LIZARDPATROL/EXPLOITS

WELCOME TO THE EXPLOITATION OF / THE LIZARDPATROL.COM / ANONYMOUS WILL PULL YOU APART BIT BY BIT .CLOUDFARE SERVERS WONT SAVE YOU' YOUR LIFES AND FAMILYS PROFILES ARE ALL OVER THE NET ? THINK B4 YOU STEP UP WITH ANONYMOUS . EXPLOIT TEST BY ANON-CAT-NINJA ' CONE-CAT-NINJA'S & INFOSEC-CAT-NINJA'S & GHOST-CAT-NINJA'S & LULZ-CAT-NINJA'S OF THE ANONYMOUS FAMILY WORLD-WIDE 'FRONT LINE SOLDIERS OF THE CYBER HIVE./

WE ARE ANONYMOUS
WE ARE LEGION
WE ARE GHOSTS OF THE CYBERHIVE
WE OWN THIS B_T_H .( EXCUSE MY MANNERS )

http://lizardpatrol.com/  STAY THE  F_ _k AWAY FROM TOR NETWORK LIZARDS >

IP Address 	108.162.194.108  <<cloudflare-nginx >>

Server Type 	cloudflare-nginx

Server:cloudflare-nginx
IP Address:108.162.193.14
Port:443
Hostname:lizardpatrol.com

scan report for 108.162.194.108 <<< cloudflare-nginx)
Host is up (0.015s latency).
PORT     STATE    SERVICE
80/tcp   open     http
25/tcp   open     smtp

lizardpatrol.com
IP Address	Location	IP Address Owner	Last seen on this IP
127.0.0.1	Reserved	Internet Assigned Numbers Authority 	2014-12-27

traceroute to lizardpatrol.com (127.0.0.1),

Hostname:
sni78862.cloudflaressl.com, *.barnardhealth.us, *.blckur.com, *.cpatut.com, *.downloadall.us, *.lizardpatrol.com, *.lizardsquad.ru, *.netvalues.biz, *.pritunl.co, *.watdahack.com, *.xemluon.com, barnardhealth.us, blckur.com, cpatut.com, downloadall.us, lizardpatrol.com, lizardsquad.ru, netvalues.biz, pritunl.co, watdahack.com, xemluon.com
----------------------------------------------------------------------------------------------------------------------------------------------------------
HTTP Headers for lizardpatrol.com
==============

HTTP/1.1 200 OK
Date: Sat, 27 Dec 2014 08:52:20 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html
---------------------------------------------------------------------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------------------------------------------------------------------
Data for lizardpatrol.com << CloudFare wont save you > Lol

plato.ns.cloudflare.com
marjory.ns.cloudflare.com

A direct-connect IP address was found: lizardpatrol.com 5.39.90.132 FRANCE <<<<<<<<<<<<<,

2014-12-08: lizardpatrol.com 5.39.90.132 FRANCE

Some CloudFlare-user domains with a direct-connect IP address in  5.39.90.0/24

5.39.90.129    chilli943.tk
5.39.90.132    lizardpatrol.com <<<<<<
------------------------------------------------------------------------------
2014-12-08: lizardpatrol.com 37.187.112.166 FRANCE <<<<<<<<<<<<<

Some CloudFlare-user domains with a direct-connect IP address in  37.187.112.0/24

37.187.112.115    evildeathnightmare.com
37.187.112.115    teamgamerfood.com
37.187.112.134    athostyou.com
37.187.112.134    guiedo.com
37.187.112.14    cdnhttps.com
37.187.112.166    lizardpatrol.com <<<<<
-------------------------------------------------------------------------------
2014-12-08: lizardpatrol.com 198.100.144.122 CANADA <<<<<<<<<<

Some CloudFlare-user domains with a direct-connect IP address in  198.100.144.0/24

198.100.144.106    canspace.ca
198.100.144.122    lizardpatrol.com <<<<<
--------------------------------------------------------------------------------------------------------------------------------------------------------
108.162.194.108

9 site(s) hosted on ip 108.162.194.108
Location:   San Francisco,United States

    moodle.com
    mp4.ma
    thinkmuscle.com
    buildingfree.com
    parishotelneva.com
    carthage-cafe.com
    degracaemaisgostoso.org
    hotidols.org
    gueulardiere.com
------------------------------------------------------------------------------------------------------------------------------------------------------
The server header for the remote web server is: "cloudflare-nginx"
GET http://lizardpatrol.com/ HTTP/1.1
Host: lizardpatrol.com
Cookie: __cfduid=d0fdaff42537a979967319debeb60daea1419676765

The URL "http://lizardpatrol.com/" has the following allowed methods: *.

DAV seems to be correctly configured and allowing you to use the PUT method but the directory does not have the correct permissions that would allow the web server to write to it. This error was found at: "http://lizardpatrol.com/UeUvq".
PUT http://lizardpatrol.com/UeUvq HTTP/1.1
Host: lizardpatrol.com
Cookie: __cfduid=d0fdaff42537a979967319debeb60daea1419676765

The target site has no DNS wildcard, and the contents of http://www.lizardpatrol.com/ differ from the contents of http://lizardpatrol.com.
GET http://www.lizardpatrol.com/ HTTP/1.1
Host: www.lizardpatrol.com
Cookie: __cfduid=d4a4932117d9590129bbeaaf46c8061601419677038

The contents of http://108.162.192.14 differ from the contents of http://lizardpatrol.com
GET http://108.162.192.14 HTTP/1.1
Host: 108.162.192.14

The remote web server seems to have a reverse proxy installed.
GET http://lizardpatrol.com/ HTTP/1.1
Host: lizardpatrol.com
Cookie: __cfduid=d4a4932117d9590129bbeaaf46c8061601419677038

The URL: "http://lizardpatrol.com/" sent the cookie: "__cfduid=d4377f7e9defcb7edff9feb5fc3fab2431419677413; expires=Sun, 27-Dec-15 10:50:13 GMT; path=/; domain=.lizardpatrol.com; HttpOnly"
GET http://lizardpatrol.com/ HTTP/1.1
Host: lizardpatrol.com

The remote web server sent the HTTP header: "CF-RAY" with value: "19f4ebdac6cb04b6-SYD"
GET http://lizardpatrol.com/ HTTP/1.1
Host: lizardpatrol.com

The URL: "http://lizardpatrol.com/" returned a response that may contain a "SHA1" hash. The hash is: "b56d376c2628fb7d441c15576fbcfa79ff8ccf6a".
GET http://lizardpatrol.com/ HTTP/1.1
Host: lizardpatrol.com

The mail account: "[email protected]" was found in: "http://www.google.com/[email protected]&start=60&sa=N&hl=en".

The URL "http://lizardpatrol.com/" has the following allowed methods: *, GET, HEAD.
GET http://lizardpatrol.com/ HTTP/1.1
Host: lizardpatrol.com
Cookie: __cfduid=d1e2c6188103bcb50c7bf52a84c30d3451419677791

[email protected]
----------------------------------------------------------------
Cross Site Request Forgery:<<<

URL  http://chat-1.lizardpatrol.com/

URL  http://chat-1.lizardpatrol.com/kiwi

URL  http://chat-2.lizardpatrol.com/

URL  http://chat-3.lizardpatrol.com/

----------------------------------------------------------------
X-Frame-Options header not set << 'ClickJacking' attacks .

URL  http://chat-1.lizardpatrol.com/

URL  http://chat-1.lizardpatrol.com/kiwi/assets/css/font-awesome.min.css

URL  http://chat-1.lizardpatrol.com/cdn-cgi/nexp/dok2v=1613a3a185/cloudflare/rocket.js

URL  http://chat-3.lizardpatrol.com/cdn-cgi/pe/bag2?r%5B%5D=http%3A%2F%2Fchat-3.lizardpatrol.com%2Fcdn-cgi%2Fnexp%2Fdok2v%3D1613a3a185%2Fapps%              2Freset_the_net.js

URL  http://chat.lizardpatrol.com/cdn-cgi/nexp/dok2v=1613a3a185
----------------------------------------------------------------------
Password Autocomplete in browser <<  HTML FORM/INPUT element containing password type input. Passwords may be stored in browsers and retrieved.

URL  http://chat-1.lizardpatrol.com/kiwi

Parameter  input

URL  http://chat-2.lizardpatrol.com/

Parameter  input

URL  http://chat-3.lizardpatrol.com/

Parameter  input
----------------------------------------------------------------------------------------------------------------------------------------------------------
EXPLOITS:

The whole target has no protection (X-Frame-Options header) against ClickJacking attack

Sessions may be vulnerable to BEAST attack
Attackers may be able to decrypt the encrypted SSL traffic

Server has not enabled HTTP Strict-Transport-Security
Users may be exposed to man-in-the-middle attacks

Server has not yet upgraded to a Extended Validation certificate
Increase customer confidence by offering visitors the highest level of assurance

HTTP Tests:

Strict Transport Security:Fail <<<<<<
Mixed Content (HTTP and HTTPS):Timed Out <<<<<<
Domain name resolves to IPv4 address:Pass
Domain name resolves to IPv6 address:Pass