap/css/
  1984. | Total files found (by extension):
  1985. |_ Other: 1; css: 8; png: 3; webmanifest: 1
  1986. |_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
  1987. |_http-title: Newsfeed
  1988. | http-trace: TRACE is enabled
  1989. | Headers:
  1990. | Date: Sat, 28 Sep 2019 08:49:29 GMT
  1991. | Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  1992. | Connection: close
  1993. | Transfer-Encoding: chunked
  1994. |_Content-Type: message/http
  1995. | http-vhosts:
  1996. |_127 names had status 200
  1997. | http-vuln-cve2010-0738:
  1998. |_ /jmx-console/: Authentication was not required
  1999. |_http-vuln-cve2017-1001000: ERROR: Script execution failed (use -d to debug)
  2000. |_http-wordpress-enum: Nothing found amongst the top 100 resources,use --script-args search-limit=<number|all> for deeper analysis)
  2001. |_http-wordpress-users: [Error] Wordpress installation was not found. We couldn't find wp-login.php
  2002. |_http-xssed: No previously reported XSS vuln.
  2003. | vulners:
  2004. | cpe:/a:apache:http_server:2.4.25:
  2005. | CVE-2017-7679 7.5 https://vulners.com/cve/CVE-2017-7679
  2006. | CVE-2017-7668 7.5 https://vulners.com/cve/CVE-2017-7668
  2007. | CVE-2017-3169 7.5 https://vulners.com/cve/CVE-2017-3169
  2008. | CVE-2017-3167 7.5 https://vulners.com/cve/CVE-2017-3167
  2009. | CVE-2019-0211 7.2 https://vulners.com/cve/CVE-2019-0211
  2010. | CVE-2018-1312 6.8 https://vulners.com/cve/CVE-2018-1312
  2011. | CVE-2017-15715 6.8 https://vulners.com/cve/CVE-2017-15715
  2012. | CVE-2019-10082 6.4 https://vulners.com/cve/CVE-2019-10082
  2013. | CVE-2017-9788 6.4 https://vulners.com/cve/CVE-2017-9788
  2014. | CVE-2019-10098 5.8 https://vulners.com/cve/CVE-2019-10098
  2015. | CVE-2019-10081 5.0 https://vulners.com/cve/CVE-2019-10081
  2016. | CVE-2019-0220 5.0 https://vulners.com/cve/CVE-2019-0220
  2017. | CVE-2019-0196 5.0 https://vulners.com/cve/CVE-2019-0196
  2018. | CVE-2018-17199 5.0 https://vulners.com/cve/CVE-2018-17199
  2019. | CVE-2018-1333 5.0 https://vulners.com/cve/CVE-2018-1333
  2020. | CVE-2017-9798 5.0 https://vulners.com/cve/CVE-2017-9798
  2021. | CVE-2017-7659 5.0 https://vulners.com/cve/CVE-2017-7659
  2022. | CVE-2017-15710 5.0 https://vulners.com/cve/CVE-2017-15710
  2023. | CVE-2019-0197 4.9 https://vulners.com/cve/CVE-2019-0197
  2024. | CVE-2019-10092 4.3 https://vulners.com/cve/CVE-2019-10092
  2025. | CVE-2018-11763 4.3 https://vulners.com/cve/CVE-2018-11763
  2026. |_ CVE-2018-1283 3.5 https://vulners.com/cve/CVE-2018-1283
  2027. |_vulscan: ERROR: Script execution failed (use -d to debug)
  2028. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  2029. Device type: specialized|general purpose
  2030. Running (JUST GUESSING): AVtech embedded (87%), FreeBSD 6.X (87%)
  2031. OS CPE: cpe:/o:freebsd:freebsd:6.2
  2032. Aggressive OS guesses: AVtech Room Alert 26W environmental monitor (87%), FreeBSD 6.2-RELEASE (87%)
  2033. No exact OS matches for host (test conditions non-ideal).
  2034. Network Distance: 20 hops
  2035. TCP Sequence Prediction: Difficulty=258 (Good luck!)
  2036. IP ID Sequence Generation: Incremental
  2037.  
  2038. TRACEROUTE (using port 80/tcp)
  2039. HOP RTT ADDRESS
  2040. 1 51.19 ms 10.244.204.1
  2041. 2 71.05 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  2042. 3 71.06 ms irb-0.agg1.qc1.ca.m247.com (37.120.128.168)
  2043. 4 71.04 ms te-1-5-2-0.bb1.fra2.de.m247.com (82.102.29.44)
  2044. 5 71.06 ms ix-xe-11-1-1-0.tcore1.w6c-montreal.as6453.net (66.198.96.98)
  2045. 6 71.11 ms if-ae-12-2.tcore1.mtt-montreal.as6453.net (64.86.31.26)
  2046. 7 71.11 ms if-ae-0-2.tcore2.mtt-montreal.as6453.net (216.6.115.90)
  2047. 8 71.15 ms if-ae-5-2.tcore2.n0v-new-york.as6453.net (64.86.226.58)
  2048. 9 71.14 ms if-ae-2-2.tcore1.n0v-new-york.as6453.net (216.6.90.21)
  2049. 10 29.99 ms if-ae-7-5.tcore1.nto-new-york.as6453.net (63.243.128.141)
  2050. 11 60.35 ms if-ae-9-2.tcore1.n75-new-york.as6453.net (63.243.128.122)
  2051. 12 50.40 ms 66.110.96.146
  2052. 13 49.87 ms be-10390-cr02.newyork.ny.ibone.comcast.net (68.86.83.89)
  2053. 14 49.88 ms be-10203-cr01.newark.nj.ibone.comcast.net (68.86.85.185)
  2054. 15 49.90 ms be-7922-ar03.ivyland.pa.panjde.comcast.net (68.86.93.174)
  2055. 16 49.91 ms 68.86.211.122
  2056. 17 49.88 ms 162.151.182.174
  2057. 18 49.92 ms lag1-acr22.levittown.pa.panjde.comcast.net (68.85.78.58)
  2058. 19 ...
  2059. 20 69.70 ms c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  2060.  
  2061. NSE: Script Post-scanning.
  2062. Initiating NSE at 04:49
  2063. Completed NSE at 04:49, 0.00s elapsed
  2064. Initiating NSE at 04:49
  2065. Completed NSE at 04:49, 0.00s elapsed
  2066. #######################################################################################################################################
  2067. http://68.81.58.227 [200 OK] Apache[2.4.25], Country[UNITED STATES][US], HTML5, HTTPServer[Windows (32 bit)][Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1], IP[68.81.58.227], Meta-Refresh-Redirect[./login.php], Open-Graph-Protocol[website], OpenSSL[1.0.2j], PHP[7.1.1], Script, Title[Newsfeed], X-Powered-By[PHP/7.1.1]
  2068. http://68.81.58.227/login.php [200 OK] Apache[2.4.25], Country[UNITED STATES][US], HTML5, HTTPServer[Windows (32 bit)][Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1], IP[68.81.58.227], JQuery, Open-Graph-Protocol[website], OpenSSL[1.0.2j], PHP[7.1.1], PasswordField[password], Script[text/javascript], Title[Login to Führernet], X-Powered-By[PHP/7.1.1]
  2069. #######################################################################################################################################
  2070.  
  2071. wig - WebApp Information Gatherer
  2072.  
  2073.  
  2074. Scanning http://68.81.58.227...
  2075. ____________________ SITE INFO ____________________
  2076. IP Title
  2077. 68.81.58.227 Newsfeed
  2078.  
  2079. _____________________ VERSION _____________________
  2080. Name Versions Type
  2081. Apache 2.4.25 Platform
  2082. PHP 7.1.1 Platform
  2083. openssl 1.0.2j Platform
  2084. FreeBSD 10 | 11 OS
  2085. openSUSE tumbleweed OS
  2086.  
  2087. ___________________ INTERESTING ___________________
  2088. URL Note Type
  2089. /test.html Test file Interesting
  2090. /login.php Login Page Interesting
  2091. /phpinfo.php PHP info file Interesting
  2092. /test/ Test directory Interesting
  2093.  
  2094. ___________________________________________________
  2095. Time: 29.6 sec Urls: 846 Fingerprints: 40401
  2096. #######################################################################################################################################
  2097. HTTP/1.1 200 OK
  2098. Date: Sat, 28 Sep 2019 08:50:27 GMT
  2099. Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  2100. X-Powered-By: PHP/7.1.1
  2101. Content-Type: text/html; charset=UTF-8
  2102.  
  2103. HTTP/1.1 200 OK
  2104. Date: Sat, 28 Sep 2019 08:50:27 GMT
  2105. Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1
  2106. X-Powered-By: PHP/7.1.1
  2107. Content-Type: text/html; charset=UTF-8
  2108. #######################################################################################################################################
  2109. https://68.81.58.227 [200 OK] Apache[2.4.25], Country[UNITED STATES][US], HTML5, HTTPServer[Windows (32 bit)][Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1], IP[68.81.58.227], Meta-Refresh-Redirect[./login.php], Open-Graph-Protocol[website], OpenSSL[1.0.2j], PHP[7.1.1], Script, Title[Newsfeed], X-Powered-By[PHP/7.1.1]
  2110. https://68.81.58.227/login.php [200 OK] Apache[2.4.25], Country[UNITED STATES][US], HTML5, HTTPServer[Windows (32 bit)][Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/7.1.1], IP[68.81.58.227], JQuery, Open-Graph-Protocol[website], OpenSSL[1.0.2j], PHP[7.1.1], PasswordField[password], Script[text/javascript], Title[Login to Führernet], X-Powered-By[PHP/7.1.1]
  2111. #######################################################################################################################################
  2112. Version: 1.11.13-static
  2113. OpenSSL 1.0.2-chacha (1.0.2g-dev)
  2114.  
  2115. Connected to 68.81.58.227
  2116.  
  2117. Testing SSL server 68.81.58.227 on port 443 using SNI name 68.81.58.227
  2118.  
  2119. TLS Fallback SCSV:
  2120. Server supports TLS Fallback SCSV
  2121.  
  2122. TLS renegotiation:
  2123. Secure session renegotiation supported
  2124.  
  2125. TLS Compression:
  2126. Compression disabled
  2127.  
  2128. Heartbleed:
  2129. TLS 1.2 not vulnerable to heartbleed
  2130. TLS 1.1 not vulnerable to heartbleed
  2131. TLS 1.0 not vulnerable to heartbleed
  2132.  
  2133. Supported Server Cipher(s):
  2134. Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve P-256 DHE 256
  2135. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA384 Curve P-256 DHE 256
  2136. Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  2137. Accepted TLSv1.2 256 bits DHE-RSA-AES256-GCM-SHA384 DHE 1024 bits
  2138. Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA256 DHE 1024 bits
  2139. Accepted TLSv1.2 256 bits DHE-RSA-AES256-SHA DHE 1024 bits
  2140. Accepted TLSv1.2 256 bits DHE-RSA-CAMELLIA256-SHA DHE 1024 bits
  2141. Accepted TLSv1.2 256 bits AES256-GCM-SHA384
  2142. Accepted TLSv1.2 256 bits AES256-SHA256
  2143. Accepted TLSv1.2 256 bits AES256-SHA
  2144. Accepted TLSv1.2 256 bits CAMELLIA256-SHA
  2145. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve P-256 DHE 256
  2146. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA256 Curve P-256 DHE 256
  2147. Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  2148. Accepted TLSv1.2 128 bits DHE-RSA-AES128-GCM-SHA256 DHE 1024 bits
  2149. Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA256 DHE 1024 bits
  2150. Accepted TLSv1.2 128 bits DHE-RSA-AES128-SHA DHE 1024 bits
  2151. Accepted TLSv1.2 128 bits DHE-RSA-CAMELLIA128-SHA DHE 1024 bits
  2152. Accepted TLSv1.2 128 bits AES128-GCM-SHA256
  2153. Accepted TLSv1.2 128 bits AES128-SHA256
  2154. Accepted TLSv1.2 128 bits AES128-SHA
  2155. Accepted TLSv1.2 128 bits CAMELLIA128-SHA
  2156. Accepted TLSv1.2 128 bits DHE-RSA-SEED-SHA DHE 1024 bits
  2157. Accepted TLSv1.2 128 bits SEED-SHA
  2158. Accepted TLSv1.2 128 bits IDEA-CBC-SHA
  2159. Accepted TLSv1.2 112 bits ECDHE-RSA-DES-CBC3-SHA Curve P-256 DHE 256
  2160. Accepted TLSv1.2 112 bits EDH-RSA-DES-CBC3-SHA DHE 1024 bits
  2161. Accepted TLSv1.2 112 bits DES-CBC3-SHA
  2162. Preferred TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  2163. Accepted TLSv1.1 256 bits DHE-RSA-AES256-SHA DHE 1024 bits
  2164. Accepted TLSv1.1 256 bits DHE-RSA-CAMELLIA256-SHA DHE 1024 bits
  2165. Accepted TLSv1.1 256 bits AES256-SHA
  2166. Accepted TLSv1.1 256 bits CAMELLIA256-SHA
  2167. Accepted TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  2168. Accepted TLSv1.1 128 bits DHE-RSA-AES128-SHA DHE 1024 bits
  2169. Accepted TLSv1.1 128 bits DHE-RSA-CAMELLIA128-SHA DHE 1024 bits
  2170. Accepted TLSv1.1 128 bits AES128-SHA
  2171. Accepted TLSv1.1 128 bits CAMELLIA128-SHA
  2172. Accepted TLSv1.1 128 bits DHE-RSA-SEED-SHA DHE 1024 bits
  2173. Accepted TLSv1.1 128 bits SEED-SHA
  2174. Accepted TLSv1.1 128 bits IDEA-CBC-SHA
  2175. Accepted TLSv1.1 112 bits ECDHE-RSA-DES-CBC3-SHA Curve P-256 DHE 256
  2176. Accepted TLSv1.1 112 bits EDH-RSA-DES-CBC3-SHA DHE 1024 bits
  2177. Accepted TLSv1.1 112 bits DES-CBC3-SHA
  2178. Preferred TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve P-256 DHE 256
  2179. Accepted TLSv1.0 256 bits DHE-RSA-AES256-SHA DHE 1024 bits
  2180. Accepted TLSv1.0 256 bits DHE-RSA-CAMELLIA256-SHA DHE 1024 bits
  2181. Accepted TLSv1.0 256 bits AES256-SHA
  2182. Accepted TLSv1.0 256 bits CAMELLIA256-SHA
  2183. Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve P-256 DHE 256
  2184. Accepted TLSv1.0 128 bits DHE-RSA-AES128-SHA DHE 1024 bits
  2185. Accepted TLSv1.0 128 bits DHE-RSA-CAMELLIA128-SHA DHE 1024 bits
  2186. Accepted TLSv1.0 128 bits AES128-SHA
  2187. Accepted TLSv1.0 128 bits CAMELLIA128-SHA
  2188. Accepted TLSv1.0 128 bits DHE-RSA-SEED-SHA DHE 1024 bits
  2189. Accepted TLSv1.0 128 bits SEED-SHA
  2190. Accepted TLSv1.0 128 bits IDEA-CBC-SHA
  2191. Accepted TLSv1.0 112 bits ECDHE-RSA-DES-CBC3-SHA Curve P-256 DHE 256
  2192. Accepted TLSv1.0 112 bits EDH-RSA-DES-CBC3-SHA DHE 1024 bits
  2193. Accepted TLSv1.0 112 bits DES-CBC3-SHA
  2194.  
  2195. SSL Certificate:
  2196. Signature Algorithm: sha1WithRSAEncryption
  2197. RSA Key Strength: 1024
  2198.  
  2199. Subject: localhost
  2200. Issuer: localhost
  2201.  
  2202. Not valid before: Nov 10 23:48:47 2009 GMT
  2203. Not valid after: Nov 8 23:48:47 2019 GMT
  2204. #######################################################################################################################################
  2205. Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-28 04:51 EDT
  2206. Nmap scan report for c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  2207. Host is up (0.077s latency).
  2208.  
  2209. PORT STATE SERVICE VERSION
  2210. 3306/tcp open mysql MariaDB (unauthorized)
  2211. | mysql-brute:
  2212. | Accounts: No valid accounts found
  2213. |_ Statistics: Performed 9415 guesses in 244 seconds, average tps: 60.1
  2214. |_mysql-empty-password: Host '176.113.74.60' is not allowed to connect to this MariaDB server
  2215. | mysql-enum:
  2216. | Accounts: No valid accounts found
  2217. |_ Statistics: Performed 10 guesses in 1 seconds, average tps: 10.0
  2218. |_mysql-vuln-cve2012-2122: ERROR: Script execution failed (use -d to debug)
  2219. |_vulscan: ERROR: Script execution failed (use -d to debug)
  2220. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
  2221. Device type: general purpose|router
  2222. Running (JUST GUESSING): FreeBSD 6.X (87%), Linksys embedded (86%)
  2223. OS CPE: cpe:/o:freebsd:freebsd:6.2
  2224. Aggressive OS guesses: FreeBSD 6.2-RELEASE (87%), Linksys BEFSR41 EtherFast router (86%)
  2225. No exact OS matches for host (test conditions non-ideal).
  2226. Network Distance: 20 hops
  2227.  
  2228. TRACEROUTE (using port 3306/tcp)
  2229. HOP RTT ADDRESS
  2230. 1 49.43 ms 10.244.204.1
  2231. 2 69.07 ms vlan102.as02.qc1.ca.m247.com (176.113.74.17)
  2232. 3 69.10 ms irb-0.agg1.qc1.ca.m247.com (37.120.128.168)
  2233. 4 69.04 ms te-1-5-2-0.bb1.fra2.de.m247.com (82.102.29.44)
  2234. 5 69.08 ms ix-xe-11-1-1-0.tcore1.w6c-montreal.as6453.net (66.198.96.98)
  2235. 6 69.17 ms if-ae-12-2.tcore1.mtt-montreal.as6453.net (64.86.31.26)
  2236. 7 69.16 ms if-ae-0-2.tcore2.mtt-montreal.as6453.net (216.6.115.90)
  2237. 8 69.20 ms if-ae-5-2.tcore2.n0v-new-york.as6453.net (64.86.226.58)
  2238. 9 69.16 ms if-ae-2-2.tcore1.n0v-new-york.as6453.net (216.6.90.21)
  2239. 10 29.39 ms if-ae-7-5.tcore1.nto-new-york.as6453.net (63.243.128.141)
  2240. 11 58.46 ms if-ae-9-2.tcore1.n75-new-york.as6453.net (63.243.128.122)
  2241. 12 58.44 ms 66.110.96.150
  2242. 13 58.31 ms be-10390-cr02.newyork.ny.ibone.comcast.net (68.86.83.89)
  2243. 14 58.31 ms be-10203-cr01.newark.nj.ibone.comcast.net (68.86.85.185)
  2244. 15 58.28 ms be-7922-ar03.ivyland.pa.panjde.comcast.net (68.86.93.174)
  2245. 16 58.31 ms 68.86.211.122
  2246. 17 58.19 ms 162.151.182.174
  2247. 18 58.31 ms lag1-acr22.levittown.pa.panjde.comcast.net (68.85.78.58)
  2248. 19 ...
  2249. 20 78.05 ms c-68-81-58-227.hsd1.pa.comcast.net (68.81.58.227)
  2250. #######################################################################################################################################
  2251. Anonymous JTSEC #OpDomesticTerrorism Full Recon #3
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!